# Google Analytics and the GDPR: is it compliant, and how to run it with consent

> Google Analytics can be used lawfully under the GDPR, but not by default: it needs prior consent in the EU, the right GA4 settings, a data processing agreement and an honest privacy notice. What the regulators decided and what to set.

Updated 2026-09-26 · Best practices · HTML version: https://getreport.app/guides/google-analytics-gdpr

Google Analytics can be used in line with the GDPR, but only if you set it up for it: in the EU it needs the visitor's prior consent because it sets non-essential cookies, and you also need a data processing agreement with Google, privacy-minded GA4 settings, and a privacy notice that names it. The big legal fight, about sending EU data to the US, was largely settled by the EU–US Data Privacy Framework in 2023, although a challenge is still pending. This guide is for site owners and marketers who use GA4 and want a clear answer and a checklist. It is part of our guide to [cookie consent and what the law requires](https://getreport.app/guides/cookie-consent).

> **Watch out:**
> This guide explains decisions and settings in plain language and names its sources, current as of September 2026. It is not legal advice. Regulators in different countries take different views, and your obligations depend on your setup; for a decision with legal consequences, ask a qualified lawyer or your data protection officer.

## Quick answer

- **Consent first.** In the EU, GA4's `_ga` cookie is not strictly necessary, so it needs opt-in consent under the ePrivacy rules before it is set. That applies whatever GA4 settings you choose.
- **US transfers:** since 10 July 2023 the EU–US Data Privacy Framework (DPF) covers transfers to certified US companies, Google included. The EU General Court upheld it in September 2025; an appeal to the Court of Justice is pending.
- **Accept Google's data processing terms** in the GA4 admin, so Google processes the data on your behalf.
- **Turn off what you don't need:** Google signals, granular location and device data, data sharing with Google. Set data retention to 2 months unless you need 14.
- **Use Consent Mode v2** so GA4 respects the visitor's choice, and decide basic or advanced mode deliberately.
- **Name Google Analytics in your privacy notice and cookie policy,** with purpose, retention and the transfer mechanism.
- **Check the first visit** with the free [cookie scanner](https://getreport.app/tools/cookie-scanner): no `_ga` cookie and no Google Analytics request should appear before the visitor accepts, unless you use Consent Mode without cookies.

## Is Google Analytics GDPR compliant?

"GDPR compliant" is not a property of a tool; it describes how a controller uses it. Google Analytics is neither approved nor banned. What regulators have judged are specific setups on specific sites, and those judgements turned on two separate questions:

1. **Consent for the cookie.** Setting `_ga` or reading it back is "storing or accessing information on a terminal device" under Article 5(3) of the ePrivacy Directive. Analytics is not strictly necessary for a service the visitor asked for, so it needs prior consent in the EU. Getting this wrong is the most common problem, and it has nothing to do with the US.
2. **Transfers to the US.** Google Analytics data is processed by Google LLC in the US. Under Chapter V of the GDPR, that transfer needs a legal basis such as an adequacy decision or standard contractual clauses with extra safeguards.

A site that gets consent, uses the right settings and relies on the Data Privacy Framework is on much firmer ground than the sites regulators ruled against in 2022. A site that fires GA4 on page load before the banner is answered is not, however the transfer question ends.

## What EU regulators decided about Google Analytics

In 2020 the EU Court of Justice struck down the previous EU–US Privacy Shield in *Schrems II* (Case C-311/18), finding that US surveillance law did not give EU citizens equivalent protection. The privacy group noyb then filed 101 complaints against European websites using Google Analytics. The decisions that followed:

| Regulator | When | Finding |
| --- | --- | --- |
| Austria (DSB) | January 2022 | A website's use of Universal Analytics transferred personal data to the US unlawfully |
| France (CNIL) | February 2022 | Same conclusion; ordered the site to comply or stop using it |
| Italy (Garante) | June 2022 | Same conclusion; gave the site 90 days to comply |
| Denmark (Datatilsynet) | September 2022 | Guidance that lawful use required changes to the setup |
| Sweden (IMY) | July 2023 | Fined Tele2 SEK 12 million and a second company SEK 300,000 over transfers |

The regulators found that IP addresses and cookie IDs were personal data, and that Google's supplementary measures at the time, such as IP anonymisation, did not prevent access by US authorities. These decisions concerned Universal Analytics, the previous version of Google Analytics, before GA4's EU-specific changes and before the Data Privacy Framework.

### What the Data Privacy Framework changed

On 10 July 2023 the European Commission adopted an adequacy decision for the EU–US Data Privacy Framework, following a US executive order that limited intelligence access and created a redress mechanism. Transfers to US companies certified under the DPF, which include Google LLC, no longer need standard contractual clauses or a transfer impact assessment for that route.

The framework has been challenged. The EU General Court dismissed the challenge by French MP Philippe Latombe on 3 September 2025 (Case T-553/23). He appealed to the Court of Justice in October 2025 (Case C-703/25 P), and that appeal was still pending when this guide was written. The Court of Justice struck down the two previous frameworks, so treat the DPF as valid but not permanent: keep your records in order so you can switch transfer mechanisms if you need to.

## How to run Google Analytics with consent

### 1. Block GA4 until consent, or use Consent Mode

There are two compliant patterns:

- **Load GA4 only after "Accept".** The consent platform holds the Google tag, or the Tag Manager container, until the visitor agrees. This is the strictest option; nothing reaches Google before consent.
- **Consent Mode v2 with denied defaults.** The Google tag loads, sets no cookies while `analytics_storage` is denied, and switches to normal measurement after "Accept". In advanced mode it sends cookieless pings before consent, which some regulators view critically.

Our guide to [Google Consent Mode v2, basic vs advanced](https://getreport.app/guides/google-consent-mode-v2) explains the difference and shows the code. Either way, the banner must offer "Reject" as easily as "Accept", and GA4 must not be placed in a "strictly necessary" category.

### 2. Accept the data processing terms

In GA4, go to Admin → Account settings and accept the data processing terms (Google's "Google Ads Data Processing Terms", which also cover Analytics). They make Google your processor under Article 28 of the GDPR and include standard contractual clauses as a fallback.

### 3. Switch off features you don't use

Each of these sends more data to Google or links it to Google accounts. Turn off what you don't need:

| Setting | Where in GA4 | Recommendation |
| --- | --- | --- |
| Google signals | Admin → Data collection and modification → Data collection | Off unless you need cross-device reports and ads remarketing |
| Granular location and device data | Same panel | Off for EU countries if you don't need city-level or device-model reports |
| Ads personalisation | Same panel, per region | Off for regions where you don't advertise |
| Data sharing settings | Admin → Account settings | Off for any sharing you have not chosen deliberately |
| User-provided data collection | Admin → Data collection | Off unless you send hashed emails for enhanced conversions |

### 4. Shorten data retention and cookie lifetime

GA4's user-level data retention is set in Admin → Data collection and modification → Data retention: 2 months or 14 months for standard properties. Aggregated standard reports are not affected; only explorations using user-level data are. Choose 2 months unless you run year-over-year explorations.

The `_ga` cookie lasts two years by default. French and Spanish guidance caps consent-based cookies at 13 months; set `cookie_expires` in the Google tag configuration (in seconds, for example `34164000` for about 13 months), and the report's cookie lifetime check will confirm it.

> **Check: Cookie lifetime.** French and Spanish guidance caps consent-based cookies at 13 months, and Chrome and Safari already trim long lifetimes. A two-year analytics cookie earns nothing and reads badly in an audit.
>
> 1. Set the cookie's Max-Age or Expires to 13 months or less (GA4: the cookie_expires parameter; Meta Pixel and most tags have a similar setting).

### 5. Don't send personal data in URLs or events

Email addresses in URLs (`?email=…` on a thank-you page), names in event parameters or user IDs that reveal identity break Google's terms and the GDPR's data minimisation principle. GA4 has a data redaction option for email addresses and query parameters in the web data stream settings; turn it on, and fix the source.

### 6. Tell visitors

Your privacy notice must name Google Analytics, the purpose, the legal basis (consent), the retention period, that Google LLC in the US receives the data, and the transfer mechanism (the Data Privacy Framework, with standard contractual clauses as a fallback). The cookie details belong in your cookie policy; our guide to [what a cookie policy must list](https://getreport.app/guides/cookie-policy) has a model table with `_ga` in it.

## What about the IP address?

Universal Analytics stored IP addresses unless you turned on IP anonymisation. GA4 does not log or store IP addresses, according to Google's documentation, and for EU visitors Google says the IP address is used for geolocation on servers in the EU and then discarded before data is sent on. That removes one of the issues in the 2022 decisions. It does not remove the need for consent, because the cookie ID alone is personal data under Recital 30 of the GDPR and the ePrivacy rule covers the cookie either way.

## The UK exception for analytics

Since 5 February 2026, the UK's Data (Use and Access) Act 2025 allows cookies used only to collect statistics to improve your own service without consent, provided you give clear information and a free way to object. Whether a given Google Analytics setup fits depends on Google's role; the Information Commissioner's Office guidance says the exception does not cover analytics data that a third party uses for its own purposes. Features such as Google signals and data sharing make that harder to argue. In the EU there is no such exception as of September 2026.

## Alternatives if consent rates are too low

Where the banner offers a real choice, a noticeable share of visitors refuses analytics; your consent platform's statistics show your own rate. If GA4 with consent leaves too little data, the options are:

- **GA4 with Consent Mode advanced and modeling,** if your legal advice accepts it and your traffic meets Google's modeling thresholds.
- **Cookieless, privacy-focused analytics.** Tools such as Matomo (self-hosted and configured for it), Plausible or Fathom count visits without cookies or cross-site identifiers. The French CNIL publishes conditions under which audience measurement can be exempt from consent; Google Analytics does not meet them in its standard setup.
- **Server logs,** which you already have, analysed without identifiers.

getReport itself uses self-hosted analytics and no third-party trackers.

## How to check your setup

> **Free tool:** [Cookie scanner: GDPR consent check](https://getreport.app/tools/cookie-scanner): Free cookie scanner: see every cookie and tracker your site sets before and after the visitor clicks Accept, and whether your banner offers a reject option.

The cookie scanner opens your page as a first-time visitor in a fresh browser from Frankfurt, lists every cookie and tracker before and after it clicks Accept, and notes whether Google Consent Mode is present. For Google Analytics you want to see:

- no `_ga` or `_ga_*` cookie before the click;
- no Google Analytics request before the click, or, with Consent Mode, requests without any Google cookie (getReport does not count those as trackers before consent);
- `_ga` appearing after the click, with a lifetime of 13 months or less.

> **Check: No trackers load before consent.** Analytics, ad pixels and session-recording scripts that run before the visitor answers the cookie banner set identifiers without permission. Under GDPR and ePrivacy that needs prior consent; regulators fine for it, and the banner is worthless if the tags do not wait for it.
>
> 1. Load tracking tags through your consent platform (Cookiebot, OneTrust, Complianz, CookieYes, Google Tag Manager with consent triggers) so they run only after "Accept". Test in a fresh incognito window: no tracker request until you click.
> 2. If you use Google tags, add Consent Mode v2 with the defaults set to denied; the tags then send cookieless pings until consent.

> **Check: Only necessary cookies are set before consent.** Analytics and advertising cookies (_ga, _fbp, _gcl_au, _hjid…) written before the visitor agrees are the most common finding of data-protection audits. Session, security and consent cookies are fine; tracking cookies need a yes first.
>
> 1. Block the scripts that set these cookies until consent (your consent platform's script blocking, or GTM consent triggers), then check again in a fresh browser: the tracking cookies should appear only after "Accept".
> 2. If a plugin or theme sets them directly, look for its "load after consent" option or replace it.

> **Check: Analytics run with Google Consent Mode.** Consent Mode tells Google tags what the visitor agreed to, so analytics keep working (in aggregate) after a "Reject" click instead of going dark. Without it, EU sites lose a large share of their measurement.
>
> 1. Enable Consent Mode v2 in your consent banner's settings and connect it to Google Tag Manager or the GA4 tag.

Then check the settings the scan cannot see: the data processing terms, Google signals, retention and data sharing in the GA4 admin, and the Google Analytics entry in your privacy notice.

## Common mistakes

- **GA4 fired on page load by Tag Manager,** with the banner answered afterwards.
- **GA4 listed as "strictly necessary"** in the consent platform.
- **Consent Mode defaults set to `granted`** for every region.
- **Google signals on by default** with no remarketing ever used.
- **A privacy notice that still describes Universal Analytics** and IP anonymisation.
- **Emails in thank-you page URLs** that end up in GA4 page reports.

## Questions people ask

### Is Google Analytics 4 GDPR compliant out of the box?

No. GA4 is not compliant by default because it sets analytics cookies as soon as the tag loads, and in the EU those need the visitor's prior consent. It can be used lawfully: block it or run Consent Mode until the visitor accepts, accept Google's data processing terms, switch off features you do not need, shorten retention and name it in your privacy notice.

### Is it legal to send Google Analytics data to the US in 2026?

Yes, under the EU–US Data Privacy Framework. Since July 2023 transfers to certified US companies such as Google are covered by an EU adequacy decision, which the EU General Court upheld in September 2025. An appeal to the Court of Justice is pending, and the two previous frameworks were struck down, so document your transfer basis and keep standard contractual clauses as a fallback.

### Why did regulators say Google Analytics was illegal in 2022?

Because data was transferred to the US without adequate protection after the Schrems II judgment struck down Privacy Shield in 2020. Austrian, French and Italian regulators found that IP addresses and cookie IDs sent to Google in the US could be accessed by US authorities, and that IP anonymisation did not prevent it. Those decisions concerned Universal Analytics and predate the 2023 Data Privacy Framework.

### Does GA4 store IP addresses?

No. According to Google, GA4 does not log or store IP addresses. For visitors in the EU, the IP address is used on EU servers to derive a location and is then discarded. That fixes one issue regulators raised in 2022, but the analytics cookie still needs consent in the EU, because the cookie ID itself is personal data and the ePrivacy rule applies regardless.

### Can I use Google Analytics without a cookie banner?

Not for visitors in the EU. GA4 sets analytics cookies that are not strictly necessary, so they need prior consent, which requires asking. Consent Mode lets the tag load without cookies until consent, but you still need a banner to ask. In the UK a statistics exception exists since February 2026 with conditions, and US state laws do not require an opt-in banner for analytics.