Data privacy & security Archives

June 24, 2025

EU hosting vs. EU sovereignty: Why the difference matters for privacy-first analytics

As EU-US data transfer tensions continue to evolve, driven by legal uncertainties and heightened regulatory scrutiny, organizations are under increasing pressure to make informed decisions about where and how their analytics data is stored. The collapse of previous data transfer frameworks and the uncertain future of the current EU-U.S. Data Privacy Framework have made one…
Read more
May 2, 2025

PHI and PII: How they impact HIPAA compliance and your marketing strategy

Personally identifiable information (PII) and protected health information (PHI) may seem similar. However, there are critical distinctions between the two. While PII is a catch-all term for any information that can be associated with an individual, PHI applies specifically to HIPAA-covered entities dealing with identifiable patient information. Keeping HIPAA compliant and protecting patient information requires…
Read more
April 25, 2025

EU-US data transfers uncertainties: How an EU-based analytics platform can improve your marketing performance

European digital marketers are facing unprecedented levels of disruption. Increasing regulatory scrutiny and growing doubts about the legality of EU-US data transfers demand an urgent reassessment of your tech stack. In the very near future, relying on US-based analytics and consent platforms will expose your organization to operational, legal, and financial risks that can no…
Read more
March 19, 2025

Norwegian DPA warns against EU-US data transfers – what it means for your website analytics

If your company relies on Google Analytics or other US-based analytics tools, you may soon be putting your data compliance at risk. In February 2025, Norway’s Data Protection Authority (Datatilsynet) issued new guidance on data transfers to the United States, highlighting growing concerns about the legal framework supporting these transfers – the EU-US Data Transfer…
Read more
February 19, 2025

Everything you need to know about the New York Health Information Privacy Act (NYHIPA)

On January 22, 2025, the New York Assembly passed Senate Bill S929, also known as the New York Health Information Privacy Act (NYHIPA). The bill now awaits Governor Kathy Hochul’s signature. The new legislation adopts novel provisions that would make this one of the most stringent privacy laws in the US. It introduces an expansive…
Read more
November 5, 2024

How do Google’s Enhanced Conversions and Meta’s Advanced Matching impact analytics

Privacy regulations such as GDPR and CCPA have significantly changed how companies can track and measure user interactions online. Additionally, the rise of adblockers and browser tracking restrictions limit the use of third-party cookies on the web. Users are blocking and deleting cookies due to a lack of trust in the AdTech industry and what…
Read more
October 25, 2024

The AHA’s lawsuit against HHS guidance on online tracking technologies: What it means for HIPAA-covered entities and their use of analytics

On June 20, 2024, a US district court ruled in favor of the American Hospital Association’s (AHA) lawsuit against the Department of Health and Human Services (HHS) bulletin on using online tracking technologies, declaring it beyond agency authority. The 2022 bulletin sought to inform entities regulated under HIPAA of their obligations concerning the use of…
Read more
October 2, 2024

25 years of digital analytics with Brian Clifton: Being data-informed, not just data-driven

As organizations increasingly rely on data in their business decisions, the challenges of ensuring data accuracy, consistency, and ethical collection are becoming more and more important. Along with understanding the audience’s needs, supporting collaboration between teams, and securing privacy compliance, these challenges have evolved into data collection and analytics priorities. Let’s dive into the third…
Read more
August 6, 2024

What is PII, non-PII, and personal data? [UPDATED]

Personally identifiable information (PII) and personal data are two classifications of data that often confuse organizations that collect, store and analyze such data. Both terms cover common ground, classifying information that could reveal an individual’s identity directly or indirectly. PII is used in the US, but no specific legal document defines it. The legal system…
Read more
July 23, 2024

Anonymous tracking: How to do useful analytics without personal data

Regulations worldwide, like GDPR or the ePrivacy Regulation, set a high bar for collecting user data. For one, GDPR requires consent to process the data if it’s reasonably likely that such data could be used to identify an individual. The problem is that consent opt-in rates typically vary between 30% and 70-80%. The solution? Anonymizing…
Read more