[Important Notice] Data processing terms for the General Data Protection Regulation (GDPR) available for review / acceptance

Dear Customer, Over the past year we've shared how we are preparing to meet the requirements of the GDPR, the new data protection law coming into force on May 25, 2018. It affects European and non-European businesses using online advertising and measurement solutions when their sites and apps are accessed by users in the European Economic Area (EEA). We would like to ensure you are aware of updated data processing terms and a new contact collection mechanism for your Google Analytics Suite Products (Standard and 360 versions). If you service users in the EEA (or are based in Switzerland, where our updated terms are also relevant), or are otherwise subject to the GDPR, please review and accept these terms and provide related contact information. If you do not service users in the EEA or are not based in Switzerland, you may disregard the rest of this email. Step 1: Review and accept the updated data processing terms in each account for each product you manage in the Google Analytics Suite: Google Analytics / Analytics 360: Admin > Account > Account Settings (scroll to bottom of page) Google Optimize / Optimize 360: Edit Account Details > (scroll to bottom of page) Google Tag Manager / Tag Manager 360: Account Settings > (scroll to bottom of page) Google Attribution / Attribution 360: Admin > Account Settings > (scroll to bottom of page) Google Data Studio: User Settings > Account and Privacy (acceptance managed on a user basis) Additional information about accepting these terms: All clients using 360 products, clients using Data Studio, and clients using standard versions of Tag Manager or Optimize whose accounts were created before March 12, 2018, can review and accept data processing terms in their account(s). For clients based in the EEA or Switzerland, updated data processing terms have already been included in online terms for all Google Analytics and Attribution accounts and for Tag Manager and Optimize accounts created on or after March 12, 2018. For clients based outside of the EEA or Switzerland, data processing terms can be reviewed and accepted in the UIs of each account. Once you accept the new data processing terms, they'll supplement your current contract or Terms of Service and will take effect on May 25, 2018 If you contract through a Sales Partner for any 360 products within the Google Analytics Suite, you should seek advice from the parties with whom you contract. If you are located in Germany, the Hamburg Data Protection Authority has been informed of these new data processing terms. Step 2: Provide your legal entity and contact details for notifications we may need to send under the GDPR (e.g. subprocessor appointment): For Analytics, Optimize, Tag Manager and Attribution, you can provide the contact details within Suite Home ( "Organization Settings" >"Data Processing Amendment - Details"). Learn more. For Data Studio, the contact collection mechanism exists in Data Studio only (not in Suite Home) and is available at User Settings > Account and Privacy. Learn more. Find Out More You can refer to privacy.google.com/businesses to learn more about Google's data privacy policies and approach. Sincerely, The Google Analytics Suite Team

Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043 You have received this mandatory email service announcement to update you about important changes to your Google Analytics product or account.

[Action Required] Important updates on Google Analytics Data Retention and the General Data Protection Regulation (GDPR)

Dear Google Analytics Administrator, Over the past year we've shared how we are preparing to meet the requirements of the GDPR, the new data protection law coming into force on May 25, 2018. Today we are sharing more about important product changes that may impact your Google Analytics data, and other updates in preparation for the GDPR. This e-mail requires your attention and action even if your users are not based in the European Economic Area (EEA). Product Updates Today we introduced granular data retention controls that allow you to manage how long your user and event data is held on our servers. Starting May 25, 2018, user and event data will be retained according to these settings; Google Analytics will automatically delete user and event data that is older than the retention period you select. Note that these settings will not affect reports based on aggregated data. Action: Please review these data retention settings and modify as needed. Before May 25, we will also introduce a new user deletion tool that allows you to manage the deletion of all data associated with an individual user (e.g. site visitor) from your Google Analytics and/or Analytics 360 properties. This new automated tool will work based on any of the common identifiers sent to Analytics Client ID (i.e. standard Google Analytics first party cookie), User ID (if enabled), or App Instance ID (if using Google Analytics for Firebase). Details will be available on our Developers site shortly. As always, we remain committed to providing ways to safeguard your data. Google Analytics and Analytics 360 will continue to offer a number of other features and policies around data collection, use, and retention to assist you in safeguarding your data. For example, features for customizable cookie settings, privacy controls, data sharing settings, data deletion on account termination, and IP anonymization may prove useful as you evaluate the impact of the GDPR for your company's unique situation and Analytics implementation. Contract And User Consent Related Updates Contract changes Google has been rolling out updates to our contractual terms for many products since last August, reflecting Google's status as either data processor or data controller under the new law (see full classification of our Ads products). The new GDPR terms will supplement your current contract with Google and will come into force on May 25, 2018. In both Google Analytics and Analytics 360, Google operates as a processor of personal data that is handled in the service. For Google Analytics clients based outside the EEA and all Analytics 360 customers, updated data processing terms are available for your review/acceptance in your accounts (Admin ➝ Account Settings). For Google Analytics clients based in the EEA, updated data processing terms have already been included in your terms. If you don't contract with Google for your use of our measurement products, you should seek advice from the parties with whom you contract. Updated EU User Consent Policy Per our advertising features policy, both Google Analytics and Analytics 360 customers using advertising features must comply with Google's EU User Consent Policy. Google's EU User Consent Policy is being updated to reflect new legal requirements of the GDPR. It sets out your responsibilities for making disclosures to, and obtaining consent from, end users of your sites and apps in the EEA. Action: Even if you are not based in the EEA, please consider together with your legal department or advisors, whether your business will be in scope of the GDPR when using Google Analytics and Analytics 360 and review/accept the updated data processing terms as well as define your path for compliance with the EU User Consent Policy. Find Out More You can refer to privacy.google.com/businesses to learn more about Google's data privacy policies and approach, as well as view our data processing terms. We will continue to share further information on our plans in the coming weeks and will update relevant developer and help center documentation where necessary. Thanks, The Google Analytics Team Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043 You have received this mandatory email service announcement to update you about important changes to your Google Analytics product or account.