Cookie Confirm
en

Google Analytics and the GDPR

Do you need consent for Google Analytics 4? What European regulators decided in 2022, what changed with the EU-US Data Privacy Framework, and how the UK's new analytics exception fits in.

Last checked on 13 October 2026

In short

  • In a standard setup, Google Analytics 4 needs consent in the EU before it sets cookies.
  • The 2022 decisions against Google Analytics were about transfers to the US; since July 2023 the Data Privacy Framework covers those.
  • The EU General Court upheld the Data Privacy Framework in September 2025; an appeal is pending.
  • The UK now allows analytics without consent under strict conditions; whether GA4 meets them depends on your setup.

Does Google Analytics need consent?

Two different sets of rules apply to Google Analytics 4, and it helps to keep them apart:

  1. The cookie rule (article 5(3) of the ePrivacy Directive, and PECR in the UK): GA4 stores cookies such as _ga in the visitor's browser. That needs consent, unless an exception applies.
  2. The GDPR: GA4 processes personal data, such as cookie IDs and device information. That needs a legal basis, transparency and, when data leaves Europe, a valid transfer mechanism.

The ePrivacy Directive has no general exception for analytics. Some EU countries allow audience measurement without consent under strict conditions, for example the French CNIL: only for the site's own audience measurement, anonymous statistics only, no cross-site tracking and no reuse of the data by the provider for its own purposes. The CNIL notes that some providers do reuse data and that the publisher has to check the configuration. A standard GA4 setup does not meet these conditions, so in the EU you should ask for consent first. National rules differ, so check those of your country.

What regulators decided in 2022

After complaints filed by the privacy organization noyb, several European regulators looked at Google Analytics, then still the older Universal Analytics. The Austrian authority, the French CNIL (February 2022) and the Italian Garante (June 2022) were among those that found that specific websites transferred personal data to Google in the US without adequate protection against access by US intelligence services. They ordered those websites to bring their use into line or stop.

The core problem was the transfer to the US, not analytics as such. The CJEU had struck down the earlier Privacy Shield in 2020 (Schrems II), and the regulators found that Google's supplementary measures were not enough.

What changed with the Data Privacy Framework

On 10 July 2023 the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework (DPF). US companies that certify under it may receive personal data from the EU without extra transfer tools. Google LLC is certified, also under the UK Extension and the Swiss-US framework, and Google says it relies on the DPF for its advertising and analytics products. The CNIL has noted that, because of the adequacy decision, these transfer breaches can no longer lead to new formal notices.

The framework has been challenged. On 3 September 2025 the EU General Court dismissed the action of French MP Philippe Latombe (case T-553/23) and confirmed that the US offered adequate protection when the DPF was adopted. Latombe appealed to the Court of Justice (case C-703/25 P). As of October 2026 that appeal is pending. If the DPF falls, the transfer question returns.

What GA4 does with data

According to Google's own documentation:

  • IP addresses: GA4 does not log or store IP addresses. For users in the EU, the UK and Switzerland, the IP address is used on EU servers to derive approximate location and then discarded.
  • Data processing terms: Google acts as a processor for Google Analytics under the Google Ads Data Processing Terms. Check in Admin, under Account settings, that they have been accepted.
  • Advertising features: if you switch on Google signals or advertising features, or link Analytics to Google Ads, the data is also used for advertising. Google states that you are then the sole controller for those features. This always needs consent.
  • Regional controls: you can disable Google signals and granular location and device data per region.

The UK: a new analytics exception

Since 5 February 2026, PECR in the UK has an exception for storage or access solely for statistical purposes: gathering information about how your service is used, with a view to improving it. The conditions: you give clear information, visitors have a simple and free way to object, and the data is only shared to help make those improvements. The ICO's guidance adds that the exception covers aggregate statistics only, not tracking individuals or anything related to advertising, and that a third-party analytics provider must act as your processor, using the data only to improve your service.

The ICO does not name any tool. For GA4 that means at least: no Google signals, no link with Google Ads, no data sharing with Google for its own purposes, and an easy way to object. If you can't meet all of that, ask for consent. More in UK cookie law.

Alternatives

Some website owners switch to tools that can be configured to collect fewer data or to host the data themselves, such as Matomo. The CNIL mentions open-source software such as Matomo, which you configure yourself, and has published a configuration guide for using it under its audience measurement exemption. Whether your configuration qualifies is up to you as the publisher to check.

In practice

  1. Block GA4 until consent in the EU, unless you are sure a national exemption applies and you meet every condition.
  2. Use Google Consent Mode v2, so GA4 respects the choice and can model data for visitors who decline. See Google Consent Mode v2 explained.
  3. Check the Data Processing Terms and your data sharing and Google signals settings.
  4. Mention Google Analytics in your cookie policy and privacy notice, including the US transfer and the DPF.

Cookie Confirm blocks Google Analytics until consent, sends all four Consent Mode signals and can apply different rules per country, so you can treat UK and EU visitors differently where the law allows it.

Sources

Frequently asked questions

Is Google Analytics illegal in the EU?

No. In 2022 several regulators found that specific websites used Google Analytics unlawfully because data went to the US without adequate protection. Since the EU-US Data Privacy Framework took effect on 10 July 2023, and Google LLC is certified under it, that transfer problem is covered. You still need consent for the cookies.

Can I use Google Analytics 4 without a cookie banner?

In the EU, normally not: GA4 sets cookies that need consent, and the national exemptions for audience measurement have conditions that a standard GA4 setup does not meet. In the UK, the statistical purposes exception may apply if Google only uses the data to improve your site, you share no data for advertising, you inform visitors and you let them object. The ICO does not say whether any specific tool qualifies.

Does GA4 store IP addresses?

According to Google, GA4 does not log or store IP addresses. For users in the EU, the UK and Switzerland, Google uses the IP address on EU servers only to derive approximate location and then discards it.

Do I still need Consent Mode if I use a cookie banner?

Consent Mode passes the visitor's choice to Google's tags. If you link Analytics to Google Ads, Google requires consent signals for EEA users. It also lets GA4 model data for visitors who decline.

What about the US transfer if the Data Privacy Framework is struck down?

Then transfers would need another basis again, such as standard contractual clauses with extra safeguards, as before 2023. The appeal against the General Court's ruling (case C-703/25 P) was still pending at the Court of Justice in October 2026.

This guide is general information, not legal advice. We check it regularly, but laws and guidance change. Not sure about your situation? Ask a lawyer.

Keep reading

More guides

All guides →

Enjoy the first 7 days completely free

Create a free account and see if Cookie Confirm is the right fit for you. Live in 5 minutes.

  • No credit card required
  • €7.95 per month after
  • Plug & play installation
Start my free trial

4.9/5 5,000+ websites