Still got Google Analytics on the page. I do not feel that reporting every online interaction I have with my government in the UK, back to a huge corporate in the US, is in any way appropriate. But I can't even get anyone to engage on the issue. When I tried to raise it I got directed to a helpdesk ticket on a site run by an SV helpdesk-as-a-service company. I appreciate that gov.uk have done some great stuff getting…
GDS’s GA Premium account contractually prevents Google from investigating the data, and Google self-anonymises with a flag in their API[1]. If you don’t trust them then that’s fine, but for functionality vs cost it seems to be the best option. For what it’s worth, for extremely sensitive projects like GOV.UK Verify other options are fine; Verify uses a local Piwik instance. You’re also welcome to block that specific…
What's the penalty for completely disregarding that?
Is it anywhere near large enough to justify them not disregarding it?
More to the point: Pretty much the only thing a contract can do is impose a monetary penalty. Even if it's quite large, it's still only money, and Google rakes in money by the bushel basket from selling data to advertisers. Therefore, it isn't a very convincing penalty.