Google Signals and GDPR: privacy guide and compliance

What Does Google Signals Do?

Google Signals is a GA4 feature that, when enabled, produces four key effects:

1. Cross-device reconciliation: Google links your GA4 sessions to the user's Google account ID to reconstruct the full journey across mobile, tablet, and desktop
2. Demographic and interest data: GA4 receives data on the age, gender, and interest categories of users signed into Google
3. Enhanced remarketing: GA4 audience lists are enriched with Google signals for targeting across the Google network
4. Cross-channel attribution: conversions are attributed more accurately by cross-referencing multi-device sessions

Google Signals and GDPR: ICO and EDPB Position

The ICO and EDPB have confirmed that cross-device tracking via Google Signals constitutes personal data processing under GDPR Article 4. The key requirements are:

For the wider question, read our analysis of whether Google Analytics is GDPR compliant.

1. Consent must be obtained before Google Signals is activated
2. Users must be informed that their data is linked to their Google account
3. Cross-device tracking must be explicitly mentioned in the cookie policy
4. Withdrawing consent must immediately stop Signals data transmission

How to Disable Google Signals in GA4

If you do not have valid consent, or want to limit data collection, follow these steps to disable Google Signals:

1. Sign into Google Analytics 4 and navigate to Admin
2. Under the Property column, click Property Settings
3. Scroll to Google Signals and click Google Data Settings
4. Click Deactivate and confirm the deactivation
5. Verify in Data Streams that the signal is inactive

The Data Thresholding Effect

When Google Signals is disabled or when users have not consented, GA4 applies data thresholding. This means that certain dimensions (age, gender, interest) disappear from reports, and exploration reports may show aggregated or suppressed data below privacy thresholds. This behavior is expected and correct in a GDPR-compliant setup.

To recover part of this data, compare the two options in our guide to Consent Mode basic vs advanced.

Common Mistakes with Google Signals

Enabling Google Signals by default. GA4 activates Google Signals automatically in some configurations. Check the activation status every time a new GA4 property is created.

The Google Analytics 4 entry in our services catalog summarises the cookies and consent requirements documented for GA4.

Confusing Signals with User-ID. User-ID is an internal mechanism based on your own customer identifier. Google Signals uses the Google account ID. These are distinct with different GDPR implications.

Not mentioning Signals in the cookie policy. The EDPB requires each processing purpose to be explicitly described. Cross-device tracking via Signals must appear as a separate purpose.

Our cookie policy guide explains what each entry should contain.

Using Signals without Consent Mode v2. Without Consent Mode v2, GA4 cannot respect consent state in a granular way. All four parameters must be transmitted before GA4 loads.

Our documentation on Google Consent Mode v2 with FlowConsent explains how denied defaults are set before any tag fires.

Google Signals GDPR Compliance Checklist

1. Check whether Google Signals is enabled in your GA4 property
2. If yes, ensure explicit consent is obtained before it activates
3. Mention cross-device tracking in your cookie policy
4. Implement Google Consent Mode v2 with all four parameters
5. Test that Signals deactivation applies correctly when consent is refused
6. Monitor the impact of data thresholding on your audience reports
7. Document Signals processing in your GDPR records of processing activities

Conclusion

Google Signals amplifies GA4's analytical power but introduces significant GDPR risk if consent is not properly managed. The ICO has acted against organizations transferring data to Google without a valid legal basis. A compliant consent setup protects your organization.

Scan your site for free to check your compliance: Free FlowConsent Scan