Google Analytics and GDPR: What You Need to Know

If you have visitors in the European Union or the UK, GDPR compliance isn't optional, and Google Analytics sits right in the middle of it. GA4 collects data about real people, which means it falls squarely under data protection rules. This isn't legal advice — you should always loop in your own counsel for anything binding — but here's a practical, technical breakdown of what actually matters when running GA4 under GDPR.

Why Google Analytics Is a GDPR Concern

GDPR governs the processing of personal data belonging to EU/UK residents, and analytics cookies, IP addresses, and device identifiers can all qualify as personal data depending on how they're used. That means before GA4 can start collecting data from an EU visitor, you generally need:

• A lawful basis for processing (usually consent, for analytics cookies).
• A clear privacy policy disclosing what's collected and why.
• A way for users to withdraw consent as easily as they gave it.
• An appropriate data processing agreement in place with Google.

Step 1: Get Consent Before Tracking

The safest approach is to not fire GA4 at all until a visitor has actively consented. This is where Consent Mode comes in — it lets you tell Google Analytics what a user has and hasn't agreed to, and GA4 adjusts its behavior accordingly.

// Set defaults before GA4 loads — deny by default
gtag("consent", "default", {
  ad_storage: "denied",
  analytics_storage: "denied",
  ad_user_data: "denied",
  ad_personalization: "denied",
});

gtag("js", new Date());
gtag("config", "G-XXXXXXX");

Then, once the visitor accepts your cookie banner:

gtag("consent", "update", {
  analytics_storage: "granted",
});

With consent denied, GA4 still records anonymous, cookieless "conversion modeling" pings in supported configurations, but it will not set identifying cookies or store data tied to that visitor until consent is granted.

Step 2: Use a Real Consent Management Platform

Hand-rolling your own banner is possible, but a proper Consent Management Platform (CMP) makes this far more reliable — it handles jurisdiction detection, records proof of consent, and integrates with Google's Consent Mode out of the box. If you operate in the EU, look for a CMP registered with the IAB's Transparency and Consent Framework.

Step 3: Turn On Google Signals Carefully

Google signals enables cross-device reporting and remarketing audiences by tying GA4 data to signed-in Google accounts. It's genuinely useful, but it also increases the personal-data footprint of your property. If you enable it, make sure your privacy policy explicitly discloses this and that consent covers it.

Step 4: Set a Sensible Data Retention Period

GA4 lets you control how long user-level and event-level data is retained before it's automatically deleted:

1. Go to Admin > Data Settings > Data Retention.
2. Choose 2 months or 14 months for event data.
3. Decide whether to reset user retention on new activity.

Shorter retention windows reduce your exposure and align well with data minimization principles — one of GDPR's core requirements.

Step 5: Handle Data Subject Requests

GDPR gives users the right to access, correct, or delete their personal data. Google Analytics supports this through the User Deletion API, which lets you programmatically request deletion of a specific user's data based on identifiers like Client ID or User ID.

curl -X POST \
  "https://analyticsadmin.googleapis.com/v1alpha/properties/PROPERTY_ID/userDataDeletionRequests" \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "userDataDeletion": {
      "userDeletionRequest": {
        "userId": "client-id-goes-here"
      }
    }
  }'

Step 6: Minimize What You Actually Collect

GDPR's data minimization principle means you shouldn't collect more than you need. Practically, this means:

• Never pass names, emails, or other directly identifying data as GA4 event parameters or user properties.
• Avoid custom dimensions that could re-identify an individual when combined with other data.
• Review any User-ID implementation to confirm it's a pseudonymous, internal identifier — not something like an email address.

Step 7: Document Everything

Keep a record of your consent flow, your data retention settings, and your data processing agreement with Google. If a regulator or a user ever asks how your analytics setup handles their data, you want a clear paper trail, not a scramble.

Auditing an Existing GA4 Setup for GDPR Gaps

If GA4 has already been running on your site for a while, it's worth a dedicated audit rather than assuming everything is fine:

1. Check whether analytics cookies fire before consent. Open your site in an incognito window with a network tab open, and look for requests to google-analytics.com/g/collect before you've interacted with any cookie banner. If you see them, tracking is starting before consent, which is very likely non-compliant.
2. Review your data retention setting. Go to Admin > Data Settings > Data Retention and confirm it reflects a deliberate choice, not just whatever the default happened to be when the property was created.
3. Search your custom dimensions and user properties for PII. Look specifically for anything resembling names, email addresses, or phone numbers being passed as event parameters — a surprisingly common mistake when a developer wires up a form submission event quickly and passes the whole form payload without filtering it first.
4. Confirm Google signals status matches your consent flow. If Google signals is enabled, your consent banner needs to disclose it and gate it just like standard analytics storage.
5. Test the deletion flow. Simulate a user data deletion request end to end at least once, so you're not figuring out the User Deletion API for the first time under time pressure from a real request.

Working with Legal and Development Together

GDPR compliance for analytics isn't purely a legal question or purely a technical one — it sits between the two. Legal needs to define what lawful basis you're relying on and what the privacy policy discloses; engineering needs to implement Consent Mode correctly and make sure no tracking fires ahead of consent. The teams that handle this well tend to treat it as a shared checklist reviewed together, rather than legal writing a policy that engineering never actually implements to spec, or engineering shipping a consent banner that doesn't match what legal promised.

FAQ about Google Analytics and GDPR: What You Need to Know

Is Google Analytics illegal under GDPR?

No, but it must be configured and used in a way that respects GDPR — typically requiring consent before analytics cookies are set for EU/UK visitors.

Does GA4 anonymize IP addresses automatically?

Yes, GA4 does not store full IP addresses by design; IP addresses are used briefly for geolocation and then discarded, which is an improvement over how Universal Analytics originally handled this.

What is Consent Mode and do I need it?

Consent Mode lets Google tags adjust their behavior based on a visitor's consent choices. It's strongly recommended (and effectively required in many setups) for any site serving EU/UK traffic.

Can I still use GA4 without cookie consent banners?

Only if you can operate GA4 in a way that doesn't require consent under your legal basis — which is rare for standard analytics implementations. Most sites need a consent mechanism.

How long should I retain GA4 data for GDPR reasons?

There's no single legally mandated number, but shorter retention (like GA4's 2-month option) is generally more aligned with data minimization principles than the maximum 14-month setting.

Do I need a Data Processing Agreement with Google?

Yes — Google provides one as part of its Ads Data Processing Terms, and accepting it is a standard part of proper GA4 configuration for EU-facing sites.

Conclusion

GDPR compliance with Google Analytics isn't a single checkbox — it's a combination of consent, retention settings, minimal data collection, and a documented process for handling requests. None of it is especially hard once it's set up correctly, but it does need to be deliberate rather than assumed. For more practical technical breakdowns, visit my website.