Is Google Analytics GDPR compliant?

The transfer is covered.
The consent is still yours.

Yes, Google Analytics can be used in line with the GDPR as of 14 October 2026, but not out of the box. What regulators objected to in 2022, sending EU visitors’ data to Google in the US, has been covered since 10 July 2023 by the EU–US Data Privacy Framework. Google LLC is certified under it, and the EU’s General Court upheld it on 3 September 2025, though an appeal is pending and the EDPB has asked the Commission to look again. What never changed: GA4 sets cookies, so visitors in the EU must say yes before it runs, and its settings and your privacy policy are yours to get right. Below: every ruling in order, the three questions “GDPR compliant” really means, and a helper that checks your own GA4 setup.

Check my GA4 setup See the timeline

By the Builderify team Not legal advice

Illustration · Three layers of “is GA legal”, 2020 to today. Only one ever moved.
01 / Timeline

Google Analytics and the GDPR,
from Schrems II to today.

Six years, from the ruling that sank Privacy Shield to the appeal that could reopen its successor. Each entry links to the decision itself. Filter by who decided, or follow the colours: red went against sending GA data to the US, green cleared it, black set rules for everyone.

  • Against GA transfers
  • Clears the transfer
  • A risk to the framework
  • Cookie rules
  1. 2020

    Privacy Shield falls

    1. CJEU Courts

      Schrems II: Privacy Shield struck down

      In case C-311/18 the EU’s Court of Justice invalidated Privacy Shield, the framework US companies, Google included, used to receive data from Europe. Standard contractual clauses survived, but only where they protect the data in practice, and regulators must stop transfers where they can’t.

      For GA: Every Google Analytics property in Europe now rested on contract clauses that US surveillance law could undercut.

      CJEU press release 91/20 ↗
    2. noyb Google and others

      101 complaints, aimed at websites

      The privacy group noyb filed 101 complaints against websites in 30 EU and EEA countries that kept sending visitor data to Google Analytics or Facebook Connect after the ruling. The EDPB set up a task force so the regulators would answer them consistently.

      For GA: The complaints named the sites, not Google. The website owner is the one sending the data, so the website owner answers for it.

      noyb ↗
  2. 2022

    Regulators rule on GA

    1. Austria · DSB Regulators

      The first decision: a GA website broke Article 44

      In a decision dated 22 December 2021 and published on 13 January 2022, Austria’s data protection authority found that a health website’s use of Google Analytics sent personal data to the US unlawfully. The cookie’s unique identifiers and the IP address counted as personal data, and Google’s extra safeguards weren’t enough. The complaint against Google itself was rejected: the transfer rules bind whoever sends the data.

      For GA: No fine, but the reasoning the other regulators followed. Austria’s Federal Administrative Court upheld the finding on 12 May 2023.

      noyb: the decision ↗
    2. France · CNIL Regulators

      France gives a site one month

      The CNIL ordered a website operator to bring its Google Analytics use into line within one month, by stopping it if necessary, finding Google’s additional measures unable to rule out access by US intelligence services.

      For GA: The CNIL has since taken the notice down; law firms’ summaries of it remain.

      Hunton Andrews Kurth ↗
    3. France · CNIL Regulators

      The proxy answer

      In a follow-up Q&A, the CNIL said only a proxy server that stops the visitor’s browser contacting Google directly “could be considered as a sufficient supplementary measure”, and only under strict conditions: no IP address passed on, no cross-site identifiers, URLs and referrers cleaned.

      For GA: Keeping GA meant re-engineering it. Few small sites could.

      DLA Piper ↗
    4. Italy · Garante Regulators

      Italy: 90 days to comply

      In a decision of 9 June, announced on 23 June, Italy’s Garante gave a publisher 90 days to bring its Google Analytics transfers into line with Chapter V of the GDPR, or have them suspended. It added that an IP address is personal data and isn’t anonymised even when truncated.

      For GA: IP truncation, the old Universal Analytics answer, was ruled out as a fix.

      Garante: the decision ↗
    5. Denmark · Datatilsynet Regulators

      Denmark: not lawful as it is

      Not a case but a statement: Denmark’s authority said Google Analytics can’t be used lawfully without supplementary measures, such as pseudonymisation through a proxy, and that organisations without them should stop.

      For GA: A general statement, aimed at every Danish site at once.

      Hunton Andrews Kurth ↗
  3. 2023

    Fines, then a new framework

    1. Finland · Ombudsman Regulators

      Finland reprimands a library network

      Finland’s deputy data protection ombudsman reprimanded the Helsinki region’s Helmet library network for sending search information to the US through Google Analytics and Tag Manager without sufficient safeguards. A reprimand, not a fine.

      For GA: Public bodies were held to the same reasoning as businesses.

      Finnish ombudsman ↗
    2. Sweden · IMY Regulators

      Sweden: the first fines

      Sweden’s IMY fined Tele2 SEK 12 million and CDON SEK 300,000 over Google Analytics transfers, and ordered CDON, Coop and Dagens Industri to stop using it. Swedish courts upheld Tele2’s fine on 17 October 2024 and again on 15 October 2025.

      For GA: Announced a week before the new framework. It still applied to the transfers already made.

      IMY ↗
    3. European Commission Law and policy

      The EU–US Data Privacy Framework

      Implementing Decision (EU) 2023/1795 found that the US ensures an adequate level of protection for personal data sent to companies certified under the new framework, after a 2022 US executive order set new limits on intelligence access and a new route to redress through a Data Protection Review Court.

      For GA: Transfers to certified companies no longer need contract clauses and extra measures. The 2022 decisions were about the years before.

      European Commission ↗
    4. Google Google and others

      Google relies on the framework

      Google says that since 1 September 2023 it relies on the EU–US Data Privacy Framework to transfer personal data from the EEA to the US, with standard contractual clauses as the fallback, and since 16 September 2024 on the Swiss–US framework and the UK Extension “in certain circumstances”. The official register lists all three of Google LLC’s certifications as active, next due on 13 September 2027.

      For GA: The framework covers GA only because Google is certified. Check the register if you ever doubt it.

      Google: data transfers ↗
    5. France · CNIL Regulators

      France: transfers can flow freely

      The CNIL’s updated guidance on audience measurement says that, since the adequacy decision, transfers to certified US entities “peuvent se faire librement”, can be made freely. Proxying remains an option for tools whose recipients aren’t certified.

      For GA: The regulator that set the 2022 bar says the bar is met for certified companies.

      CNIL ↗
  4. 2024

    The framework settles in

    1. Swiss Federal Council Law and policy

      Switzerland follows

      Switzerland added the US to its list of countries with adequate protection, for companies certified under the Swiss–US Data Privacy Framework, in force from 15 September 2024.

      For GA: Swiss visitors’ data can go to Google LLC on the same basis.

      Federal Council ↗
    2. EDPB Regulators

      Cookie rules cover more than cookies

      The EDPB adopted the final version of its Guidelines 2/2023 on the technical scope of Article 5(3) of the ePrivacy Directive: tracking pixels, tracking links, local storage and some IP-based tracking can all need consent, not only cookies.

      For GA: GA4’s cookies needed consent before and after. This is why “cookieless” doesn’t automatically mean “no banner”.

      EDPB ↗
    3. European Commission Law and policy

      The first review

      The Commission’s first review found that the US had put the framework’s structures and procedures in place, said it was too early to judge them in practice, and set the next review for three years later.

      For GA: No change for GA users.

      A&O Shearman ↗
  5. 2025

    Questioned, then upheld

    1. US government Google and others

      The oversight board loses its quorum

      The President removed the three Democratic members of the Privacy and Civil Liberties Oversight Board, one of the US oversight bodies the framework was built around, leaving it without a quorum.

      For GA: Critics said one of the framework’s safeguards had gone. The framework itself stayed in force.

      The Hill ↗
    2. EU General Court Courts

      Latombe v Commission: the framework upheld

      In case T-553/23 the General Court dismissed French MP Philippe Latombe’s action against the framework, finding the US ensured adequate protection when the decision was adopted. It added that the Commission must keep monitoring US law and can suspend or change the decision if that law changes.

      For GA: The first court test of the framework went its way.

      CJEU press release 106/25 ↗
    3. Court of Justice Courts

      The appeal: C-703/25 P

      Latombe appealed to the Court of Justice, asking it to set aside the judgment and annul the framework. The court has admitted Microsoft to intervene on the Commission’s side, which Microsoft announced on 28 June 2026. As of 14 October 2026 we found no hearing date, Advocate General’s opinion or judgment.

      For GA: Pending. The framework applies unless and until the Court of Justice, or the Commission, decides otherwise.

      Official Journal: the appeal ↗
    4. Netherlands · AP Regulators

      The Dutch regulator: no blanket ban

      In a briefing for the Dutch government, the Autoriteit Persoonsgegevens said a total ban on Google Analytics is not obvious at present, and that its 2022 findings can’t be carried over one to one to today’s use, because of the framework. Its 2022 investigation had ended in a reprimand.

      For GA: One more regulator reading the framework as having changed the answer.

      Autoriteit Persoonsgegevens ↗
  6. 2026

    Under review again

    1. UK Parliament Law and policy

      The UK's statistics exception starts

      The cookie changes in the Data (Use and Access) Act 2025 came into force: storage for statistical purposes can run without consent if improving the service is its sole purpose, visitors get clear information and a simple, free way to object, and the data is shared only with someone helping make those improvements.

      For GA: Analytics-only GA4 may fit for UK visitors. Google signals and Ads links don’t: the exception doesn’t cover advertising.

      legislation.gov.uk ↗
    2. US Supreme Court Courts

      Trump v. Slaughter

      The US Supreme Court overruled Humphrey’s Executor and held that the President may remove FTC commissioners at will. The FTC enforces companies’ framework commitments, and noyb wrote to the Commission demanding the framework’s repeal.

      For GA: The independence the framework assumed is in question. Nothing has been suspended.

      noyb ↗
    3. EDPB Regulators

      The EDPB asks for a reassessment

      The European Data Protection Board wrote to the Commission asking it to “closely assess whether this development affects the functioning” of the adequacy decision.

      For GA: A request, not a ruling. The framework is in force on 14 October 2026; this is the entry to watch.

      EDPB letter ↗

Dates are those of the decision, or of its publication where the regulator only announced it later; each entry says which. Regulators also ruled on other tools and other websites. This list keeps to Google Analytics and the framework under it.

02 / Three layers

Is Google Analytics legal in the EU?
It’s three questions.

When a headline said “Google Analytics is illegal”, it meant one thing: sending EU visitors’ data to Google in the US, without enough protection from US surveillance. That is the layer the courts and the Commission settle, and in 2023 they settled it the other way.

The other two never depended on the US. GA4 stores a cookie, so it needs the visitor’s permission under the EU’s cookie rules. And what you collect has to meet the GDPR’s ordinary principles. Neither is Google’s job; both are yours.

  1. 01

    The transfer

    Chapter V GDPR

    Can your visitors' data go to Google in the US?

    Decided by the courts and the European Commission. Since 10 July 2023: yes, under the Data Privacy Framework, which Google LLC has joined.

    Your job Watch the appeal. Nothing to configure.

  2. 02

    The cookie

    Article 5(3) ePrivacy

    May GA4 store its cookies on the visitor's device?

    Decided by each visitor. In the EU, only after they say yes; the UK and Switzerland are a little softer.

    Your job A banner that holds GA4 back until a yes.

  3. 03

    The setup

    GDPR principles

    Is what you collect fair, disclosed and no more than you need?

    Decided by you, in GA4's settings and your privacy policy.

    Your job Google signals, retention, user-ID, data sharing.

Layer 01 is what the 2022 decisions were about. Layer 02 is enforced separately, under each country’s cookie law, and layer 03 is the ordinary GDPR that applies to any tool you run.

03 / Can I use GA4?

Is your Google Analytics
GDPR compliant? Check it.

Tell it where you and your visitors are and how GA4 is set up. It answers layer by layer, lists the settings to change, and links the alternatives. It runs in your browser and sends nothing anywhere. It’s a checklist, not a legal opinion.

Where is your business?
Where are your visitors?
Your cookie banner
Google Ads
A sensitive audience?
Data retention
Can I use GA4? 14 Oct 2026

Not as set up

Not yet: 2 things to change, starting with the ones marked Fix. The transfer is no longer the problem; the setup is.

01 The transfer
Covered

Google LLC is certified under the EU–US Data Privacy Framework, so sending visitors' data to Google in the US no longer needs the extra safeguards regulators asked for in 2022. The EU's General Court upheld the framework on 3 September 2025; an appeal, C-703/25 P, is pending at the Court of Justice, and in July 2026 the EDPB asked the Commission to reassess the framework after a US Supreme Court ruling.

02 The cookie
Fix first
  • EU / EEA GA4 sets its _ga cookie before the visitor answers. A banner that informs but doesn't wait isn't consent: make the tag wait for a yes.
  • US Most US state laws don't ask for consent before analytics cookies. Disclose GA4 in your privacy policy, as Google's own terms require.
03 The setup
Changes

1 to change, 5 to tidy up, in GA4 and your privacy policy. The list is below.

Settings to change Where
  1. Check Turn off Google signals for EuropeGoogle signals links visits to signed-in Google accounts with ad personalisation on, for cross-device and demographic reports. That is advertising data: switch it off for the EEA, the UK and Switzerland unless your banner asks for marketing consent too. Admin › Data collection and modification › Data collection
  2. Note Drop granular location and device dataGA4 collects city, device model, screen resolution and browser and OS minor versions by default. You can switch that off per region if you don't use it; Google warns that modelled key events drop in that region. Admin › Data collection and modification › Data collection
  3. Note Send Consent Mode v2 to Google AdsLinked conversions go to Google's ad systems. In the EEA, Google expects ad_storage and ad_user_data from your banner; name Google Ads in your privacy policy. Admin › Product links › Google Ads links
  4. Note Consider 2 months of retentionA standard property keeps user-level and event data for 2 or 14 months. If you only read the standard reports, which the setting doesn't affect, 2 months loses nothing you look at, and the GDPR asks you to keep data no longer than you need it. Admin › Data settings › Data retention
  5. Note Review data sharing settingsFour account-level switches decide whether Google may use your data to improve its own products, for benchmarks, for support and for recommendations. Switch off what you don't need. Admin › Account details
  6. Note Name GA4 in your privacy policyGoogle's Analytics terms require you to disclose that you use Google Analytics and how it collects and processes data, and to give notice of its cookies. Your privacy policy
  7. Good IP addresses: nothing to switch onGoogle says GA4 doesn't log or store IP addresses from EU, UK or Swiss visitors. It collects their data through servers in those regions, uses the IP for a rough location there, then discards it. Built in
Or step around it

Tools that don’t send data to a US company take the transfer layer away, and a cookieless one makes the consent question smaller. Compare them in the guide to simpler GA4 alternatives, or read on the Plausible and Simple Analytics pages. Builderify’s own option is further down, with its catch.

04 / GA4 settings

The GA4 privacy settings
that change the answer.

Google built GA4 with European regulators in mind, and some of it is automatic. The rest is a switch you have to find. Each row below is in Google’s own words, with where to find it.

GA4 settings that affect GDPR compliance: what Google says, where to find each one, and what to choose for visitors in Europe
Setting What Google says Where For European visitors
IP addresses “Google Analytics does not log or store individual IP addresses from EU, Switzerland, or UK users.” Their IP is used for a rough location, then discarded. Built in Nothing to switch on. The old “anonymise IP” code was for Universal Analytics.
EU data collection “Google Analytics collects all data from EU, Switzerland, or UK-based devices” through servers in those regions, before it goes on to be processed. Built in Nothing to do, unless your Content Security Policy needs *.google-analytics.com and *.analytics.google.com. Processing can still happen in the US, which is why the transfer layer matters.
Google signals For users who turned on ad personalisation and signed in to Google, “reporting data is enriched” with demographics and a view across their devices. It can be switched per region. Admin › Data collection and modification › Data collection Off for the EEA, the UK and Switzerland, unless your banner asks for marketing consent and you need those reports.
Granular location and device data City, device model, screen resolution, browser and OS minor versions. “Analytics collects this data by default”, and you can turn it off per region. Admin › Data collection and modification › Data collection Off for Europe if you don’t read city or device-model reports. Google warns that modelled key events fall in that region.
Data retention User-level and event data are kept 2 or 14 months on a standard property, 26 to 50 on Analytics 360. The setting limits explorations and funnel reports; standard reports aren’t affected. Admin › Data settings › Data retention 2 months, unless you run explorations further back. Write down why if you pick longer.
Data sharing With “Google products & services” on, Google says it is “an independent controller” of that data. Off, it works only as your processor, under the Google Ads Data Processing Terms. Admin › Account details Off, along with any other sharing you don’t need. It also matters for the UK’s statistics exception, which wants the provider to be your processor.
User-ID and personal details You must not pass information, “hashed or otherwise”, that Google “could use or recognize as personally identifiable information”. Your tag, events and page URLs An internal, random ID at most. Watch for emails in URLs, such as a thank-you page with ?email=.
Consent Mode “Consent mode doesn’t provide a consent banner or widget.” It passes your banner’s answer to Google’s tags. Your banner, first in <head> Basic mode for the EU: no Google tag until a yes. The Consent Mode v2 guide builds the code.

From Google’s Analytics Help and Analytics terms, linked in the sources. GA4’s menus move around; if a path has changed, search Admin for the setting’s name.

05 / Cookie consent

Google Analytics and cookie consent:
the part that never changed.

The Data Privacy Framework decides where data may go. It says nothing about whether GA4 may set its cookie in the first place: that falls under separate cookie rules, enforced country by country. GA4 sets first-party cookies such as _ga to tell visitors apart, so in the EU it waits for a yes.

EU and EEA

Article 5(3) of the ePrivacy Directive: storing or reading information on a visitor’s device needs consent, unless it is strictly necessary for a service they asked for. Each country writes it into its own law, and the EDPB reads it as covering more than cookies.

For GA4 → Ask first. Hold GA4 back until the visitor accepts analytics, with refusing as easy as accepting.

ePrivacy Directive ↗
United Kingdom

PECR asks for consent too. Since 5 February 2026, the Data (Use and Access) Act 2025 lets storage for statistics run without it, if improving your service is its sole purpose, you explain it clearly, give a simple, free way to object, and the provider uses it only for you. It “does not apply to purposes related to online advertising”.

For GA4 → Analytics-only GA4 with data sharing off may fit; Google signals and Ads links don’t. If in doubt, ask first.

ICO: the exceptions ↗
Switzerland

The Telecommunications Act asks you to tell visitors about cookies and let them refuse, rather than ask first. The FDPIC’s cookie guidelines, updated on 6 October 2025, add that unexpected or high-risk processing, such as profiling for advertising, can need consent.

For GA4 → Analytics only: a clear notice and an opt-out that works. With Google signals or remarketing, ask first. Google’s own EU user consent policy covers Switzerland too.

FDPIC: cookie guidelines ↗
United States

No federal rule asks for consent before analytics cookies. State privacy laws, California’s first among them, work on notice and opt-outs, including one from “sharing” data for targeted ads.

For GA4 → Describe GA4 in your privacy policy, as Google’s terms require. With remarketing, check whether a state law gives your visitors an opt-out.

California AG: CCPA ↗
Who to ask

This page is how the rules read to us. It isn’t legal advice.

  • Your adviserYour data protection officer if you have one, or a privacy lawyer where your business is based. Take them the checklist from section 03.
  • Your regulatorEach EU country’s data protection authority publishes cookie guidance; the EDPB lists them all.
  • UK and SwitzerlandThe ICO’s small-business pages and the FDPIC’s cookie guidelines are written for people without a legal team.
06 / Without Google

Rather not depend
on an appeal?

An analytics tool that keeps data away from US companies takes the transfer layer off the table, whatever the Court of Justice decides. One that sets no cookies also changes the consent question, though regulators read the cookie rules as covering more than cookies, so “cookieless” isn’t automatically “no banner”.

With Builderify

User Journey, behind the same banner

Builderify’s User Journey is visitor analytics on the same script tag as its popups, forms and chat, stored on Builderify’s own servers rather than Google’s. That takes Google out of the picture, not the consent question: Journey sets cookies too. Switch on “Wait for cookie consent” and it waits for the same yes as everything else. The user journey tracking guide shows what it records, and the pricing page what it costs; packs start at $9, one-time.

What it does

  • With “Wait for cookie consent” on, it records nothing until the visitor allows Analytics in Builderify’s cookie banner; withdrawing stops tracking and erases the visitor ID from their browser
  • Do Not Track is honoured by default
  • Journeys are kept 7, 14 or 30 days, your choice, and older ones are deleted every night
  • The same banner sends Google’s Consent Mode signals, if you keep GA4 alongside it
  • Each visitor page by page, with goals and signups on their timeline. 0.1 credits per new visitor, from the 250 free credits every account gets each month

Know this first

  • It isn’t cookieless: it sets first-party cookies, _bdf_jid for 400 days and _bdf_jvs_… for 30 minutes. In the EU it needs consent, just like GA4
  • “Wait for cookie consent” is off by default. Switch it on before European visitors arrive
  • It stores the visitor’s IP address, and looks up an approximate location with a third-party service, ip-api.com
  • Builderify’s privacy policy says data is stored on its own servers, “which may be located in Romania or other jurisdictions”. If you need a processing agreement or a list of sub-processors, ask support before you switch
  • Global Privacy Control switches off marketing in the banner, not analytics, so on its own it doesn’t stop Journey
  • It helps you ask properly; it isn’t legal advice or a compliance guarantee
Questions

Google Analytics and the GDPR, before you ask.

It can be, but not out of the box. Since 10 July 2023, sending EU visitors' data to Google in the US is covered by the EU–US Data Privacy Framework, which Google LLC is certified under and the EU General Court upheld on 3 September 2025; an appeal is pending. You still need consent before GA4 sets its cookies in the EU, sensible settings and a privacy policy that names it. This is not legal advice.

No law or court bans it. In 2022 regulators in Austria, France, Italy and Denmark, and later Finland and Sweden, found specific uses of Google Analytics unlawful because data went to the US without enough protection. Those decisions concern transfers before the Data Privacy Framework; France's CNIL now says transfers to certified US companies can be made freely.

For visitors in the EU, yes: GA4 sets first-party cookies such as _ga, so it should wait until the visitor accepts analytics. In the UK, a statistics exception in force since 5 February 2026 may cover analytics-only use under strict conditions, but never advertising features. Switzerland mostly asks for clear notice and a way to refuse, and most US states ask for disclosure rather than consent.

Transfers to Google in the US would fall back on standard contractual clauses and a case-by-case assessment, the position regulators judged insufficient in 2022. The framework stays in force until the Court of Justice or the Commission decides otherwise; the appeal (C-703/25 P) is pending and the EDPB asked the Commission to reassess it in July 2026. An analytics tool that keeps data away from US companies avoids the question.

Google says GA4 does not log or store IP addresses from EU, UK or Swiss users: it uses them on servers in those regions to derive a rough location, then discards them. The old IP anonymisation setting is no longer needed. GA4 still uses cookie identifiers, which count as personal data under the GDPR.

Sources

Read on 14 October 2026.

← All guides

Stop losing the visitors
you already paid for.

More leads from the traffic you already have, and follow-up that sends itself. Free to start. No card, no monthly fee.

Start free See what it does