Google Analytics and GDPR: What US Teams Need to Do

Google Analytics is not compliant with the GDPR on its own. GA4 gives you privacy controls, but the legal responsibility for using it sits with you as the website operator. If your site or app has visitors in the European Economic Area (EEA), you need valid opt-in consent before analytics cookies fire, a documented basis for sending data to the US, and settings that you review on a schedule. The GDPR applies to you based on who visits, not where your company is incorporated.

This guide covers what GA4 does for you, what it does not, and a checklist you can work through this week. It is written for product managers, designers, developers, researchers and marketers at US companies, not for lawyers. For legal advice on your specific setup, talk to a privacy lawyer or your data protection officer.

Why a US company has to care about the GDPR

The GDPR protects people in the EEA. If you run a SaaS product, a store or a content site and EU residents land on it, you are processing their personal data. A cookie ID, a device identifier or an IP address can all count. That makes you a data controller, even if you have no office in Europe.

The European Data Protection Board (EDPB) task force that reviewed Google Analytics complaints put the point plainly. Website operators decide the purposes and means of the processing, so they are responsible for it, including the transfer of data to a third country. The EDPB 101 Task Force report is where that reasoning is laid out. You cannot hand the problem to the vendor and call it done. You have to be able to show you checked before you switched the tool on.

What GA4 does for privacy out of the box

GA4 is a different product from the older Universal Analytics, and several of its defaults were built with EU rules in mind. According to Google’s page on EU-focused data and privacy, GA4 does not log or store IP addresses. For EU users, Analytics drops IP addresses before the data is logged, and the IP lookup happens on EU-based servers before data moves on for processing.

GA4 also lets you:

• Turn off collection of granular location and device data, including per region.

• Turn off data collection for web or app entirely when needed.

• Set data retention limits for user-level and event-level data.

• Delete data tied to a specific user identifier on request.

These are real improvements, and they help with data minimization. They do not answer the two questions regulators care most about: did the visitor consent, and is the transfer to the US lawful?

Consent: the part most teams get wrong

The Irish Data Protection Commission is direct on this. In its guidance on cookies and other tracking technologies, analytics cookies require consent. It also describes valid consent as freely given, specific, informed and unambiguous.

In practice that rules out several patterns that are still common on US-built sites:

• Pre-ticked boxes. Consent has to be an affirmative act.

• “By continuing to browse, you agree.” Silence and scrolling are not consent.

• One bundled toggle for everything. Analytics, advertising and personalization need separate choices.

• Treating analytics as “strictly necessary.” Product teams often argue that measurement is needed to improve the service. European regulators generally do not accept that. The exemption covers what is needed to deliver the service the user asked for, not your roadmap research.

If you cannot show a record of who agreed to what and when, you cannot prove consent. Pick a consent management platform that stores that record, and test it with a real EU browser session instead of trusting the vendor demo.

Consent Mode v2 in GA4

Google’s consent mode reference explains how your site passes the visitor’s choice to Google tags. The parameters include ad_storage, ad_user_data and ad_personalization. When consent is denied, tags do not read or write advertising cookies. For traffic from the EEA, Google requires you to collect affirmative consent for ad_user_data and ad_personalization and to send those signals through your tags or SDKs. Without them, your ability to use Analytics data for personalized advertising and remarketing is restricted.

Google also has a help page to verify and update consent settings in your property. Run it after any change to your consent banner.

Two cautions. Consent Mode is a signaling mechanism, not a consent banner. It does nothing until a compliant banner feeds it real choices. And a correct signal does not by itself fix the transfer question below.

The transfer problem: why European regulators acted against Google Analytics

The harder issue is where the data goes. After the Court of Justice of the EU struck down the Privacy Shield in 2020, a group of European authorities looked at sites using the older Google Analytics. Several concluded that sending visitor data to the US without sufficient safeguards breached Article 44 of the GDPR.

The Swedish authority is a good example. It ordered four companies to stop using Google Analytics, finding that the standard contractual clauses were not enough to protect against access by US intelligence services. The EDPB task force also noted that anonymizing after the data reaches a third country is not an effective safeguard against that access. In other words, masking an IP address inside the Analytics interface does not undo a transfer that already happened.

What changed with the Data Privacy Framework

The legal picture shifted in July 2023, when the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework. Usercentrics’ summary of the rulings covers that timeline. Companies certified under the framework can receive EU personal data without separate transfer tools. That gave Google Analytics users on the US side a more stable footing.

The framework has been challenged. In September 2025 the EU General Court dismissed the Latombe challenge and upheld the framework, based on the facts and law at the time of the 2023 decision. That is good news for now, but it is not permanent. Earlier arrangements fell, and this one can face further challenges. Treat your transfer basis as something to monitor, not a box you tick once.

The paperwork Google provides

Google publishes Data Processing Terms for customers affected by the GDPR. Its safeguarding your data page describes how measurement data is collected and protected. Accept the terms in your account, read them, and file a copy. They help you document your compliance, but they do not replace your own assessment.

A practical GA4 GDPR checklist

Use this order. Each step builds on the one before.

1. Map your data. List every tag, SDK and pixel on your site and product. Note what each collects and where it sends it. Many teams find tags nobody remembers adding.

2. Decide your legal basis and write it down. For analytics cookies, that means consent.

3. Install a consent banner that blocks before consent. GA4 tags should not fire for EEA visitors until they opt in. Offer “reject” as easily as “accept.”

4. Configure Consent Mode v2. Pass analytics and advertising signals correctly, then verify in your tag debugger and in Google’s consent settings check.

5. Tighten GA4 settings. Shorten retention, turn off granular location and device collection where you do not need it, and disable Google signals if you do not use advertising features.

6. Accept the data processing terms and save the record.

7. Update your privacy policy. Name the tool, the purpose, the retention period, the transfer basis and how to withdraw consent.

8. Keep it alive. Schedule a review each quarter and after any legal change to the transfer framework. Keep dated notes of what you checked.

If your team also needs to understand how events and parameters are set up before you lock down collection, our guide to Google Analytics tracking from click to report walks through it. For the wider question of keeping data trustworthy while you change what you collect, see how to build a healthy tracking setup.

What consent does to your data

Once you ask for opt-in properly, a share of EU visitors will say no. Your GA4 numbers for that region will drop and will no longer represent everyone. That is the correct result, not a bug. Plan for it:

• Compare trends within consented traffic instead of comparing to pre-banner totals.

• Annotate the date you changed your banner so nobody reads a dip as a product problem.

• Use server logs or aggregate, cookieless counts for rough capacity planning, and be careful that they do not identify individuals.

• If you track AI-referred visits as a separate channel, the same consent rules apply to that tracking. A walkthrough on checking LLM traffic in GA4 shows how to set up the segment, and you should still put it behind your consent gate for EEA users.

If you are weighing GA4 against other tools, remember that the legal analysis follows the data flows, not the logo. Our comparison of Mixpanel and GA4 covers features. For each tool you still ask the same questions: what personal data, what consent, where it goes, and who is the processor.

Our perspective: compliance is a product decision

We talk with product teams every week, and the same pattern shows up. GDPR gets handed to legal at the end, after the tracking plan is already built. By then the tags are everywhere, nobody owns the inventory, and the banner is a patch.

We think it works better when compliance is part of the measurement plan from the start. Decide what questions you need answered, collect only the data those questions require, and treat every extra field as a liability. A smaller, cleaner tracking setup is easier to make compliant and easier to trust. It is also cheaper to maintain.

We also see teams assume that one tool fixes it. It does not. GA4’s EU settings reduce what is collected. A consent platform records choices. Your privacy policy tells people what happens. Your team has to own the whole chain and be able to show it. That is the accountability principle regulators keep returning to, and it applies whichever analytics product you use.

Finally, aggregate numbers only tell you what happened. When a funnel drops, you still need to see why. Whatever you use for that, apply the same discipline: mask sensitive fields, collect on a lawful basis, and keep retention short. That is how we build our own product, and it is how we would advise any product team to evaluate one.

Seeing the why behind the numbers

GA4 is strong at counting. It is weaker at showing what a confused user actually did. LiveSession pairs session replay with heatmaps, funnels, error tracking and product analytics dashboards, and it is built with privacy compliance (GDPR and CCPA) in mind. You can start on the Free plan at $0 per year, and paid plans are Basic at $54 per year and Pro at $83 per year. Enterprise is available with custom pricing on request. See the plans on our pricing page, or look at how the product analytics dashboard and click maps work before you decide.

Frequently asked questions

Is Google Analytics compliant with the GDPR?

Not automatically. GA4 has EU-focused privacy controls, but compliance depends on how you use it: valid opt-in consent, a lawful basis for transferring data to the US, accepted processing terms and an accurate privacy policy. The responsibility belongs to the site operator.

Is Google Analytics legal in the EU?

It can be used lawfully, but it has been the subject of enforcement. Several European authorities ordered sites to stop using earlier versions because of US transfers. Since the EU-US Data Privacy Framework was adopted in 2023, the position is more stable, though regulators still expect you to document your assessment.

Do I need a cookie banner for Google Analytics?

If you serve visitors in the EEA, yes. The Irish Data Protection Commission states that analytics cookies require consent, and implied consent or pre-ticked boxes do not meet the standard. Analytics should not load until the visitor opts in.

Does anonymizing IP addresses make GA4 compliant?

No. GA4 already drops IP addresses from EU users before logging, which helps, but it does not replace consent or a lawful transfer basis. European authorities have said that anonymization carried out only after data reaches a third country does not protect against access there.

Does the GDPR apply if my company is only in the US?

Yes, if you process personal data of people in the EEA, for example by tracking their visits to your site. Where your company is based does not remove the obligation. Talk to a privacy lawyer about your specific exposure.

Sources

• EDPB 101 Task Force report on Google Analytics

• Irish DPC guidance note on cookies and other tracking technologies

• Google: EU-focused data and privacy

• Google: Consent mode reference

• Google: Verify and update consent settings

• Google: Data Processing Terms

• Google: Safeguarding your data

• EDPB: IMY orders CDON, Coop, Dagens Industri and Tele2 to stop using Google Analytics

• Usercentrics: Is Google Analytics 4 GDPR-compliant?

• IAPP: General Court dismisses Latombe challenge

• Guide to checking LLM traffic in GA4