Google Analytics and the GDPR: is it compliant, and how to run it with consent

Google Analytics can be used in line with the GDPR, but only if you set it up for it: in the EU it needs the visitor's prior consent because it sets non-essential cookies, and you also need a data processing agreement with Google, privacy-minded GA4 settings, and a privacy notice that names it. The big legal fight, about sending EU data to the US, was largely settled by the EU–US Data Privacy Framework in 2023, although a challenge is still pending. This guide is for site owners and marketers who use GA4 and want a clear answer and a checklist. It is part of our guide to cookie consent and what the law requires.

Quick answer

• Consent first. In the EU, GA4's _ga cookie is not strictly necessary, so it needs opt-in consent under the ePrivacy rules before it is set. That applies whatever GA4 settings you choose.
• US transfers: since 10 July 2023 the EU–US Data Privacy Framework (DPF) covers transfers to certified US companies, Google included. The EU General Court upheld it in September 2025; an appeal to the Court of Justice is pending.
• Accept Google's data processing terms in the GA4 admin, so Google processes the data on your behalf.
• Turn off what you don't need: Google signals, granular location and device data, data sharing with Google. Set data retention to 2 months unless you need 14.
• Use Consent Mode v2 so GA4 respects the visitor's choice, and decide basic or advanced mode deliberately.
• Name Google Analytics in your privacy notice and cookie policy, with purpose, retention and the transfer mechanism.
• Check the first visit with the free cookie scanner: no _ga cookie and no Google Analytics request should appear before the visitor accepts, unless you use Consent Mode without cookies.

Is Google Analytics GDPR compliant?

"GDPR compliant" is not a property of a tool; it describes how a controller uses it. Google Analytics is neither approved nor banned. What regulators have judged are specific setups on specific sites, and those judgements turned on two separate questions:

1. Consent for the cookie. Setting _ga or reading it back is "storing or accessing information on a terminal device" under Article 5(3) of the ePrivacy Directive. Analytics is not strictly necessary for a service the visitor asked for, so it needs prior consent in the EU. Getting this wrong is the most common problem, and it has nothing to do with the US.
2. Transfers to the US. Google Analytics data is processed by Google LLC in the US. Under Chapter V of the GDPR, that transfer needs a legal basis such as an adequacy decision or standard contractual clauses with extra safeguards.

A site that gets consent, uses the right settings and relies on the Data Privacy Framework is on much firmer ground than the sites regulators ruled against in 2022. A site that fires GA4 on page load before the banner is answered is not, however the transfer question ends.

What EU regulators decided about Google Analytics

In 2020 the EU Court of Justice struck down the previous EU–US Privacy Shield in Schrems II (Case C-311/18), finding that US surveillance law did not give EU citizens equivalent protection. The privacy group noyb then filed 101 complaints against European websites using Google Analytics. The decisions that followed:

The regulators found that IP addresses and cookie IDs were personal data, and that Google's supplementary measures at the time, such as IP anonymisation, did not prevent access by US authorities. These decisions concerned Universal Analytics, the previous version of Google Analytics, before GA4's EU-specific changes and before the Data Privacy Framework.

What the Data Privacy Framework changed

On 10 July 2023 the European Commission adopted an adequacy decision for the EU–US Data Privacy Framework, following a US executive order that limited intelligence access and created a redress mechanism. Transfers to US companies certified under the DPF, which include Google LLC, no longer need standard contractual clauses or a transfer impact assessment for that route.

The framework has been challenged. The EU General Court dismissed the challenge by French MP Philippe Latombe on 3 September 2025 (Case T-553/23). He appealed to the Court of Justice in October 2025 (Case C-703/25 P), and that appeal was still pending when this guide was written. The Court of Justice struck down the two previous frameworks, so treat the DPF as valid but not permanent: keep your records in order so you can switch transfer mechanisms if you need to.

How to run Google Analytics with consent

1. Block GA4 until consent, or use Consent Mode

There are two compliant patterns:

• Load GA4 only after "Accept". The consent platform holds the Google tag, or the Tag Manager container, until the visitor agrees. This is the strictest option; nothing reaches Google before consent.
• Consent Mode v2 with denied defaults. The Google tag loads, sets no cookies while analytics_storage is denied, and switches to normal measurement after "Accept". In advanced mode it sends cookieless pings before consent, which some regulators view critically.

Our guide to Google Consent Mode v2, basic vs advanced explains the difference and shows the code. Either way, the banner must offer "Reject" as easily as "Accept", and GA4 must not be placed in a "strictly necessary" category.

2. Accept the data processing terms

In GA4, go to Admin → Account settings and accept the data processing terms (Google's "Google Ads Data Processing Terms", which also cover Analytics). They make Google your processor under Article 28 of the GDPR and include standard contractual clauses as a fallback.

3. Switch off features you don't use

Each of these sends more data to Google or links it to Google accounts. Turn off what you don't need:

4. Shorten data retention and cookie lifetime

GA4's user-level data retention is set in Admin → Data collection and modification → Data retention: 2 months or 14 months for standard properties. Aggregated standard reports are not affected; only explorations using user-level data are. Choose 2 months unless you run year-over-year explorations.

The _ga cookie lasts two years by default. French and Spanish guidance caps consent-based cookies at 13 months; set cookie_expires in the Google tag configuration (in seconds, for example 34164000 for about 13 months), and the report's cookie lifetime check will confirm it.

5. Don't send personal data in URLs or events

Email addresses in URLs (?email=… on a thank-you page), names in event parameters or user IDs that reveal identity break Google's terms and the GDPR's data minimisation principle. GA4 has a data redaction option for email addresses and query parameters in the web data stream settings; turn it on, and fix the source.

6. Tell visitors

Your privacy notice must name Google Analytics, the purpose, the legal basis (consent), the retention period, that Google LLC in the US receives the data, and the transfer mechanism (the Data Privacy Framework, with standard contractual clauses as a fallback). The cookie details belong in your cookie policy; our guide to what a cookie policy must list has a model table with _ga in it.

What about the IP address?

Universal Analytics stored IP addresses unless you turned on IP anonymisation. GA4 does not log or store IP addresses, according to Google's documentation, and for EU visitors Google says the IP address is used for geolocation on servers in the EU and then discarded before data is sent on. That removes one of the issues in the 2022 decisions. It does not remove the need for consent, because the cookie ID alone is personal data under Recital 30 of the GDPR and the ePrivacy rule covers the cookie either way.

The UK exception for analytics

Since 5 February 2026, the UK's Data (Use and Access) Act 2025 allows cookies used only to collect statistics to improve your own service without consent, provided you give clear information and a free way to object. Whether a given Google Analytics setup fits depends on Google's role; the Information Commissioner's Office guidance says the exception does not cover analytics data that a third party uses for its own purposes. Features such as Google signals and data sharing make that harder to argue. In the EU there is no such exception as of September 2026.

Alternatives if consent rates are too low

Where the banner offers a real choice, a noticeable share of visitors refuses analytics; your consent platform's statistics show your own rate. If GA4 with consent leaves too little data, the options are:

• GA4 with Consent Mode advanced and modeling, if your legal advice accepts it and your traffic meets Google's modeling thresholds.
• Cookieless, privacy-focused analytics. Tools such as Matomo (self-hosted and configured for it), Plausible or Fathom count visits without cookies or cross-site identifiers. The French CNIL publishes conditions under which audience measurement can be exempt from consent; Google Analytics does not meet them in its standard setup.
• Server logs, which you already have, analysed without identifiers.

getReport itself uses self-hosted analytics and no third-party trackers.

How to check your setup

The cookie scanner opens your page as a first-time visitor in a fresh browser from Frankfurt, lists every cookie and tracker before and after it clicks Accept, and notes whether Google Consent Mode is present. For Google Analytics you want to see:

• no _ga or _ga_* cookie before the click;
• no Google Analytics request before the click, or, with Consent Mode, requests without any Google cookie (getReport does not count those as trackers before consent);
• _ga appearing after the click, with a lifetime of 13 months or less.

Then check the settings the scan cannot see: the data processing terms, Google signals, retention and data sharing in the GA4 admin, and the Google Analytics entry in your privacy notice.

Common mistakes

• GA4 fired on page load by Tag Manager, with the banner answered afterwards.
• GA4 listed as "strictly necessary" in the consent platform.
• Consent Mode defaults set to granted for every region.
• Google signals on by default with no remarketing ever used.
• A privacy notice that still describes Universal Analytics and IP anonymisation.
• Emails in thank-you page URLs that end up in GA4 page reports.

Questions people ask

Is Google Analytics 4 GDPR compliant out of the box?

No. GA4 is not compliant by default because it sets analytics cookies as soon as the tag loads, and in the EU those need the visitor's prior consent. It can be used lawfully: block it or run Consent Mode until the visitor accepts, accept Google's data processing terms, switch off features you do not need, shorten retention and name it in your privacy notice.

Is it legal to send Google Analytics data to the US in 2026?

Yes, under the EU–US Data Privacy Framework. Since July 2023 transfers to certified US companies such as Google are covered by an EU adequacy decision, which the EU General Court upheld in September 2025. An appeal to the Court of Justice is pending, and the two previous frameworks were struck down, so document your transfer basis and keep standard contractual clauses as a fallback.

Why did regulators say Google Analytics was illegal in 2022?

Because data was transferred to the US without adequate protection after the Schrems II judgment struck down Privacy Shield in 2020. Austrian, French and Italian regulators found that IP addresses and cookie IDs sent to Google in the US could be accessed by US authorities, and that IP anonymisation did not prevent it. Those decisions concerned Universal Analytics and predate the 2023 Data Privacy Framework.

Does GA4 store IP addresses?

No. According to Google, GA4 does not log or store IP addresses. For visitors in the EU, the IP address is used on EU servers to derive a location and is then discarded. That fixes one issue regulators raised in 2022, but the analytics cookie still needs consent in the EU, because the cookie ID itself is personal data and the ePrivacy rule applies regardless.

Can I use Google Analytics without a cookie banner?

Not for visitors in the EU. GA4 sets analytics cookies that are not strictly necessary, so they need prior consent, which requires asking. Consent Mode lets the tag load without cookies until consent, but you still need a banner to ask. In the UK a statistics exception exists since February 2026 with conditions, and US state laws do not require an opt-in banner for analytics.