> GA4 is not GDPR compliant by default. See what the law requires, which cookies GA4 sets and how to configure consent, Consent Mode v2 and retention. > > Canonical: https://www.flowconsent.com/en/blog/google-analytics-gdpr-compliant [Marketing tools](https://www.flowconsent.com/en/blog?category=tools) # Is Google Analytics GDPR compliant? The complete GA4 guide By FlowConsent · Published 6 March 2026 · Updated 9 October 2026 · 9 min read In short Google Analytics 4 can be used lawfully in Europe, but only with prior consent, Consent Mode v2 and a minimised configuration. Here is what the authorities decided and how to set GA4 up step by step. ## TL;DR Google Analytics 4 is not GDPR compliant out of the box. It sets cookies (`_ga`, `_ga_`), collects personal data (cookie identifiers, browsing behaviour, device and location data) and sends it to Google, including servers in the United States. Several European data protection authorities ruled against Google Analytics in 2022. You can still use GA4 lawfully in Europe, but only if you block it until the visitor consents, configure Google Consent Mode v2 correctly, minimise what GA4 collects and document the processing. Without these measures, your site carries a real legal risk. ## Why the question still matters in 2026 Google Analytics remains the most widely used web analytics tool in the world, and its GDPR compliance has been under regulatory scrutiny for years. The problem has two layers that are often confused: - **Consent.** GA4 stores identifiers in the visitor's browser for a purpose that is not strictly necessary. Under the ePrivacy rules (and the GDPR for the data that follows), that requires prior consent. - **Transfers.** The data goes to Google, a US company. Whether that transfer is lawful depends on the EU-US legal framework of the day. Fixing one layer does not fix the other. Since July 2023, transfers to Google have a new legal basis, but the consent requirement is unchanged. The useful question is what must be configured to use GA4 without legal risk, and when an alternative makes more sense. ## What the GDPR and ePrivacy rules require for analytics The GDPR applies to any website that processes data of people in the EU, wherever it is hosted. The ePrivacy Directive adds a specific rule: reading or writing information on a device requires consent, unless it is strictly necessary for the service the user asked for. For Google Analytics, this means five concrete obligations: 1. **A legal basis.** For analytics cookies, that basis is consent. There is no general exemption for audience measurement tools. 2. **Prior blocking.** The analytics script must not run until the visitor has said yes. Loading GA4 on page load, before any choice, is the most common violation regulators detect. 3. **Clear information.** Your privacy policy must say what is collected, why, for how long, by whom, and how users exercise their rights (access, deletion, withdrawal of consent). 4. **Safeguarded transfers.** Data leaving the EU needs a legal mechanism: an adequacy decision, standard contractual clauses, or supplementary measures. 5. **Accountability.** You must be able to prove that consent was obtained and document the processing in your record of processing activities (GDPR Article 30). ## Which cookies does GA4 set and what data does it collect? ### GA4 cookies The standard GA4 tag (gtag.js or the GA4 tag in Google Tag Manager) sets first-party cookies on your domain: - `_ga`: unique visitor identifier, valid for 2 years by default - `_ga_` (where `` is the end of your Measurement ID): keeps the session state, also valid for 2 years If a scan of your site also finds `_gid` or `_gat_UA-...`, they come from the old Universal Analytics library: a legacy tag is still running somewhere and should be removed. Two years is longer than the 13-month maximum lifetime the CNIL recommends for consent-based trackers. You can shorten it with the `cookie_expires` setting of the GA4 tag. Our guide on [cookie retention and the 13-month rule](https://www.flowconsent.com/en/blog/cookie-retention-duration-gdpr-13-months) explains the limits that apply. ### Data collected GA4 collects visited URLs, interaction events (clicks, scrolls, form submissions, downloads), session data, approximate location, and technical information (browser, operating system, screen size, device). Google states that GA4 does not log or store IP addresses, but the IP is still used to derive location, and the cookie identifier on its own is personal data under the GDPR. Google acts as a processor on behalf of the website owner, who remains the controller. You decide to install Google Analytics, so you are legally responsible for the compliance of the collection: Google provides the settings, activating and checking them is your job. ## What European authorities have decided ### The 2022 decisions Following complaints by the noyb association, several authorities examined websites using Google Analytics (then Universal Analytics): - **Austria (DSB, January 2022)** was the first to find that using Google Analytics violated the GDPR rules on international transfers (Chapter V), based on the CJEU's Schrems II judgment. - **France (CNIL, February 2022)** found a violation of Article 44 of the GDPR and ordered several French websites to comply within one month. - **Italy (Garante, June 2022)** ordered a website to stop using Google Analytics under the existing conditions. - **Denmark and Norway** reached similar conclusions. All these decisions rest on the invalidation of the Privacy Shield by Schrems II in July 2020. They did not ban Google Analytics as such, but made one thing clear: without prior consent, proper configuration and a transfer assessment, there is no compliance. ### The Data Privacy Framework since July 2023 On 10 July 2023, the European Commission adopted the EU-US Data Privacy Framework (DPF). Google is certified under it, which gives transfers to Google in the United States a legal basis again. In September 2025, the EU General Court dismissed an action seeking to annul the DPF (Latombe v Commission). An appeal is now pending before the Court of Justice (case C-703/25 P), so the long-term durability of the framework is still not guaranteed. Keep documenting your transfer assessment. Most importantly, the DPF only addresses transfers. The obligation to collect consent before GA4 sets its cookies is entirely independent of it. ### Is there a consent exemption for GA4? The CNIL exempts some audience measurement tools from consent, but only if every condition is met: purpose strictly limited to audience measurement for the publisher alone, no cross-referencing or cross-site tracking, no transfer to third parties, IP anonymised before processing, tracker lifetime of 13 months maximum and data kept 25 months maximum. GA4 in its standard configuration sends data to Google for its own processing and cannot meet these criteria. Tools like Matomo can, in a specific configuration. The [FlowConsent services catalog](https://www.flowconsent.com/en/doc/services-and-legal-basis) shows this checklist for every service flagged as potentially exempt. ## How to use GA4 in a compliant way Installing GA4 with its default settings is not enough. Here are the six steps that matter. ### Step 1: block GA4 before consent This is the most important rule. The Google Analytics script must not load until the visitor has accepted analytics cookies through your [cookie banner](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide). A banner that displays but does not actually block scripts is not compliant. To check, open your site in a private window and inspect network requests before touching the banner: any request to google-analytics.com or googletagmanager.com setting `_ga` means your scripts load before consent. ### Step 2: configure Consent Mode v2 [Google Consent Mode v2](https://www.flowconsent.com/en/blog/google-consent-mode-v2-implementation-guide) tells Google tags what the visitor has accepted. It has been required since March 2024 to keep measurement and remarketing features for traffic from the EEA. It uses four signals: `analytics_storage`, `ad_storage`, `ad_user_data` and `ad_personalization`. All four must default to `denied` for European visitors and be updated by your CMP once the visitor chooses. Understand the two modes before choosing: - **Basic mode:** Google tags do not load at all before consent. Nothing is sent to Google if the visitor refuses. - **Advanced mode:** tags load with consent denied and send cookieless pings, which Google uses to model conversions. No cookies are written, but data is still sent to Google, which some authorities and lawyers view with caution. Assess this choice with your DPO. With FlowConsent, an inline stub sets [denied defaults for all four signals before any Google tag loads](https://www.flowconsent.com/en/doc/google-consent-mode), then the banner sends the update when the visitor chooses. A refusal results in cookieless pings (`gcs=G100`) and no cookies. ### Step 3: configure GA4 to minimise data In GA4 Admin: - **Data retention:** standard properties offer 2 months (the default) or 14 months for event-level data used in Explorations. Keep 2 months unless you really need longer analyses. Standard reports are not affected by this setting. - **Google Signals:** disable it if you do not need cross-device reporting or remarketing. It processes additional data linked to signed-in Google accounts and requires specific disclosure. - **Ads personalisation:** keep it disabled if you do not run Google Ads remarketing. - **Granular location and device data:** disable its collection in the EU if your analysis does not need it. None of these settings replaces consent: they only reduce the data processed once consent is given. ### Step 4: load GA4 correctly, with or without GTM If you use Google Tag Manager, your CMP snippet must sit in the `` above the GTM container, never inside GTM as a tag, and your GA4 tag must check the consent state. Our [GTM installation guide](https://www.flowconsent.com/en/doc/install-google-tag-manager) and the article on [Google Tag Manager and Consent Mode v2](https://www.flowconsent.com/en/blog/google-tag-manager-consent-mode-guide) detail the setup. If you paste the GA4 snippet directly into your site, your CMP must block it until acceptance, and the CMP snippet must come first in the ``: any script placed above it escapes prior blocking. Also check that GA4 is not injected by your hosting or site builder settings, outside the banner's control. Data sent from your server (for example through the GA4 Measurement Protocol) escapes any banner. It must follow the same consent decision: see our article on [server-side tagging and consent](https://www.flowconsent.com/en/blog/server-side-tagging-cookies-consent-impact). ### Step 5: update your privacy policy and records Your privacy policy must mention Google Analytics and Google Ireland Ltd as the provider, the data collected, the legal basis (consent), retention periods, transfers to the United States and their framework (DPF), and user rights, including how to withdraw consent. Record the processing in your Article 30 register and keep your transfer assessment on file. ### Step 6: use a CMP that blocks and keeps proof Your consent management platform must block scripts before consent, send Consent Mode v2 signals, store proof of consent, and let visitors change their mind at any time. When [choosing a CMP](https://www.flowconsent.com/en/blog/how-to-choose-consent-management-platform), check that it handles the technical blocking, not just the display of a banner. FlowConsent goes one step further: its [compliance verification](https://www.flowconsent.com/en/doc/compliance-verification) loads your pages while refusing consent and lists everything that still fires, so you can prove that GA4 stays silent after a refusal. ## Common mistakes (and how to avoid them) **GA4 loads in the \`\\` with no condition.** The script and `_ga` cookie fire on page load, before the banner. Fix: block the tag through your CMP or condition it in GTM with Consent Mode v2. **Relying on Consent Mode alone.** Consent Mode adjusts Google tags, but it does not block third-party scripts. Meta Pixel, TikTok and other trackers must be blocked separately by your CMP. To understand the [different types of cookies](https://www.flowconsent.com/en/blog/what-are-cookies-types-how-they-work), see our dedicated guide. **Treating IP anonymisation as a substitute for consent.** GA4 does not store IP addresses, but the persistent `_ga` identifier still requires prior consent. These are two separate questions. **Using a banner without an equivalent reject option.** European authorities, including the CNIL, require refusing to be as easy as accepting. A large Accept button next to a small "Settings" link is not compliant. **Not testing after configuration.** Run a [cookie scan](https://www.flowconsent.com/en/scan) after every change, including changes made by marketing teams. ## GDPR-friendly alternatives to Google Analytics If configuring GA4 is too heavy, or you would rather avoid transatlantic transfers, other options exist: - **Matomo in exempt mode**, self-hosted or hosted in the EU, can run without consent in France if it meets every CNIL condition. Our article on [Matomo and cookies](https://www.flowconsent.com/en/blog/matomo-cookies-gdpr-do-you-need-banner) explains the configuration. - **Cookieless analytics tools** measure traffic without identifiers. They offer less detail but can sometimes work without a banner: see our [complete guide to cookieless analytics](https://www.flowconsent.com/en/blog/cookieless-analytics-complete-guide). The exemption only applies if the tool produces anonymous, aggregated statistics, with no transfer outside the EU and no reuse by the provider. In every other case, consent remains required. ## GA4 and GDPR compliance checklist - Block the GA4 or GTM script by default through your CMP. - Configure Consent Mode v2 with all four signals set to `denied` by default for the EEA. - Check in a private window that no `_ga` cookie is set before acceptance. - Remove any legacy Universal Analytics tag (`_gid`, `_gat_` cookies). - Shorten the `_ga` cookie lifetime to 13 months maximum. - Keep GA4 data retention at 2 months unless you need 14. - Disable Google Signals and ads personalisation if you do not use them. - Mention GA4 and Google Ireland Ltd in your privacy policy, with transfers and DPF coverage. - Record the processing in your Article 30 register and document your transfer assessment. - Apply the same consent decision to data sent from your server. ## Conclusion Google Analytics 4 can be used in a GDPR-compliant way, but it takes rigorous configuration: scripts blocked before consent, Consent Mode v2 set to denied by default, minimised GA4 settings, an up-to-date privacy policy and a CMP that keeps proof. Start with a [free scan of your site](https://www.flowconsent.com/en/scan) to find the scripts that load before consent and any undeclared cookies, then fix them one by one. [Back to the blog](https://www.flowconsent.com/en/blog) Share this article · [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fgoogle-analytics-gdpr-compliant) · [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fgoogle-analytics-gdpr-compliant) Questions ## Common questions on this topic. Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Is Google Analytics illegal in Europe? Google Analytics is not banned as such. Several European authorities ruled that its use violated the GDPR. Since the adoption of the Data Privacy Framework in July 2023, the legal framework has evolved, but challenges are pending before the CJEU. ### Do I need a cookie banner if I use Google Analytics? Yes. Google Analytics sets cookies and collects personal data. The GDPR and the ePrivacy Directive require explicit consent before setting non-essential cookies. ### Does Consent Mode v2 make Google Analytics GDPR compliant? No, not on its own. Consent Mode v2 adjusts the behavior of Google tags based on consent, but it is not a complete compliance solution. ### Does GA4 automatically anonymize IP addresses? GA4 truncates IP addresses by default, but this truncation does not constitute full anonymization under the GDPR. ### Can I use Google Analytics without cookies? GA4 uses first-party cookies by default. It is possible to configure GA4 in a cookieless mode via Consent Mode, but the data collected is very limited. ### What are the penalties for non-compliance? The GDPR provides for fines of up to 20 million euros or 4% of global annual turnover. Read next ## Keep reading. [All articles](https://www.flowconsent.com/en/blog) [Marketing tools · 5 July 2026](https://www.flowconsent.com/en/blog/cookieless-analytics-complete-guide) ### [Cookieless analytics and tracking: a complete guide to measuring without consent](https://www.flowconsent.com/en/blog/cookieless-analytics-complete-guide) [How to measure traffic and conversions without consent-required cookies: the exemption, cookieless tools, alternative techniques and their real limits.](https://www.flowconsent.com/en/blog/cookieless-analytics-complete-guide) [Read the article ](https://www.flowconsent.com/en/blog/cookieless-analytics-complete-guide)· [Marketing tools · 25 March 2026](https://www.flowconsent.com/en/blog/youtube-nocookie-embed-videos-without-cookies-gdpr) ### [YouTube no cookies: what youtube-nocookie.com does and is it GDPR compliant?](https://www.flowconsent.com/en/blog/youtube-nocookie-embed-videos-without-cookies-gdpr) [YouTube-nocookie.com is not enough for GDPR compliance. Local storage, cookies on play click: here is how to embed YouTube videos correctly.](https://www.flowconsent.com/en/blog/youtube-nocookie-embed-videos-without-cookies-gdpr) [Read the article ](https://www.flowconsent.com/en/blog/youtube-nocookie-embed-videos-without-cookies-gdpr)· [Marketing tools · 21 June 2026](https://www.flowconsent.com/en/blog/google-signals-gdpr-privacy-guide) ### [Google Signals and GDPR: privacy guide and compliance](https://www.flowconsent.com/en/blog/google-signals-gdpr-privacy-guide) [Google Signals links GA4 sessions to Google accounts for cross-device tracking and remarketing. This guide covers the GDPR implications, how to disable it, and compliant alternatives.](https://www.flowconsent.com/en/blog/google-signals-gdpr-privacy-guide) [Read the article](https://www.flowconsent.com/en/blog/google-signals-gdpr-privacy-guide) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)