Many of us are using Google Analytics and our ISO is now telling us IP addresses are now considered PII and can not be stored without notice and is building policy around this to augment previous PII policy.

What is everyone elses policy on using GA and do you have any extraordinary agreements with them outside their stated policy.

Thank you.