By Daniel de Almeida Afonso · Last updated: October 12, 2026
Google Analytics 4 (GA4) is not GDPR compliant by default. You are the data controller, so you need valid consent before analytics cookies are set for visitors in the EU, EEA, and UK, a lawful basis for sending their data to the United States, and settings that match your privacy policy. Today that transfer basis is the EU-US Data Privacy Framework (DPF), which Google has certified under but which is under legal and political pressure.
This guide covers what GA4 collects, what regulators decided, where the DPF stands in October 2026, and a 10-step checklist for setting up GA4 with consent. It is general information, not legal advice.
Is Google Analytics GDPR compliant?
No tool is compliant on its own. The GDPR regulates how you use the data, so the answer depends on your setup.
Google acts as a processor for the data it collects for you, and you act as the controller. Google's Ads Data Processing Terms, which we read, describe Google as "a processor of Customer Personal Data"; confirm which terms govern your Analytics account. Google's own compliance work does not cover your obligations. You still need a lawful basis, an accurate privacy notice, and a way to honor visitors' choices.
GA4 collects online identifiers such as cookie IDs, device identifiers, and, as part of ordinary web requests, IP addresses. Under the GDPR, identifiers like these are personal data, even when you cannot read a name from them.
Google states that GA4 does not log or store IP addresses, so the old "anonymize IP" switch from Universal Analytics no longer exists. That helps, but it does not remove the rest of the identifiers. Italy's data protection authority (the Garante) said in 2022 that a shortened IP address is still personal data, and that point is only one of several.
What did regulators decide about Google Analytics?
Between January and September 2022, several authorities found that using Google Analytics sent EU visitors' data to the US without adequate protection. All of these came after the Court of Justice invalidated the EU-US Privacy Shield in the 2020 Schrems II ruling, and all of them predate the DPF.
| Authority | When | What it found |
|---|---|---|
| Austria (DSB) | 13 January 2022 | Google Analytics use breached the transfer rules. The DSB said it was "not recognizable" how Google's technical measures, including encryption, would limit access by US intelligence agencies. |
| France (CNIL) | February 2022 | Ordered website operators to comply and stop the transfers, applying Schrems II. |
| Italy (Garante) | 23 June 2022 | Websites using Google Analytics without safeguards violated the GDPR. A shortened IP address is still personal data. First order gave the site operator 90 days to comply. |
| Denmark (Datatilsynet) | 21 September 2022 | Google Analytics was not compliant because of US transfers, and companies should assess whether continued use fits the GDPR. |
The European Data Protection Supervisor (EDPS) reached a similar view in 2022 about the European Parliament's COVID testing website.
Two points keep these decisions in proportion. First, they were about the transfer of data, not about analytics as such. Second, they examined earlier Google Analytics versions, so they do not automatically describe GA4 today. We did not find a new authority decision that declares GA4 itself unlawful after the DPF took effect, but authorities can still act on your specific setup.
For the wider transfer rules these decisions rest on, see our EDPB Schrems II guidance.
Where does the EU-US Data Privacy Framework stand in October 2026?
The DPF is in force, and it is the legal basis most GA4 users rely on for transfers to Google. It could still change, so plan for that.
Here are the facts, in order:
- 10 July 2023: The European Commission adopted its adequacy decision for the DPF.
- Google's status: Google says it complies with the EU-US and Swiss-US Data Privacy Frameworks and that Google LLC and its wholly owned US subsidiaries have certified, unless explicitly excluded.
- 3 September 2025: The EU General Court dismissed Philippe Latombe's challenge to the adequacy decision in the Latombe case. It rejected his arguments about the independence of the Data Protection Review Court, bulk data collection, and US data security protections.
- 31 October 2025: Latombe appealed to the Court of Justice. The appeal is reported under the case number C-703/25 P. We found no judgment as of this update.
- 29 June 2026: The US Supreme Court ruled in Trump v. Slaughter that limits on removing FTC commissioners are unconstitutional. The FTC is a core enforcer under the DPF, and the adequacy decision assumed it was independent. This is reported by law firms and privacy groups, and We did not read the opinion myself.
- 31 July 2026: The European Data Protection Board (EDPB) wrote to Commissioner Michael McGrath asking the Commission to examine whether the ruling affects the DPF. The EDPB did not ask for the DPF to be repealed.
- July 2026: The privacy group noyb called for the Commission to withdraw from the framework and said it would sue. We found no confirmation that a case has been filed.
Until the Commission amends or withdraws the decision, or a court invalidates it, transfers to certified US companies stay lawful. The risk is a sudden change, as happened with Safe Harbor in 2015 and Privacy Shield in 2020.
A sensible response is to document a fallback. Check which data processing terms apply to your Analytics account and whether they include standard contractual clauses (the Ads Data Processing Terms we read include them as a fallback). For a deeper look at the current risk, read our analysis of whether the DPF is at risk.
Do you need consent to use GA4?
For visitors in the EU, EEA, and UK, plan on yes. The ePrivacy rules require consent before you store or read analytics cookies on someone's device, and the GDPR sets the standard for valid consent. This is the position most regulators take for Google Analytics, and it is the safest default.
Valid consent must be:
- Informed: your cookie notice names Google as a recipient and explains the purpose.
- Specific: consent to analytics is separate from consent to advertising.
- Unambiguous: the visitor acts, for example by clicking Accept. Scrolling or silence does not count.
- Freely given: you do not block access to the site until they agree, and refusing is as easy as accepting.
Some regulators exempt strictly limited first-party audience measurement from consent. We could not confirm a country-by-country list, and GA4 setups that use Google signals or link to advertising products would fall outside the narrowest versions of that idea. Treat consent as required unless your counsel tells you otherwise.
If you use Google's advertising features, Google's EU user consent policy adds its own rules. It covers end users in the EEA, the UK, and Switzerland and requires you to obtain consent to cookies or local storage where legally required, and to the collection, sharing, and use of personal data for ad personalization. It also requires you to keep records of consent and give visitors clear instructions to revoke it. Google can limit or suspend its products if you do not comply.
How does Google Consent Mode work with GA4?
Consent Mode passes your visitor's choices to Google tags so they change what they collect. It does not collect consent for you. You still need a consent banner or a consent management platform (CMP) that sets and updates the signals.
Google's consent signals are:
- analytics_storage: controls analytics cookies, for example to measure visit duration.
- ad_storage: controls advertising cookies and storage.
- ad_user_data: controls whether user data for advertising can be sent to Google. Google also lists it as needed for measurement such as enhanced conversions.
- ad_personalization: controls personalized advertising.
By default, no consent values are set, so you must define defaults before any tag fires. Google recommends scoping those defaults to the regions where you show a banner. If your CMP loads asynchronously, the wait_for_update setting gives the banner time to send its update before tags fire.
For EEA traffic, Google asks you to send the two newer signals, ad_user_data and ad_personalization, in addition to the older pair. Google's help pages show that if ad_personalization is denied, remarketing audiences do not receive data for that user. If ad_user_data is denied, personal data use for advertising and some conversion export to Ads is limited. Secondary sources date the start of this requirement to March 2024. Google's current guidance is in its Consent Mode documentation, and our Consent Mode v2 compliance guide covers the details.
Basic versus advanced Consent Mode
| Basic | Advanced | |
|---|---|---|
| When Google tags load | Only after the visitor grants consent | On page load, with denied defaults |
| Data before consent | None collected | Cookieless pings with coarse data that cannot directly identify a person |
| Analytics cookies when denied | None | None set, accessed, or read |
| Modeled data to fill gaps | Not available from GA4 behavioral modeling, per Google's guidance | Available |
| Consent risk | Lower | Higher: pings are sent before consent, so confirm your regulator accepts that |
Choose basic if you want the cleanest consent position and can accept gaps in your data. Choose advanced if you need modeled reporting, and have your counsel confirm that cookieless pings before consent fit your risk tolerance and your regulator's position. Our Google Consent Mode guide walks through both.
One 2026 change matters here. Google's Analytics Help notice says that starting June 15, 2026, Consent Mode in Google Ads becomes the single control for Analytics data used with ads, and Google signals only links Analytics data to signed-in user information for behavioral reporting. Google says ad personalization controls and IP address handling will move in later in 2026, with dates still to come. See our note on what changed with Consent Mode in June 2026.
Which GA4 settings affect GDPR compliance?
Four settings matter most: data retention, Google signals, data sharing, and what you send in events and URLs.
Data retention. Standard GA4 properties offer 2 months or 14 months for user-level and event data. Longer periods of 26, 38, and 50 months are available only on Analytics 360. The GDPR requires you to keep data no longer than needed, so pick the shortest period that serves your reports, and make your privacy policy say the same. Do not rely on the default, and check what your property is set to.
Google signals. This setting lets Analytics use data from signed-in Google users who turned on ads personalization. It supports cross-device reports and demographic data. Google says signed-in data expires after 26 months by default, and a shorter retention setting overrides that. Leave it off unless you need it and have consent, or limit it by region.
Data sharing and ads links. Linking GA4 to Google Ads or sharing data with other Google products widens the purposes. Link only what you use, and make sure your consent categories cover it.
What you send. Google's policy prohibits sending personally identifiable information to Analytics. Both URL paths and parameters must be free of it, as must utm parameters and page titles. Visitors can also type personal data into search boxes and forms, so strip that before it goes out. Google also says not to collect fine-grained location, meaning any area under one square mile.
A 10-step GA4 GDPR compliance checklist
- Map your use. List which GA4 reports you actually use and whether any advertising features are on. This decides your consent categories.
- Decide your legal basis. For EU, EEA, and UK visitors, plan on consent for analytics cookies.
- Install a consent banner or CMP that blocks Google tags until consent, or sets denied defaults, and that records each choice.
- Set consent defaults to denied for the regions where you show a banner, before any tag fires.
- Choose basic or advanced Consent Mode using the table above and write the decision down.
- Send all four consent signals if you use advertising features in the EEA, and test that updates fire when a visitor changes their mind.
- Set data retention to 2 or 14 months and match it to your privacy policy.
- Review Google signals and product links. Turn off what you do not need.
- Strip personal data from URLs, page titles, campaign parameters, and form fields.
- Update your privacy and cookie notices. Name Google, state the purposes, the retention period, the transfer basis (currently the DPF), and how to withdraw consent. Keep your consent records.
After you finish, run a test visit with a banner rejection and confirm no analytics cookies appear. Use Google Tag Assistant to check the consent state.
What if you do not want to rely on Google?
Some teams drop Google Analytics for tools that avoid personal data or keep it in the EU. Matomo can be self-hosted, which gives you full control of where data lives. Plausible, Fathom, Simple Analytics, and Piwik PRO position themselves as privacy-first alternatives. We did not re-verify each vendor's current consent position for this update, so check each one's documentation against your regulator's view before you drop your banner. Our overview of cookieless tracking technology explains how these tools work.
Frequently asked questions
Is Google Analytics 4 GDPR compliant?
Not by default. GA4 can be used lawfully if you get valid consent before setting analytics cookies, rely on a valid transfer basis such as the DPF, and configure retention and data sharing to match your privacy policy. The compliance sits with you as the controller, not with Google.
Do I need a cookie banner for Google Analytics?
Yes, in practice, for visitors in the EU, EEA, and UK. Consent is the safest basis for analytics cookies, and Google's own EU user consent policy requires consent for advertising features. A few regulators accept narrow exemptions, so confirm the rule for each country you serve.
Is Google Analytics illegal in the EU?
No. In 2022, authorities in Austria, France, Italy, and Denmark found that the US data transfers behind Google Analytics were unlawful at the time. Since the DPF took effect in July 2023 and Google certified under it, transfers can rely on it, though its future is uncertain.
Is the EU-US Data Privacy Framework still valid?
Yes, as of October 12, 2026. The General Court upheld it in September 2025, and the appeal by Philippe Latombe is pending at the Court of Justice. The Supreme Court's June 2026 FTC decision and the EDPB's July 2026 letter add pressure, but the adequacy decision stays in force unless it is withdrawn or invalidated.
Do I need Consent Mode v2 for GA4?
If you use Google advertising features with EEA traffic, yes, you should send ad_user_data and ad_personalization as well as the two older signals. For analytics alone, Consent Mode is not a legal requirement, but it is how Google tags respect your visitors' choices.
How long can I keep GA4 data?
Standard GA4 properties allow 2 months or 14 months. Only Analytics 360 offers 26, 38, or 50 months. Under the GDPR, choose the shortest period you can justify and state it in your privacy policy.
Does GA4 store IP addresses?
Google says GA4 does not log or store IP addresses, so IP masking is not needed. That does not make GA4 free of personal data, because cookie IDs and device identifiers are still collected.
