Google Cloud Trace

What Cloud Trace does

Google Cloud Trace is a managed distributed tracing and application performance monitoring service that lets engineering teams understand request latency, dependency chains, and bottlenecks across microservices. Back end applications instrument their code with OpenTelemetry or the Cloud Trace SDK and emit spans over gRPC or HTTPS to a Google Cloud project. Traces are then visualised in the Google Cloud Console, queried via APIs, and exported to BigQuery for deeper analysis. Because tracing happens entirely server side, the service does not interact with user browsers and does not place cookies, pixels, or scripts on visitors.

Data collected and personal data

Spans typically contain technical fields: service name, operation, latency, status code, host, region, container ID, trace ID, span ID, and developer set attributes. Cloud Trace can become exposed to personal data when developers attach user identifiers, IP addresses, request paths with PII, or error payloads to spans. By default, attribute values are not redacted. Cloud Trace stores spans for up to 30 days (configurable) and offers IAM controls, audit logs, and VPC Service Controls to restrict access to the trace data.

GDPR and ePrivacy implications

The lawful basis is generally legitimate interest under Article 6(1)(f) GDPR, since monitoring availability, performance, and security is essential for the controller and aligns with NIS2, DORA, and Article 32 GDPR security obligations. Article 5(3) ePrivacy does not apply because Cloud Trace is server to server: nothing is stored or read on the user device. Therefore no consent banner is required for Cloud Trace itself, although the website that customers monitor may need consent for other reasons.

Roles and contracts with Google

Google Cloud LLC acts as a processor under Article 28 GDPR for the trace data. The Google Cloud Data Processing Addendum, the EU and EEA SCCs, and the EU US Data Privacy Framework certification of Google LLC apply automatically once the customer accepts the Cloud Terms. Customers should also enable Customer Managed Encryption Keys (CMEK) where supported, configure VPC Service Controls, and document their use of Cloud Trace in the Record of Processing Activities.

International data transfers

Cloud Trace stores spans in the Google Cloud region chosen by the customer at project level, which can be an EU region. However, support engineering, billing, and operational metadata may involve Google personnel outside the EEA, especially in the United States. Transfers rely on the Google Cloud SCCs, the EU US Data Privacy Framework, and Google Cloud's supplementary measures including end to end encryption and the Sovereign Cloud / Trusted Cloud offerings for sensitive workloads.

Practical compliance steps

Pin trace storage to an EU region, enable CMEK and VPC Service Controls, and restrict IAM roles to the engineers who need them. Avoid attaching personal data, request bodies, or sensitive headers to spans, and use redaction libraries in OpenTelemetry. Configure span retention to the minimum necessary and document Cloud Trace in your Record of Processing Activities, your Article 32 security measures, and your transfer impact assessment for Google Cloud.