The new Google Analytics 4, which replaced the popular Universal Analytics, is one of Google's key tools for online marketing and eCommerce. Its more privacy-focused design shows a shift in how data is processed. But with stricter privacy laws in Connecticut, you might wonder if Google Analytics 4 adheres to the Connecticut Data Privacy Act (CTDPA).
In short, the answer is yes - the new version of Google Analytics does comply with the CTDPA privacy regulations. However, using it also comes with some responsibilities for your business.
In this article, we'll dive into:
- How Google Analytics 4 adheres to the CTDPA rules
- What companies need to do with Google Analytics data to stay within CTDPA rules
- What happens if you don't comply with the CTDPA rules
- How to deal with CTDPA rules related to Google Analytics 4
Is Google Analytics 4 CTDPA Compliant?
Google Analytics 4 complies with the CTDPA rules, but this doesn't mean your website automatically does. You still need to undertake some steps.
Google Analytics 4 uses online trackers to collect and process user data. Their data handling agreement clearly states they manage "Online IDs, including cookie IDs, IP addresses, and device IDs." It aggregates the data and creates valuable insights for businesses that use the tool for data collection and processing.
The Google Analytics cookies track how users navigate a website on different devices. Its first-party cookies create a client ID, giving businesses insight into who's visiting, where they're coming from, how long they stay on pages, etc. This information helps website owners understand how users use their websites and improve the user experience based on this data.
Setting it up is simple, even for non-tech-savvy individuals. The business owner just needs to set up a GA4 property, put a JavaScript tracking code on the website, and start collecting data. This data can be used with other Google products and ad features, like retargeting and customizing goo. As you might guess, Google uses the data to build user profiles. They track the websites you visit and learn about your interests. Then, they can show you ads that match your interests.
The CTDPA covers this data. It operates on an opt-out basis, meaning businesses don't have to get cookie consent to use Google Analytics. This means you can process website user data through Google Analytics 4. It can also be used in conjunction with Google Tag Manager.
The Connecticut Data Privacy Act (CTDPA) applies to businesses that operate in Connecticut or aim their products or services at its residents and have met the following conditions in the previous calendar year:
- They process data of at least 100,000 consumers, except when personal data was only used or processed to complete payment.
- They process data of at least 25,000 consumers and make more than 25% of their total income from selling personal data.
Nonprofits and government entities don't have to meet these conditions. They are exempt from the law.
How to Use Google Analytics 4 in Compliance with the CTDPA
You can use Google Analytics 4 in Virginia or anywhere in the US without asking for user consent.
This is different from the situation in the European Union, where the General Data Protection Regulation (GDPR) dictates that websites need to obtain consent for using Google Analytics through cookie banners, a rule that US data privacy laws don't have.
However, once you gather customer data, the CTDPA imposes specific requirements. If you're using Google Analytics 4, these include:
- Allowing consumers to opt out of the sale of personal information
- Allowing consumers to opt out of processing for targeted advertising
- Determining a data retention period
- Honoring consumer requests
- Conducting a data protection assessment
Opting Out of the Sale of Personal Information and the Processing of Targeted Advertising
In 2025, CTDPA-compliant businesses must comply with Global Privacy Controls (GPC) and similar opt-out technologies. You’ll have to set your Google Analytics to disable cookies if the user’s browser sends a signal indicating they don’t want cookies.
Until then, you need to allow them to opt out of the sale of personal information and the sharing of personal information for targeted advertising.
You can do so by including an opt-out link or button on the footer of your website.
Honoring Consumer Requests
People who visit your website have CTDPA rights for the data collected by GA4 cookies. They have the right to know about data use, access the data, have their data corrected or transferred to another controller, and ask for the data to be deleted.
Options in the Google Analytics 4 control panel make dealing with a user’s request easier.
Conducting a Data Protection Assessment
Using Google Analytics data in tandem with other Google products for targeted advertising means you must conduct a data protection impact assessment. It will give you an overview of the risky processing activities in your business.
When it comes to Google Analytics and Google advertising tools, it won’t prevent you from using them. It simply means that you’ll have a document stating that you process such data and will inform your decision about data privacy in your organization.
What You Don’t Have to Do
Many US business owners are confused about the use of Google Analytics 4 due to the myth that Google Analytics is illegal in the European Union.
Data protection authorities have made decisions in Europe stating that data transfers from Europe to the United States are illegal, but that doesn't affect US businesses. You don’t transfer data. You collect it in America and keep it there. Therefore, the General Data Protection Regulation (GDPR) of the European Union does not apply to you as long as you don’t reach out and process the data of EU individual users.
As a result, you do not need to:
- Use Google Analytics 4 in Consent Mode. Collecting GA identifiers won’t trigger CTDPA obligations until you share the data with Google for targeted advertising.
- Use the IP anonymization feature. It may be good practice for protecting your users’ privacy, but it isn't required by the CTDPA or any other US consumer privacy law.
- Obtain explicit consent for the use of GA. Your users can opt out of sharing or selling their personally identifiable information (PII) and request the deletion of the data. But it doesn’t mean you must show them a cookie banner asking for explicit user consent.
How to Comply with the CTDPA Google Analytics 4 Requirements
You’ll comply with the CTDPA Google Analytics 4 requirements if you:
- Allow data subjects to opt out of the sharing or selling of personal information.
- Honor GPC signals.
- Determine data retention periods.
- Respond to consumer requests, including GA data deletion.
- Conduct data protection assessments.
We at Secure Privacy have developed tools to help you comply with the CTDPA, most notably with consumer requests and opting out of sharing personal information.
The same toolset allows you to comply with the Google Analytics 4 legal requirements from the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), the Colorado Privacy Act (CPA), the Utah Consumer Privacy Act (UCPA), and the Virginia Consumer Data Protection Act (VCDPA).
