Is Google Analytics GDPR compliant?

Google Analytics 4 can be used in compliance with GDPR, but compliance depends on how you configure and use it. Google’s Analytics privacy controls support this work; they do not establish compliance automatically.

Website operators need to:

• Establish a lawful basis and obtain valid cookie consent before using analytics cookies or tracking where applicable law requires it.

• Explain the data collected, purposes, recipients, retention and international transfers in their privacy information.

• Ensure the appropriate data processing terms apply and review any settings that allow Google to use shared data for its own purposes.

• Minimise collection, set justified retention periods and support individuals’ rights. Keep names, email addresses and other prohibited identifying information out of Analytics.

• Review advertising and data-sharing features and disable those that are unnecessary.

International transfers also need a valid legal mechanism. The EU–US Data Privacy Framework can cover transfers to appropriately certified US recipients; its coverage must be checked for the receiving entity and relevant data. This does not replace other GDPR obligations.

Google Consent Mode communicates consent choices and adjusts tag behaviour. Its advanced implementation can send cookieless pings when consent is denied, so enabling it does not by itself establish that all resulting collection is lawful.