Google Analytics

Google Analytics can be used in a GDPR-compliant way, but it is not compliant by default. You must obtain valid prior consent from visitors before loading the analytics tag, sign a Data Processing Agreement (DPA) with Google, and ensure that data transfers to the US are covered by appropriate safeguards such as Standard Contractual Clauses (SCCs). Simply enabling IP anonymisation is not sufficient for GDPR compliance.

Yes. Google Analytics sets persistent cookies (_ga, _gid, _ga_<ID>) that constitute personal data under the GDPR and the ePrivacy Directive. Under EU law, you must obtain freely given, specific, informed, and unambiguous prior consent from the visitor before setting these cookies. This must be implemented via a compliant Consent Management Platform (CMP).

Google Analytics sets four main cookies: _ga (2-year lifetime) to distinguish unique users by storing a Client ID; _gid (24-hour lifetime) to distinguish users within a session; _ga_<MEASUREMENT_ID> (2-year lifetime) to persist GA4 session state; and _gac_<ID> (90-day lifetime) to store campaign-related data. These cookies are classified as Analytics / Performance cookies and require prior consent.

Yes. All data collected by Google Analytics is processed on Google LLC servers located in the United States, which constitutes a restricted transfer under GDPR Chapter V. Google covers this transfer via Standard Contractual Clauses (SCCs). However, organisations are advised to conduct a Transfer Impact Assessment (TIA) to verify the adequacy of those safeguards in light of US surveillance law (FISA 702, Executive Order 12333).

Partially. Google Analytics 4 (GA4) with Consent Mode v2 enabled can operate in a cookieless mode when consent has not been granted. In this mode, no persistent cookies are set, and only anonymised, aggregated pings are sent to Google. However, network requests are still made to Google servers, and Google uses statistical modelling to estimate traffic. This mode does not eliminate the data transfer to Google entirely.

Universal Analytics (UA) was the previous version of Google Analytics. It used a session-based data model and was permanently discontinued on 1 July 2023. Google Analytics 4 (GA4) is the current version. It uses an event-based data model, offers cross-platform tracking (web and app), integrates natively with Google Ads and BigQuery, and supports Consent Mode v2 for privacy-compliant measurement.

By default, Google Analytics 4 stores event-level data for 2 months, which can be extended to 14 months in the property settings. The _ga cookie itself has a 2-year lifetime in the visitor browser. All data is stored on Google servers in the United States and is subject to Google own data retention policies. You can also configure data deletion requests via the GA4 admin panel.

A Data Protection Impact Assessment (DPIA) is required under GDPR Article 35 when processing is likely to result in a high risk to individuals. Given that Google Analytics involves cross-border data transfers, persistent user profiling, and large-scale processing, a DPIA is strongly recommended and may be mandatory. Several European Data Protection Authorities, including the French CNIL and the Austrian DSB, have ruled that the standard deployment of Google Analytics is non-compliant without additional technical and organisational measures.