Google Forms

What Google Forms is and how it works

Google Forms is part of the Google Workspace suite and lets anyone create surveys, quizzes, registration forms and feedback questionnaires through a simple drag and drop interface. Forms are hosted on docs.google.com and can be distributed via a shareable link, an email invitation or, most commonly on websites, embedded inside an iframe. Each response is stored in a linked Google Sheets file or directly in the Forms response panel.

What data and cookies Google Forms collects

When a Google Form loads on your site (whether through an iframe embed or a direct visit), Google sets several cookies on the docs.google.com and google.com domains, including NID, CONSENT, SOCS, AEC and 1P_JAR. Beyond cookie data, Google collects the respondent IP address, user agent, referrer, screen resolution and, if the respondent is signed in, the Google account identifier. All form responses themselves are stored on Google servers.

GDPR and ePrivacy implications

Because cookies are written to the user device on page load, Article 5(3) of the ePrivacy Directive (transposed in national cookie laws across the EU) requires prior, informed and freely given consent before Google Forms can be loaded in an embedded context. Google acts as a data processor for form responses under the Google Workspace Data Processing Addendum, but as an independent controller for some telemetry, which means publishers remain accountable for transparency and for offering a refusal that is as easy as acceptance.

Consent requirements before loading

In practice, an embedded Google Form must be blocked behind a consent management platform until the visitor has actively opted in to the relevant category (typically Functional or Marketing depending on how you classify it). A two click solution, where a placeholder explains what loading the form entails and lets the user explicitly accept, is the most common pattern and aligns with guidance from the CNIL, the BfDI and other EU regulators.

Data transfers to the United States

Google Forms data is processed on Google LLC infrastructure primarily in the United States. Transfers rely on Standard Contractual Clauses under Article 46(2)(c) GDPR, and on the EU, US Data Privacy Framework where Google LLC is certified. Controllers should run a Transfer Impact Assessment, consider supplementary measures (such as pseudonymising form fields) and document the legal basis for the transfer in their record of processing activities.

Practical compliance steps

Concretely, list Google Forms in your cookie policy and record of processing activities, block the iframe until consent is captured, present a two click placeholder, keep the Google Workspace DPA on file, run a Transfer Impact Assessment, and avoid collecting sensitive categories of data through Google Forms unless you have a strong Art. 9 lawful condition. For high risk use cases (health surveys, employee feedback, minors) consider hosting forms on a EU based alternative.