Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Enhanced eCommerce is a Google Analytics feature that captures granular shopping events such as product views, add to cart actions, checkout steps and purchases, giving rich revenue insight but also processing detailed behavioural data that requires consent under the GDPR.
Enhanced eCommerce is an extension of Google Analytics that records the full shopping journey. Instead of only counting page views, it captures product impressions, product clicks, add to cart and remove from cart actions, checkout steps, promotions and completed purchases with revenue and item detail. Online retailers use it to analyse funnels, product performance and basket value across Universal Analytics and the GA4 ecommerce model.
The feature relies on the standard Google Analytics cookies, including _ga and the GA4 _ga_ container cookie that persist a pseudonymous client identifier, plus _gid and the _gat throttling cookie. Around these it attaches structured ecommerce parameters such as product identifiers, categories, quantities, prices and order values. Combined, this builds a detailed, persistent profile of how an individual browses and buys.
The client identifier is personal data, so analytics processing falls under the GDPR, and writing the cookies falls under Article 5(3) of the ePrivacy Directive. European authorities have repeatedly found that default Google Analytics deployments raise compliance issues, particularly around transfers and the use of data for Google services. Enhanced eCommerce increases the volume and sensitivity of the behavioural data involved.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Analytics cookies are not strictly necessary, so you must obtain prior consent before Enhanced eCommerce loads and collects data. Use a consent management platform to block the tags until the visitor accepts, and apply Google Consent Mode so that measurement only runs with consent. Pre ticked boxes and implied consent are not valid in the European Union.
Data is processed by Google in the United States, relying on the EU US Data Privacy Framework and standard contractual clauses. Reduce exposure by enabling IP truncation, disabling data sharing with Google products and advertising signals where not needed, shortening retention, and accepting the Google data processing terms. Document the transfer and these safeguards in your records of processing.
Gate all Enhanced eCommerce tags behind marketing or analytics consent, configure Consent Mode, avoid sending direct identifiers such as email in event parameters, and turn off advertising features unless separately consented. Describe the analytics cookies, the shopping data and the US transfer in your cookie policy, and review the data layer regularly so no personal data leaks into ecommerce events.
Websites using Google Analytics Enhanced eCommerce must obtain user consent under GDPR regulations.
DPIA considerations
Assess the volume and granularity of shopping behaviour collected, the linkage of purchases to a persistent client identifier, the use of data for Google advertising signals, and the lawfulness of US transfers. A DPIA is advisable where ecommerce tracking is combined with advertising features or large transaction volumes.
Sample consent text
We use Google Analytics with Enhanced eCommerce to understand how visitors shop and to improve our store. This sets analytics cookies and may transfer data to Google in the United States. We only do this with your consent.
Third-party domains contacted
www.googletagmanager.comwww.google-analytics.comanalytics.google.comstats.g.doubleclick.netCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _ga | Analytics | 2 years | Stores a pseudonymous client identifier used to distinguish users and tie ecommerce events to a session and visitor. |
| _ga_<container-id> | Analytics | 2 years | GA4 cookie that persists session state and campaign information for the specific measurement property. |
| _gid | Analytics | 24 hours | Distinguishes users within a single day to support daily reporting of shopping behaviour. |
| _gat | Analytics | 1 minute | Throttles the request rate to the Analytics servers during high traffic. |
Google Analytics Enhanced eCommerce collects user analytics data — you legally need a consent banner. Try FlowConsent free.
It uses the standard Google Analytics cookies: _ga and the GA4 _ga_ container cookie that persist a pseudonymous client identifier for up to two years, _gid for daily distinction and _gat for request throttling. Ecommerce data is attached to events rather than to extra cookies.
Yes. Analytics cookies are not strictly necessary, so prior consent is required under the ePrivacy Directive before Enhanced eCommerce loads. The tags must stay blocked until the visitor accepts and Consent Mode should reflect their choice.
Consent under Article 6(1)(a) GDPR. Because the data feeds Google services and can support advertising, legitimate interest is not a safe basis for analytics tracking in the European Union.
Yes. Google processes the data in the United States and other regions under the EU US Data Privacy Framework and standard contractual clauses. Enable IP truncation and disable unnecessary data sharing to reduce exposure.
A DPIA is advisable, especially for high traffic stores or when ecommerce data is combined with Google advertising features. It should assess profiling, retention and the US transfer.
Block the tags behind a consent banner, configure Google Consent Mode, accept the Google data processing terms, shorten retention, and ensure no direct identifiers such as email are pushed into ecommerce events.
Privacy first analytics such as Matomo, Plausible or Piano Analytics offer ecommerce reporting with EU hosting and lighter cookie use. They can reduce transfer risk but analytics consent is still generally required.
List the _ga, _ga_ container, _gid and _gat cookies with purpose and duration, explain that detailed shopping events are collected, and disclose the transfer to Google in the United States. Align the entry with your banner categories.