Recherche avancée

Sur d’autres sites (2816)

• Is Google Analytics Accurate ? 6 Important Caveats

  8 novembre 2022, par Erin

  It’s no secret that accurate website analytics is crucial for growing your online business — and Google Analytics is often the go-to source for insights. 

  But is Google Analytics data accurate ? Can you fully trust the provided numbers ? Here’s a detailed explainer.

  How Accurate is Google Analytics ? A Data-Backed Answer 

  When properly configured, Google Analytics (Universal Analytics and Google Analytics 4) is moderately accurate for global traffic collection. That said : Google Analytics doesn’t accurately report European traffic. 

  According to GDPR provisions, sites using GA products must display a cookie consent banner. This consent is required to collect third-party cookies — a tracking mechanism for identifying users across web properties.

  Google Analytics (GA) cannot process data about the user’s visit if they rejected cookies. In such cases, your analytics reports will be incomplete.

  Cookie rejection refers to visitors declining or blocking cookies from ever being collected by a specific website (or within their browser). It immediately affects the accuracy of all metrics in Google Analytics.

  Google Analytics is not accurate in locations where cookie consent to tracking is legally required. Most consumers don’t like disruptive cookie banners or harbour concerns about their privacy — and chose to reject tracking. 

  This leaves businesses with incomplete data, which, in turn, results in : 

  • Lower traffic counts as you’re not collecting 100% of the visitor data. 
  • Loss of website optimisation capabilities. You can’t make data-backed decisions due to inconsistent reporting

  For the above reasons, many companies now consider cookieless website tracking apps that don’t require consent screen displays. 

  Why is Google Analytics Not Accurate ? 6 Causes and Solutions 

  A high rejection rate of cookie banners is the main reason for inaccurate Google Analytics reporting. In addition, your account settings can also hinder Google Analytics’ accuracy.

  If your analytics data looks wonky, check for these six Google Analytics accuracy problems. 

  You Need to Secure Consent to Cookies Collection 

  To be GDPR-compliant, you must display a cookie consent screen to all European users. Likewise, other jurisdictions and industries require similar measures for user data collection. 

  This is a nuisance for many businesses since cookie rejection undermines their remarketing capabilities. Hence, some try to maximise cookie acceptance rates with dark patterns. For example : hide the option to decline tracking or make the texts too small. 

  

  Sadly, not everyone’s treating users with respect. A joint study by German and American researchers found that only 11% of US websites (from a sample of 5,000+) use GDPR-compliant cookie banners.

  As a result, many users aren’t aware of the background data collection to which they have (or have not) given consent. Another analysis of 200,000 cookies discovered that 70% of third-party marketing cookies transfer user data outside of the EU — a practice in breach of GDPR.

  Naturally, data regulators and activities are after this issue. In April 2022, Google was pressured to introduce a ‘reject all’ cookies button to all of its products (a €150 million compliance fine likely helped with that). Whereas, noyb has lodged over 220 complaints against individual websites with deceptive cookie consent banners.

  The takeaway ? Messing up with the cookie consent mechanism can get you in legal trouble. Don’t use sneaky banners as there are better ways to collect website traffic statistics. 

  Solution : Try Matomo GDPR-Friendly Analytics 

  Fill in the gaps in your traffic analytics with Matomo – a fully GDPR-compliant product that doesn’t rely on third-party cookies for tracking web visitors. Because of how it is designed, the French data protection authority (CNIL) confirmed that Matomo can be used to collect data without tracking consent.

  With Matomo, you can track website users without asking for cookie consent. And when you do, we supply you with a compact, compliant, non-disruptive cookie banner design. 

  Your Google Tag Isn’t Embedded Correctly 

  Google Tag (gtag.js) is a web tracking script that sends data to your Google Analytics, Google Ads and Google Marketing Platform.

  A corrupted gtag.js installation can create two accuracy issues : 

  • Duplicate page tracking 
  • Missing script installation 

  Is there a way to tell if you’re affected ?

  Yes. You may have duplicate scripts installed if you have a very low bounce rate on most website pages (below 15% – 20%). The above can happen if you’re using a WordPress GA plugin and additionally embed gtag.js straight in your website code. 

  A tell-tale sign of a missing script on some pages is low/no traffic stats. Google alerts you about this with a banner : 

  

  Solution : Use Available Troubleshooting Tools 

  Use Google Analytics Debugger extension to analyse pages with low bounce rates. Use the search bar to locate duplicate code-tracking elements. 

  Alternatively, you can use Google Tag Assistant for diagnosing snippet install and troubleshooting issues on individual pages. 

  If the above didn’t work, re-install your analytics script. 

  Machine Learning and Blended Data Are Applied

  Google Analytics 4 (GA4) relies a lot on machine learning and algorithmic predictions.

  By applying Google’s advanced machine learning models, the new Analytics can automatically alert you to significant trends in your data. [...] For example, it calculates churn probability so you can more efficiently invest in retaining customers.

  Vidhya Srinivasan, VP of Measurement, Analytics and Buying Platforms at Google

  On the surface, the above sounds exciting. In practice, Google’s application of predictive algorithms means you’re not seeing actual data. 

  To offer a variation of cookieless tracking, Google algorithms close the gaps in reporting by creating models (i.e., data-backed predictions) instead of reporting on actual user behaviours. Therefore, your GA4 numbers may not be accurate.

  For bigger web properties (think websites with 1+ million users), Google also relies on data sampling — a practice of extrapolating data analytics, based on a data subset, rather than the entire dataset. Once again, this can lead to inconsistencies in reporting with some numbers (e.g., average conversion rates) being inflated or downplayed. 

  Solution : Try an Alternative Website Analytics App 

  Unlike GA4, Matomo reports consist of 100% unsampled data. All the aggregated reporting you see is based on real user data (not guesstimation). 

  Moreover, you can migrate from Universal Analytics (UA) to Matomo without losing access to your historical records. GA4 doesn’t yet have any backward compatibility.

  Spam and Bot Traffic Isn’t Filtered Out 

  Surprise ! 42% of all Internet traffic is generated by bots, of which 27.7% are bad ones.

  Good bots (aka crawlers) do essential web “housekeeping” tasks like indexing web pages. Bad bots distribute malware, spam contact forms, hack user accounts and do other nasty stuff. 

  A lot of such spam bots are designed specifically for web analytics apps. The goal ? Flood your dashboard with bogus data in hopes of getting some return action from your side. 

  Types of Google Analytics Spam :

  • Referral spam. Spambots hijack the referrer, displayed in your GA referral traffic report to indicate a page visit from some random website (which didn’t actually occur). 
  • Event spam. Bots generate fake events with free language entries enticing you to visit their website. 
  • Ghost traffic spam. Malicious parties can also inject fake pageviews, containing URLs that they want you to click. 

  Obviously, such spammy entities distort the real website analytics numbers. 

  Solution : Set Up Bot/Spam Filters 

  Google Analytics 4 has automatic filtering of bot traffic enabled for all tracked Web and App properties. 

  But if you’re using Universal Analytics, you’ll have to manually configure spam filtering. First, create a new view and then set up a custom filter. Program it to exclude :

  • Filter Field : Request URI
  • Filter Pattern : Bot traffic URL

  Once you’ve configured everything, validate the results using Verify this filter feature. Then repeat the process for other fishy URLs, hostnames and IP addresses. 

  You Don’t Filter Internal Traffic 

  Your team(s) spend a lot of time on your website — and their sporadic behaviours can impair your traffic counts and other website metrics.

  To keep your data “employee-free”, exclude traffic from : 

  • Your corporate IPs addresses 
  • Known personal IPs of employees (for remote workers) 

  If you also have a separate stage version of your website, you should also filter out all traffic coming from it. Your developers, contractors and marketing people spend a lot of time fiddling with your website. This can cause a big discrepancy in average time on page and engagement rates. 

  Solution : Set Internal Traffic Filters 

  Google provides instructions for excluding internal traffic from your reports using IPv4/IPv6 address filters. 

  

  Session Timeouts After 30 Minutes 

  After 30 minutes of inactivity, Google Analytics tracking sessions start over. Inactivity means no recorded interaction hits during this time. 

  Session timeouts can be a problem for some websites as users often pin a tab to check it back later. Because of this, you can count the same user twice or more — and this leads to skewed reporting. 

  Solution : Programme Custom Timeout Sessions

  You can codify custom cookie timeout sessions with the following code snippets : 

  • _setSessionCookieTimeout. Set a custom new session cookie timeout in milliseconds.
  • _setVisitorCookieTimeout. Sets a custom Google Analytics visitor cookie expiration time frame in milliseconds.

  Final Thoughts 

  Thanks to its scale and longevity, Google Analytics has some strong sides, but its data accuracy isn’t 100% perfect.

  The inability to capture analytics data from users who don’t consent to cookie tracking and data sampling applied to bigger web properties may be a deal-breaker for your business. 

  If that’s the case, try Matomo — a GDPR-compliant, accurate web analytics solution. Start your 21-day free trial now. No credit card required.

  21 day free trial. No credit card required.

  Your email address
  

  Your website address
  

  Your Analytics subdomain will be .matomo.cloud (change)

  Choose your analytics subdomain
  

  .matomo.cloud

  I hereby accept the terms and conditions and the data processing agreement (DPA)

  
  Your information will be used to create an account on our cloud service. For more information please consult our privacy policy.
  
  

  » Start improving your websites now

  

• Google Analytics 4 and GDPR : Everything You Need to Know

  17 mai 2022, par Erin

  Four years have passed since the European General Data Protection Regulation (GDPR, also known as DSGVO in German, and RGPD in French) took effect.

  That’s ample time to get compliant, especially for an organisation as big and innovative as Google. Or is it ? 

  If you are wondering how GDPR affects Google Analytics 4 and what the compliance status is at present, here’s the lowdown. 

  Is Google Analytics 4 GDPR Compliant ?

  No. As of mid-2022, Google Analytics 4 (GA4) isn’t fully GDPR compliant. Despite adding extra privacy-focused features, GA4 still has murky status with the European regulators. After the invalidation of the Privacy Shield framework in 2020, Google is yet to regulate EU-US data protection. At present, the company doesn’t sufficiently protect EU citizens’ and residents’ data against US surveillance laws. This is a direct breach of GDPR.

  Google Analytics and GDPR : a Complex Relationship 

  European regulators have scrutinised Google since GDPR came into effect in 2018.

  While the company took steps to prepare for GDPR provisions, it didn’t fully comply with important regulations around user data storage, transfer and security.

  The relationship between Google and EU regulators got more heated after the Court of Justice of the European Union (CJEU) invalidated the Privacy Shield — a leeway Google used for EU-US data transfers. After 2020, GDPR litigation against Google followed. 

  This post summarises the main milestones in this story and explains the consequences for Google Analytics users. 

  

  2018 : Google Analytics Meets GDPR 

  In 2018, the EU adopted the General Data Protection Regulation (GDPR) — a set of privacy and data security laws, covering all member states. Every business interacting with EU citizens and/or residents had to comply.

  GDPR harmonised data protection laws across member states and put down extra provisions for what constitutes sensitive personal information (or PII). Broadly, PII includes any data about the person’s :

  • Racial or ethnic origin 
  • Employment status 
  • Religious or political beliefs
  • State of health 
  • Genetic or biometric data 
  • Financial records (such as payment method data)
  • Address and phone numbers 

  Businesses were barred from collecting this information without explicit consent (and even with it in some cases). If collected, such sensitive information is also subject to strict requirements on how it should be stored, secured, transferred and used. 

  7 Main GDPR Principles Explained 

  Article 5 of the GDPR lays out seven main GDPR principles for personal data and privacy protection : 

  • Lawfulness, fairness and transparency — data must be obtained legally, collected with consent and in adherence to laws. 
  • Purpose limitation — all personal information must be collected for specified, explicit and legal purposes. 
  • Data minimisation — companies must collect only necessary and adequate data, aligned with the stated purpose. 
  • Accuracy — data accuracy must be ensured at all times. Companies must have mechanisms to erase or correct inaccurate data without delays. 
  • Storage limitation — data must be stored only for as long as the stated purpose suggests. Though there’s no upper time limit on data storage. 
  • Integrity and confidentiality (security) — companies must take measures to ensure secure data storage and prevent unlawful or unauthorised access to it. 
  • Accountability — companies must be able to demonstrate adherence to the above principles. 

  Google claimed to have taken steps to make all of their products GDPR compliant ahead of the deadline. But in practice, this wasn’t always the case.

  In March 2018, a group of publishers admonished Google for not providing them with enough tools for GDPR compliance :

  “[Y]ou refuse to provide publishers with any specific information about how you will collect, share and use the data. Placing the full burden of obtaining new consent on the publisher is untenable without providing the publisher with the specific information needed to provide sufficient transparency or to obtain the requisite specific, granular and informed consent under the GDPR.”

  The proposed Google Analytics GDPR consent form was hard to implement and lacked customisation options. In fact, Google “makes unilateral decisions” on how the collected data is stored and used. 

  Users had no way to learn about or control all intended uses of people’s data — which made compliance with the second clause impossible. 

  Unsurprisingly, Google was among the first companies to face a GDPR lawsuit (together with Facebook). 

  By 2019, French data regulator CNIL, successfully argued that Google wasn’t sufficiently disclosing its data collection across products — and hence in breach of GDPR. After a failed appeal, Google had to pay a €50 million fine and promise to do better. 

  2019 : Google Analytics 4 Announcement 

  Throughout 2019, Google rightfully attempted to resolve some of its GDPR shortcomings across all products, Google Universal Analytics (UA) included. 

  They added a more visible consent mechanism for online tracking and provided extra compliance tips for users to follow. In the background, Google also made tech changes to its data processing mechanism to get on the good side of regulations.

  Though Google addressed some of the issues, they missed others. A 2019 independent investigation found that Google real-time-bidding (RTB) ad auctions still used EU citizens’ and residents’ data without consent, thanks to a loophole called “Push Pages”. But they managed to quickly patch this up before the allegations had made it to court. 

  In November 2019, Google released a beta version of the new product version — Google Analytics 4, due to replace Universal Analytics. 

  GA4 came with a set of new privacy-focused features for ticking GDPR boxes such as :

  • Data deletion mechanism. Users can now request to surgically extract certain data from the Analytics servers via a new interface. 
  • Shorter data retention period. You can now shorten the default retention period to 2 months by default (instead of 14 months) or add a custom limit.  
  • IP Anonymisation. GA4 doesn’t log or store IP addresses by default. 

  Google Analytics also updated its data processing terms and made changes to its privacy policy. 

  Though Google made some progress, Google Analytics 4 still has many limitations — and isn’t GDPR compliant. 

  2020 : Privacy Shield Invalidation Ruling 

  As part of the 2018 GDPR preparations, Google named its Irish entity (Google Ireland Limited) as the “data controller” legally responsible for EEA and Swiss users’ information. 

  The company announcement says : 

  

  Initially, Google assumed that this legal change would help them ensure GDPR compliance as “legally speaking” a European entity was set in charge of European data. 

  Practically, however, EEA consumers’ data was still primarily transferred and processed in the US — where most Google data centres are located. Until 2020, such cross-border data transfers were considered legal thanks to the Privacy Shield framework. 

  But in July 2020, The EU Court of Justice ruled that this framework doesn’t provide adequate data protection to digitally transmitted data against US surveillance laws. Hence, companies like Google can no longer use it. The Swiss Federal Data Protection and Information Commissioner (FDPIC) reached the same conclusion in September 2020. 

  The invalidation of the Privacy Shield framework put Google in a tough position.

   Article 14. f of the GDPR explicitly states : 

  “The controller (the company) that intends to carry out a transfer of personal data to a recipient (Analytics solution) in a third country or an international organisation must provide its users with information on the place of processing and storage of its data”.

  Invalidation of the Privacy Shield framework prohibited Google from moving data to the US. At the same time, GDPR provisions mandated that they must disclose proper data location. 

  But Google Analytics (like many other products) had no a mechanism for : 

  • Guaranteeing intra-EU data storage 
  • Selecting a designated regional storage location 
  • Informing users about data storage location or data transfers outside of the EU 

  And these factors made Google Analytics in direct breach of GDPR — a territory, where they remain as of 2022.

  2020-2022 : Google GDPR Breaches and Fines 

  The 2020 ruling opened Google to GDPR lawsuits from country-specific data regulators.

  Google Analytics in particular was under a heavy cease-fire. 

  • Sweden first fined Google for violating GDPR for no not fulfilling its obligations to request data delisting in 2020. 
  • France rejected Google Analytics 4 IP address anonymisation function as a sufficient measure for protecting cross-border data transfers. Even with it, US intelligence services can still access user IPs and other PII. France declared Google Analytics illegal and pressed a €150 million fine. 
  • Austria also found Google Analytics GDPR non-compliant and proclaimed the service as “illegal”. The authority now seeks a fine too. 

  The Dutch Data Protection Authority and  Norwegian Data Protection Authority also found Google Analytics guilty of a GDPR breach and seek to limit Google Analytics usage. 

  New privacy controls in Google Analytics 4 do not resolve the underlying issue — unregulated, non-consensual EU-US data transfer. 

  Google Analytics GDPR non-compliance effectively opens any website tracking or analysing European visitors to legal persecution.

  In fact, this is already happening. noyb, a European privacy-focused NGO, has already filed over 100 lawsuits against European websites using Google Analytics.

  2022 : Privacy Shield 2.0. Negotiations

  Google isn’t the only US company affected by the Privacy Shield framework invalidation. The ruling puts thousands of digital companies at risk of non-compliance.

  To settle the matter, US and EU authorities started “peace talks” in spring 2022.

  European Commission President Ursula von der Leyen said that they are working with the Biden administration on the new agreement that will “enable predictable and trustworthy data flows between the EU and US, safeguarding the privacy and civil liberties.” 

  However, it’s just the beginning of a lengthy negotiation process. The matter is far from being settled and contentious issues remain as we discussed on Twitter (come say hi !).

  

  For one, the US isn’t eager to modify its surveillance laws and is mostly willing to make them “proportional” to those in place in the EU. These modifications may still not satisfy CJEU — which has the power to block the agreement vetting or invalidate it once again. 

  While these matters are getting hashed out, Google Analytics users, collecting data about EU citizens and/or residents, remain on slippery grounds. As long as they use GA4, they can be subject to GDPR-related lawsuits. 

  To Sum It Up 

  • Google Analytics 4 and Google Universal Analytics are not GDPR compliant because of Privacy Shield invalidation in 2020. 
  • French and Austrian data watchdogs named Google Analytics operations “illegal”. Swedish, Dutch and Norwegian authorities also claim it’s in breach of GDPR. 
  • Any website using GA for collecting data about European citizens and/or residents can be taken to court for GDPR violations (which is already happening). 
  • Privacy Shield 2.0 Framework discussions to regulate EU-US data transfers have only begun and may take years. Even if accepted, the new framework(s) may once again be invalidated by local data regulators as has already happened in the past. 

  Time to Get a GDPR Compliant Google Analytics Alternative 

  Retaining 100% data ownership is the optimal path to GDPR compliance.

  By selecting a transparent web analytics solution that offers 100% data ownership, you can rest assured that no “behind the scenes” data collection, processing or transfers take place. 

  Unlike Google Analytics 4, Matomo offers all of the features you need to be GDPR compliant : 

  • Full data anonymisation 
  • Single-purpose data usage 
  • Easy consent and an opt-out mechanism 
  • First-party cookies usage by default 
  • Simple access to collect data 
  • Fast data removals 
  • EU-based data storage for Matomo Cloud (or storage in the country of your choice with Matomo On-Premise)

  Learn about your audiences in a privacy-centred way and protect your business against unnecessary legal exposure. 

  Start your 21-day free trial (no credit card required) to see how fully GDPR-compliant website analytics works ! 

  21 day free trial. No credit card required.

  Your email address
  

  Your website address
  

  Your Analytics subdomain will be .matomo.cloud (change)

  Choose your analytics subdomain
  

  .matomo.cloud

  I hereby accept the terms and conditions and the data processing agreeement (DPA).

  
  Your information will be used to create an account on our cloud service. For more information please consult our privacy policy.
  
  

  » Start improving your websites now

  

• A Quick Start Guide to the Payment Services Directive (PSD2)

  22 novembre 2024, par Daniel Crough — Banking and Financial Services, Privacy

  In 2023, there were 266.2 billion real-time payments indicating that the demand for secure transactions has never been higher. As we move towards a more open banking system, there are a host of new payment solutions that offer convenience and efficiency, but they also present new risks.

  The Payment Services Directive 2 (PSD2) is one of many regulations established to address these concerns. PSD2 is a European Union (EU) business initiative to offer smooth payment experiences while helping customers feel safe from online threats. 

  In this post, learn what PSD2 includes, how it improves security for online payments, and how Matomo supports banks and financial institutions with PSD2 compliance.

  What is PSD2 ? 

  PSD2 is an EU directive that aims to improve the security of electronic payments across the EU. It enforces strong customer authentication and allows third-party access to consumer accounts with explicit consent. 

  Its main objectives are :

  • Strengthening security and data privacy measures around digital payments.
  • Encouraging innovation by allowing third-party providers access to banking data.
  • Improving transparency with clear communication regarding fees, terms and conditions associated with payment services.
  • Establishing a framework for sharing customer data securely through APIs for PSD2 open banking.

  Rationale behind PSD2 

  PSD2’s primary purpose is to engineer a more integrated and efficient European payment market without compromising the security of online transactions. 

  The original directive aimed to standardise payment services across EU member states, but as technology evolved, an updated version was needed.

  PSD2 is mandatory for various entities within the European Economic Area (EEA), like :

  • Banks and credit institutions
  • Electronic money institutions or digital banks like Revolut
  • Card issuing and acquiring institutions
  • Fintech companies
  • Multi-national organisations operating in the EU

  PSD2 implementation timeline

  With several important milestones, PSD2 has reshaped how payment services work in Europe. Here’s a closer look at the pivotal events that paved the way for its launch.

  • 2002 : The banking industry creates the European Payments Council (EC), which drives the Single Euro Payments Area (SEPA) initiative to include non-cash payment instruments across European regions. 
  • 2007 : PSD1 goes into effect.
  • 2013 : EC proposes PSD2 to include protocols for upcoming payment services.
  • 2015 : The Council of European Union passes PSD2 and gives member states two years to incorporate it.
  • 2018 : PSD2 goes into effect. 
  • 2019 : The final deadline for all companies within the EU to comply with PSD2’s regulations and rules for strong customer authentication. 

  PSD2 : Key components 

  PSD2 introduces several key components. Let’s take a look at each one.

  Strong Customer Authentication (SCA)

  The Regulatory Technical Standards (RTS) under PSD2 outline specific requirements for SCA. 

  SCA requires multi-factor authentication for online transactions. When customers make a payment online, they need to verify their identity using at least two of the three following elements :

  • Knowledge : Something they know (like a password, a code or a secret answer)
  • Possession : Something they have (like their phone or card)
  • Inherence : Something they are (like biometrics — fingerprints or facial features)

  

  Before SCA, banks verified an individual’s identity only using a password. This dual verification allows only authorised users to complete transactions. SCA implementation reduces fraud and increases the security of electronic payments.

  SCA implementation varies for different payment methods. Debit and credit cards use the 3D Secure (3DS) protocol. E-wallets and other local payment measures often have their own SCA-compliant steps. 

  3DS is an extra step to authenticate a customer’s identity. Most European debit and credit card companies implement it. Also, in case of fraudulent chargebacks, the issuing bank becomes liable due to 3DS, not the business. 

  However, in SCA, certain transactions are exempt : 

  • Low-risk transactions : A transaction by an issuer or an acquirer whose fraud level is below a specific threshold. If the acquirer feels that a transaction is low risk, they can request to skip SCA. 
  • Low-value transactions : Transactions under €30.
  • Trusted beneficiaries : Trusted merchants customers choose to safelist.
  • Recurring payments : Recurring transactions for a fixed amount are exempt from SCA after the first transaction.

  Third-party payment service providers (TPPs) framework

  TPPs are entities authorised to access customer banking data and initiate payments. There are three types of TPPs :

  Account Information Service Providers (AISPs)

  AISPs are services that can view customers’ account details, but only with their permission. For example, a budgeting app might use AISP services to gather transaction data from a user’s bank account, helping them monitor expenses and oversee finances. 

  Payment Initiation Service Providers (PISPs)

  PISPs enable clients to initiate payments directly from their bank accounts, bypassing the need for conventional payment options such as debit or credit cards. After the customer makes a payment, PISPs immediately contact the merchant to ensure the user can access the online services or products they bought. 

  Card-Based Payment Instruments (CBPII)

  CBPIIs refer to services that issue payment cards linked to customer accounts. 

  Requirements for TPPs

  To operate effectively under PSD2, TPPs must meet several requirements :

  Consumer consent : Customers must explicitly authorise TPPs to retrieve their financial data. This way, users can control who can view their information and for what purpose.

  Security compliance : TPPs must follow SCA and secure communication guidelines to protect users from fraud and unauthorised access.

  API availability : Banks must make their Application Programming Interfaces (APIs) accessible and allow TPPs to connect securely with the bank’s systems. This availability helps in easy integration and lets TPPs access essential data. 

  Consumer protection methods

  PSD2 implements various consumer protection measures to increase trust and transparency between consumers and financial institutions. Here’s a closer look at some of these key methods :

  • Prohibition of unjustified fees : PSD2 requires banks to clearly communicate any additional charges or fees for international transfers or account maintenance. This ensures consumers are fully aware of the actual costs and charges.
  • Timely complaint resolution : PSD2 mandates that payment service providers (PSPs) have a straightforward complaint procedure. If a customer faces any problems, the provider must respond within 15 business days. This requirement encourages consumers to engage more confidently with financial services.
  • Refund in case of unauthorised payment : Customers are entitled to a full refund for payments made without their consent.
  • Surcharge ban : Additional charges on credit and debit card payments aren’t allowed. Businesses can’t impose extra fees on these payment methods, which increases customers’ purchasing power.

  Benefits of PSD2 

  Businesses — particularly those in banking, fintech, finserv, etc. — stand to benefit from PSD2 in several ways.

  Access to customer data

  With customer consent, banks can analyse spending patterns to develop tailored financial products that match customer needs, from personalised savings accounts to more relevant loan offerings.

  Innovation and cost benefits 

  PSD2 opened payment processing up to more market competition. New payment companies bring fresh approaches to banking services, making daily transactions more efficient while driving down processing fees across the sector.

  Also, banks now work alongside payment technology providers, combining their strengths to create better services. This collaboration brings faster payment options to businesses, helping them stay competitive while reducing operational costs.

  Improved customer trust and experience

  Due to PSD2 guidelines, modern systems handle transactions quickly without compromising the safety of payment data, creating a balanced approach to digital banking.

  

  Banking customers now have more control over their financial information. Clear processes allow consumers to view and adjust their financial preferences as needed.

  Strong security standards form the foundation of these new payment systems. Payment provider platforms must adhere to strict regulations and implement additional protection measures.

  Challenges in PSD2 compliance 

  What challenges can banks and financial institutions face regarding PSD2 compliance ? Let’s examine them. 

  Resource requirements

  For many businesses, the new requirements come with a high price tag. PSD2 requires banks and fintechs to build and update their systems so that other providers can access customer data safely. For example, they must develop APIs to allow TPPs to acquire customer data. 

  Many banks still use older systems that can’t meet PSD2’s added requirements. In addition to the cost of upgrades, complying with PSD2 requires banks to devote resources to training staff and monitoring compliance.

  The significant costs required to update legacy systems and IT infrastructure while keeping services running remain challenging.

  Risks and penalties

  Organisations that fail to comply with PSD2 regulations can face significant penalties.

  Additionally, the overlapping requirements of PSD2 and other regulations, such as the General Data Protection Regulation (GDPR), can create confusion. 

  Banks need clear agreements with TPPs about who’s responsible when things go wrong. This includes handling data breaches, preventing data misuse and protecting customer information. 

  Increased competition 

  Introducing new players in the financial ecosystem, such as AISPs and PISPs, creates competition. Banks must adapt their services to stay competitive while managing compliance costs.

  PSD2 aims to protect customers but the stronger authentication requirements can make banking less convenient. Banks must balance security with user experience. Focused time, effort and continuous monitoring are needed for businesses to stay compliant and competitive.

  How Matomo can help 

  Matomo gives banks and financial institutions complete control over their data through privacy-focused web analytics, keeping collected information internal rather than being used for marketing or other purposes. 

  Its advanced security setup includes access controls, audit logs, SSL encryption, single sign-on and two-factor authentication. This creates a secure environment where sensitive data remains accessible only to authorised staff.

  While prioritizing privacy, Matomo provides tools to understand user flow and customer segments, such as session recordings, heatmaps and A/B testing.

  Financial institutions particularly benefit from several key features : 

  • Tools for obtaining explicit consent before processing personal data like this Do Not Track preference
  • Insights into how financial institutions integrate TPPs (including API usage, user engagement and potential authentication drop-off points)
  • Tracking of failed login attempts or unusual access patterns
  • IP anonymization to analyse traffic patterns and detect potential fraud

  

  PSD3 : The next step 

  In recent years, we have seen the rise of innovative payment companies and increasingly clever fraud schemes. This has prompted regulators to propose updates to payment rules.

  PSD3’s scope is to adapt to the evolving digital transformation and to better handle these fraud risks. The proposed measures : 

  • Encourage PSPs to share fraud-related information.
  • Make customers aware of the different types of fraud.
  • Strengthen customer authentication standards.
  • Provide non-bank PSPs restricted access to EU payment systems. 
  • Enact payment rules in a directly applicable regulation and harmonise and enforce the directive.

  Web analytics that respect user privacy 

  Achieving compliance with PSD2 may be a long road for some businesses. With Matomo, organisations can enjoy peace of mind knowing their data practices align with legal requirements.

  Ready to stop worrying over compliance with regulations like PSD2 and take control of your data ? Start your 21-day free trial with Matomo.