FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Analytics

Google Analytics 4

Analytics

Google Analytics 4 (GA4) is Google's latest analytics platform, replacing Universal Analytics. It uses an event-based data model, cross-device measurement, and machine learning to provide insights into user behaviour across web and app. Multiple European data protection authorities have ruled that standard GA4 deployments violate GDPR due to unlawful US data transfers. Consent is required before GA4 loads, Consent Mode v2 must be implemented, and a DPA with Google must be signed. The EU Data Processing addendum and careful configuration are essential.

Block Google Analytics 4 until consentScan my site
Overview

What does Google Analytics 4 do?

What is Google Analytics 4?

Google Analytics 4 is Google's current web and app analytics platform, replacing the deprecated Universal Analytics (GA3). GA4 uses an event-based data model where all interactions are tracked as events (page_view, scroll, click, purchase, etc.) rather than pageviews and sessions. It offers cross-device measurement via User ID and Google Signals, machine learning-powered insights, predictive metrics, and native integration with Google Ads for conversion measurement and audience building.

The EU GDPR problem: multiple DPA rulings

Between 2022 and 2023, data protection authorities in Austria (DSB), France (CNIL), Italy (Garante), Belgium (APD), Denmark (Datatilsynet), Greece (HDPA), Norway (Datatilsynet), and the Netherlands (AP) issued decisions ruling that standard GA4 deployments violate GDPR. The core issue: GA4 transfers IP addresses and other identifiers to Google's US servers, where they can be accessed by US intelligence agencies under FISA 702, a transfer with no adequate protection under Schrems II.

Consent Mode v2 and configuration

Google Consent Mode v2 (mandatory for EU/EEA from March 2024) allows GA4 to operate in a privacy-preserving mode when users decline consent: it uses cookieless pings and modelled conversions rather than tracking individuals. Enable IP anonymisation. Set data retention to the minimum (2 months). Disable Google Signals for EU traffic. Sign the Google Measurement Controller-Controller Data Protection Terms and the EU Data Processing addendum.

GDPR-compliant alternatives

EU-based analytics alternatives include Matomo (self-hostable, EU cloud), Plausible (Estonia, cookieless, no consent required), Fathom Analytics (Canada, GDPR-compliant), Piano Analytics (France), and Piwik PRO (EU-hosted). These provide web analytics without the US transfer issues inherent to GA4.

Practical compliance steps

Implement a GDPR-compliant CMP. Block GA4 until analytics consent is given. Implement Consent Mode v2. Enable IP anonymisation and set minimum data retention. Disable Google Signals for EU. Sign the Google DPA and EU Data Processing addendum. Add GA4 to your cookie policy and privacy policy disclosing US transfers and SCCs.

Compliance

Google Analytics 4 and the GDPR

Google Analytics 4 is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Consent (Art. 6(1)(a) GDPR) required for GA4 cookies under the ePrivacy Directive. GA4 must not load until analytics consent is obtained. Implement Google Consent Mode v2 to manage consent signals. The EU Data Processing addendum with Google is required. Consider Privacy-first configurations with IP anonymisation and data retention minimisation.
Risk level
high
Applicable regulations
GDPR, ePrivacy Directive. Multiple EU DPAs have ruled standard GA4 deployment non-compliant. SCCs required. Consent Mode v2 integration required for Google advertising features.

Impact assessment (DPIA)

A DPIA is recommended for GA4 deployments combining cross-device tracking, Google Signals, and demographic reporting. The combination of individual-level event tracking, US data transfer, and linkage with Google's advertising ecosystem warrants documented risk assessment.

Sample text for your banner

We use Google Analytics 4 to understand how visitors use this website. GA4 uses cookies and transfers data to Google servers in the US. You can accept analytics cookies below or manage your preferences. Without your consent, GA4 will not be loaded.
Cookies and trackers

What Google Analytics 4 sets and contacts

Tracking method
JavaScript gtag.js or analytics.js, first-party cookies, event-based measurement, cross-device tracking, Google Signals, server-side Measurement Protocol
Server location
United States (Google infrastructure) with EU data processing option
Data transferred outside the EU
Google Analytics 4 processes all data on Google's US infrastructure by default. The EU Data Processing option routes data through Google's EU servers for initial processing, but data may still be transferred to the US for certain operations. Multiple EU data protection authorities (Austria, France, Italy, Belgium, Netherlands) have ruled that standard GA4 transfers to the US violate GDPR.

Cookies set (5)

NameTypeDurationPurpose
_gaAnalytics2 yearsDistinguishes unique users
_gapersistent2 yearsGoogle Analytics 4 unique client identifier for distinguishing individual users across sessions
_ga_<container-id>Analytics2 yearsMaintains session state
_ga_XXXXXXXXpersistent2 yearsGoogle Analytics 4 session state identifier specific to the GA4 property
_gidpersistent24 hoursGoogle Analytics 4 24-hour session identifier for grouping interactions within a session

Third-party domains contacted (6)

  • www.google-analytics.com
  • google-analytics.com
  • analytics.google.com
  • analytics.google.com
  • www.googletagmanager.com
  • www.googletagmanager.com
Questions

Frequently asked questions about Google Analytics 4

Can't find your question? Write to us, we answer fast.

Does Google Analytics 4 require GDPR consent?

Yes. GA4 processes personal data (IP addresses, cookies, device identifiers) and transfers it to Google servers. Under GDPR, you must obtain explicit user consent before loading the GA4 tracking script.

Is Google Analytics 4 GDPR compliant?

Standard GA4 has been ruled non-compliant by multiple EU DPAs due to unlawful US data transfers. Compliant use requires consent, Consent Mode v2, the EU Data Processing addendum with Google, and careful configuration to minimise data transfers. Consider EU-based analytics alternatives for simpler compliance.

What EU DPAs have ruled GA4 non-compliant?

Austria (DSB, January 2022 decision), France (CNIL, June 2022), Italy (Garante, June 2022), Belgium (APD, June 2022), Denmark (Datatilsynet, September 2022), Greece (HDPA, October 2022), Norway (Datatilsynet, November 2022), and the Netherlands (AP, 2023) have all issued guidance or decisions ruling standard GA4 transfers to the US unlawful under GDPR.

What cookies does Google Analytics 4 set?

GA4 sets _ga (unique client ID, 2 years), _ga_XXXXXX (session ID, 2 years), and _gid (session, 24 hours). These require consent under the ePrivacy Directive. GA4 must not load until analytics consent is obtained.

What is the EU Data Processing addendum for GA4?

Google's Measurement Controller-Controller Data Protection Terms and the EU Data Processing addendum govern the data controller relationship for GA4. Sign these via your Google Analytics Admin settings. They are required before using GA4 for EU users but do not resolve the transfer compliance issue on their own.

Does disabling Google Signals make GA4 GDPR compliant?

Disabling Google Signals prevents linking GA4 data to Google account profiles. It reduces risk but does not fully resolve the US transfer issue that EU DPAs have identified. A comprehensive compliant deployment requires: consent, Consent Mode v2, IP anonymisation, minimal retention, Signals disabled, and the DPA signed.

What are GDPR-compliant alternatives to GA4?

Plausible Analytics (Estonia, cookieless, no consent required, EU-hosted), Matomo (self-hostable or EU cloud), Fathom Analytics, Piano Analytics (France), and Piwik PRO (EU-hosted) are established GDPR-compliant alternatives.

Does Consent Mode v2 make GA4 GDPR compliant?

Consent Mode v2 helps by reducing data collection when consent is declined. However, it does not fully resolve the underlying US transfer issue that EU DPAs identified: GA4 still sends some data to Google even in consent-declined mode. It is a necessary but not sufficient condition for full GDPR compliance.

How do I set data retention in GA4?

In GA4 Admin, go to Data Settings, Data Retention, and set Event data retention to 2 months (the minimum). This reduces the volume of individual-level data stored in GA4. The default is 14 months. Reducing it demonstrates data minimisation.

What cookies does Google Analytics 4 set?

GA4 sets _ga (2 years) and _ga_<container-id> (2 years) cookies to distinguish unique users and maintain session state.

Can I use Google Analytics 4 without cookies?

GA4 supports consent mode which allows basic measurement without cookies. However, some data collection still occurs, and legal guidance on whether consent is still required varies by jurisdiction.

Same category

More services: Analytics

See the whole category

Friendly Analytics

Friendly Analytics is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Friendly Analytics supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Friendly Analytics enables informed decisions that improve experience and drive results.

Analytics

Pinpoll

Pinpoll is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Pinpoll supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Pinpoll enables informed decisions that improve experience and drive results.

Analytics

Pyze

Pyze is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Pyze offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Pyze empowers organizations to optimize strategy and maximize return on investment.

Analytics

Ackee

Ackee is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Ackee offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Ackee empowers organizations to optimize strategy and maximize return on investment.

Analytics

Cronitor

Cronitor is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Cronitor supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Cronitor enables informed decisions that improve experience and drive results.

Analytics

Sweet Analytics

Sweet Analytics is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Sweet Analytics supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Sweet Analytics enables informed decisions that improve experience and drive results.

Analytics

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site