What the rollout of Google Analytics 4 means for website investigations

In 2011, writer and technologist Andy Baio published an article in Wired that explained how he uncovered the identity of an anonymous blogger.

“The unlucky blogger slipped up and was ratted out by an unlikely source: Google Analytics,” he wrote.

Google Analytics is a free and popular service that measures the audience of an online property. Data from BuiltWith shows it’s currently used by close to 40 million sites.

Baio’s technique relied on the fact that each Google Analytics account is assigned a unique ID that looks like this: UA-112340701-1. You can easily identify a GA ID in the source code of a webpage. Locate the same ID on different sites, and there’s a good chance they’re run by the same person or group.

Four years later, researcher Lawrence Alexander used the same technique to reveal connections between seemingly disparate sites about Syria, Ukraine and other topics. He showed they were likely part of a Russian propaganda operation. 

The technique Baio and Alexander helped popularize is today a standard approach for website investigations. I explained how to do it in this chapter for the Verification Handbook for Disinformation and Media Manipulation.

That's the background. Here's the news: as of July 1, Google deactivated the familiar "UA-" ID format as part of the launch of Google Analytics 4.

Publishers no longer have to add a UA- ID to their site to use GA. Sites that previously had a UA- ID were required to add a new ID. The migration to GA4 has been a source of concern in the OSINT and digital investigative communities. Will we be prevented from connecting sites together via an analytics ID? Will the old UA- ID be removed from sites, eliminating evidence? And will the services we used to search for sites connected by the same analytics ID still work?

I reached out to Google and others to get some answers. Here’s what I learned.

Subscribe to Indicator to read the rest.