[philipwhiuk]

> Maintain and protect the Analytics service

This is a pretty broad leash.

"To maintain the analytics service we need to make money"

[simonw]

What's the absolute worst thing Google could be doing with that analytics data?

[caymanjim]

Selling the fact that you visited a suicide prevention website to anyone who cares to buy it. Google analytics knows exactly who you are the second you access a site that uses Analytics.

You don't have to be logged in. You don't even have to be a Google customer. They have IP and browser fingerprinting to uniquely identify people through aggregation of all their sources.

[simonw]

OK, there is a feasible way this could happen. Google would need to be using IP address plus browser device fingerprinting to identify users who visit Google Analytics sites, and would then need to be packaging that data to sell to advertisers.

I don't believe they do this, partly because if they did it would be something they would want to actively promote as a product to advertisers. Why do the creepy thing if you can't talk about it to make more money?

But technically I do believe it is feasible.

[fsflover]

Sell it to insurance companies, employers? Use it to target ads of snake oil to vulnerable people?

[simonw]

Sell what to insurance companies?

All they have is that there was a hit from an IP at a specific date and time. Any cookies they set will let them tell that the same browser came back an hour later - but won't let them join traffic together across multiple sites.

[fsflover]

IP can be correlated with other data to infer the identity. Google ads are everywhere, so Google probably knows, who you are and your IP.