In an e-mail sent yesterday to all Google Analytics Administrators, Google announced that changes to GA data are coming in preparation for the new EU GDPR set to go live on 25 May 2018.

Key points:

• Changes will apply Google-wide, even if you have no users in the EU or the EEA. (Go here for a list of EU and EEA countries.)
• New "granular data retention controls" will let you manage how long non-aggregated user and event data are retained by Google.
• Google will delete older data according to the retention period you set.
• Google is creating an automated user deletion tool with which you'll be able to delete all data for any individual user from your properties.
• GDPR-related changes/amendments to your contracts for Google products will become effective 25 May.
• If you're based outside the EEA, updated data processing terms are available for review/acceptance in your GA accounts. If you're based in the EEA, your contracts already include updated data-processing terms.
• If using Google "advertising features" you must comply with the User Consent Policy for EEA users which Google is now updating to reflect legal requirements of the GDPR.
• Here for your reading pleasure are the Google Ads Data Processing Terms.

That "user deletion tool" looks like a very key element of this, because at least some legal experts interpret a provision of the GDPR to mean that if prior to 25 May 2018 you acquired the consent to be contacted of any person located in the EEA, before contacting them again after 25 May you must go back to that person and get that consent confirmed; or failing that, assume consent is terminated and delete any personal data you may have on that person, including any data acquired through a Google product.

That could involve a lot of work.