Starting on 25th May 2018, to coincide with the implementation of GDPR, The Google Data Retention policy is being updated for user and event data on Google Analytics. The default position is that Google retains user and event data (identifying the visitor) for 26 months. After this period, Google deletes the data. Once deleted it will not be available for analysis. The change does not affect reports based on aggregated data.
If a visitor returns to the website, the clock resets. A one-time visitor on 25th May 2018 who never returns, will be deleted on 25th July 2020 (i.e. 26 Months later). If they revisited the site on 20th July 2020, the clock resets. The earliest their data would delete would be September 2022.
For most SMEs, I don’t anticipate this will have a major impact though it is another example of how GDPR is making us take more notice of the personal data we hold. With data becoming a key differentiator in many business marketing propositions, from a marketing perspective this is no bad thing in my opinion. It may feel like a bit of a challenge just now and yet another piece of bureaucracy to have to deal with but, in the longer term, it can make your business better.
There are options in your Analytics Admin (under Tracking Info) to change the retention period. You can also disable the timer reset if you wish. Remember though that under GDPR you should not retain personal data longer than is appropriate.
Google is also planning to introduce a specific user deletion tool to remove individual visitor data if this proves necessary.