Google Analytics and GDPR: how to stay compliant in Europe
Google Analytics 4 can be used in the EU, and using it lawfully depends on consent and configuration. This guide gives the legal timeline with sources, from the 2022 regulator decisions to the EU-US Data Privacy Framework and the 2025 General Court judgment, then the consent mode, retention and account settings to review. It is not legal advice.
Using Google Analytics 4 under the GDPR comes down to consent and configuration: collect analytics data only after the visitor agrees, pass that choice to the Google tag through consent mode, limit data retention, and have a data processing agreement in place. The question that made headlines in 2022, whether Google Analytics may be used in the EU at all, has since been answered by a new transfer framework.
This guide gives the timeline with its sources, then the settings to review. It describes what the regulators, the courts and Google have published. It is not legal advice, and your own data protection officer or regulator has the last word for your organisation.
Is Google Analytics legal in the EU
Is Google Analytics legal in the EU
Short answer: its use is not prohibited as such. The dispute was about one thing, the transfer of personal data to the United States, and that now has a legal basis.
| Date | What happened | Source |
|---|---|---|
| July 2020 | The EU Court of Justice invalidated the Privacy Shield, the framework for EU-US data transfers at the time (“Schrems II”) | EU General Court press release 106/25, background section |
| January 2022 | The Austrian data protection authority decided that a website’s use of Google Analytics violated the GDPR’s transfer rules. Other authorities issued similar decisions that year | noyb, the complainant |
| 10 July 2023 | The European Commission adopted an adequacy decision for the EU-US Data Privacy Framework. Transfers to US organisations certified under it need no further safeguards | CNIL, 10 July 2023 |
| 5 November 2024 | The European Data Protection Board adopted its first review report. It noted progress and asked for the next review within three years or less | EDPB |
| 3 September 2025 | The EU General Court dismissed an action to annul the adequacy decision (Latombe v Commission, T-553/23). An appeal to the Court of Justice on points of law is possible | Press release 106/25 |
What follows from the table:
- The 2022 decisions were made when no transfer framework was in force. They are the origin of the claim that Google Analytics is “banned in Europe”, and they predate the 2023 decision.
- The framework covers certified organisations. The US Department of Commerce publishes the list of participants. Check Google’s entry there instead of relying on an article, this one included.
- The framework has been challenged and has held so far. Two earlier frameworks were struck down, so a prudent organisation knows what it would do if this one were too.
What the transfer question does not settle
What the transfer question does not settle
A valid transfer basis is one requirement among several. The GDPR still requires a lawful basis for processing, transparency, data minimisation and respect for the rights of the people concerned. Separately, national rules on cookies in most EU countries require consent before analytics cookies are set, with narrow exemptions that differ by country.
In practice that means three things for a Google Analytics setup:
- A consent banner that actually controls the tag.
- Settings that limit what is collected and how long it is kept.
- Paperwork: the data processing terms, a privacy notice that names the tool, and a record of your choices.
OWOX Data Marts
See your first report built in real time. 15 minutes.
- Connect your data warehouse
- Pick your metrics
- Get a live Google Sheets report
In the time it takes to write a ticket. Then imagine never writing that ticket again.
Book a DemoWe'll use your actual use case
What Google documents about GA4 and EU data
What Google documents about GA4 and EU data
Google’s own statement for EU, Swiss and UK traffic (EU-focused data and privacy, checked October 2026):
- GA4 does not log or store IP addresses. The address is used to derive coarse location, such as city and country, and is then discarded.
- Data from EU devices is collected through domains and servers in the EU before it is forwarded to Analytics servers for processing.
- Regional controls exist. You can turn off Google signals per region, and turn off the collection of granular location and device data per region.
This is why the “anonymize IP” setting from Universal Analytics has no equivalent in GA4: there is nothing to switch on. It is also Google describing its own product. A regulator may weigh it differently, which is one reason to keep your own documentation.
Consent: what the tag does with the visitor’s choice
Consent: what the tag does with the visitor’s choice
Consent mode is how the visitor’s choice reaches Google’s tags. You collect the choice with a banner or a consent management platform, and the tag changes its behaviour. Google describes the result: when visitors deny consent, tags do not store cookies. The details, including the difference between basic and advanced consent mode and what is still sent without consent, are in the guide to GA4 consent mode.
Two points belong here:
- Consent mode does not obtain consent. Google’s wording is that you are responsible for obtaining users’ consent. Consent mode communicates it.
- Google requires consent signals for EEA users. Under its EU user consent policy, Google states that from early March 2024, users in the European Economic Area are only included in audiences used by linked advertising products if the property sends consent signals (Verify and update consent settings). The two newer consent types,
ad_user_dataandad_personalization, exist for this.
Settings to review in GA4
| Setting | Where | What to know |
|---|---|---|
| Data retention | Admin, Data collection and modification, Data retention | Event-level data is kept for 2 months by default and 14 months at most on a standard property. Choose the shorter period unless you use explorations over longer ranges |
| Google signals | Admin, Data collection | Can be disabled per region. Disabling it limits demographics and interests data |
| Granular location and device data | Admin, Data collection | Can be disabled per region. Google notes that this reduces modeled conversions for that region |
| Data sharing settings | Admin, Account details | Decide which sharing with Google products and services you allow |
| Data processing terms | Admin, Account details | Review and accept Google’s data processing terms. The Editor role at account level is needed (Data Processing Terms) |
| User-ID | Your implementation | Never send an email address, a name or another direct identifier as a user ID or in any parameter |
| Data deletion requests | Admin, Data collection and modification (Editor role) | Deletes selected parameters across events for a date range, for example personal data sent by mistake. Google states processing takes 7 to 63 days. It is not a tool for erasing one person’s data (Google Analytics Help) |
Write down what you chose and why. If a regulator or a customer asks, the record is what you will be asked for.
Client-side or server-side collection
Client-side or server-side collection
There are two ways to collect data for Google Analytics, and they differ in how much control you keep.
Client-side
The Google tag runs in the visitor’s browser and sends events straight to Google. This is the standard setup. The consent banner and consent mode are what stand between the visitor and the collection.
Server-side
The browser sends events to a server container you run, and that container decides what is forwarded to Google and what is not. It gives you a place to remove parameters, apply consent, or send nothing to Google at all. It is more work to run, and it does not replace consent: the visitor’s choice still has to be respected on the server.
A setup that writes events to your own BigQuery table without sending them to Google Analytics is described in solving the GDPR problem with a GTM server-side tag.
The Digital Markets Act and your website
The Digital Markets Act and your website
The Digital Markets Act regulates designated “gatekeepers”, large platforms such as Alphabet. It does not place obligations on an ordinary website that uses Google Analytics.
Its effect reaches website owners indirectly. Google has to be able to show it has consent before it uses personal data across its services, so it asks the sites that send it data for that consent. That is the EU user consent policy and the consent signals described above. If your consent setup is correct for the GDPR and you send the consent signals, there is no separate “DMA setup” to do.
What to do, in order
- Confirm with your data protection officer that Google Analytics fits your organisation’s position on EU-US transfers.
- Put a consent banner in place that blocks or limits the tag until the visitor chooses, and implement consent mode.
- Review the settings in the table above and record your choices.
- Accept the data processing terms and update your privacy notice.
- Decide what you would do if the transfer framework changed: server-side collection and analytics tools hosted in the EU are the two usual fallbacks.
Turn your data into decisions.
Governed data marts give you the clean foundation ML needs to actually work.
- No AI hallucinations
- Analyst-governed definitions
- Every number traces to SQL
Frequently Asked Questions
Is Google Analytics banned in the EU?
No. In 2022 several data protection authorities decided that specific uses of Google Analytics violated the GDPR's rules on transfers to the United States. In July 2023 the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework, and in September 2025 the EU General Court dismissed an action against it. Consent and the rest of the GDPR still apply.
Does Google Analytics 4 store IP addresses of EU visitors?
Google states that GA4 does not log or store IP addresses from EU, Swiss or UK users. The address is used to derive coarse location and is then discarded, and data from EU devices is collected through servers in the EU before processing.
What steps make a Google Analytics 4 setup fit the GDPR?
Obtain consent before analytics cookies are set, pass the choice to the Google tag with consent mode, set data retention to the shortest period you need, review Google signals and data sharing settings, accept Google's data processing terms, and describe the tool in your privacy notice. Confirm the result with your data protection officer.
