In early 2022, the Austrian data protection authority (DSB) issued a landmark ruling: a website using Google Analytics was violating GDPR. The site was transferring personal data — specifically, the visitor's IP address and a persistent Google cookie identifier — to Google LLC's servers in the United States without a valid legal basis for that transfer under EU law.
Within months, the French CNIL, Italian Garante, and Danish Datatilsynet issued similar rulings. For a period, any EU website running Google Analytics was potentially operating outside the law.
That was before the EU-US Data Privacy Framework. Here is where things stand in 2026.
Why Google Analytics Was Deemed a Problem
The core legal issue was never the analytics themselves. It was the transfer of personal data to the United States.
IP addresses are personal data. Under GDPR, an IP address — even a truncated one — is personal data if it can be used to identify an individual, either alone or in combination with other information. The Court of Justice of the EU confirmed this in the Breyer case (2016). Google Analytics collects full IP addresses at the point of collection before any anonymisation is applied.
The Schrems II ruling (2020). The CJEU's Schrems II judgment invalidated Privacy Shield — the legal mechanism that had allowed EU-to-US data transfers. After Schrems II, Standard Contractual Clauses (SCCs) remained the primary mechanism, but they required case-by-case transfer impact assessments. For US-based analytics tools, multiple DPAs concluded that SCCs alone were insufficient because US intelligence laws (particularly FISA Section 702) gave US authorities potential access to EU personal data held by US companies.
The 2022 DPA rulings. Austria, France, Italy, and Denmark each examined the data flows between a website's use of Google Analytics and Google's US servers, and concluded that:
- IP addresses and Google cookie identifiers were personal data
- The transfer to the US lacked a valid legal basis post-Schrems II
- Standard Contractual Clauses did not adequately protect the data given US surveillance law
Website operators were directed to either stop using Google Analytics or implement supplementary technical measures sufficient to prevent US access to personal data.
What Changed: The EU-US Data Privacy Framework (2023)
In July 2023, the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework (DPF). The DPF established a new legal mechanism for EU-to-US data transfers, replacing the invalidated Privacy Shield.
Under the DPF:
- Certified US companies (Google LLC is certified) can receive EU personal data without requiring SCCs
- US companies must commit to specific data protection principles and limitations
- EU individuals have a redress mechanism — including a new Data Protection Review Court — for complaints about US government access to their data
The practical impact on Google Analytics: Google Analytics transfers to Google LLC in the US are now covered by the DPF adequacy decision. This resolves the specific legal basis issue that drove the 2022 rulings. The Austrian, French, Italian, and Danish rulings were based on the absence of a valid transfer mechanism — the DPF provides one.
What the DPF does not fix: The DPF does not change the fact that GA4 still collects personal data. It still requires a lawful basis for processing — and for analytics cookies, that basis is almost always consent. The DPF fixes the US transfer question; it does not eliminate the consent requirement.
The Schrems III risk: Max Schrems's organisation (noyb) has publicly stated it will challenge the DPF before the CJEU, as it challenged both Safe Harbor and Privacy Shield. A future Schrems III ruling invalidating the DPF would put GA4 compliance back into question. Businesses with low risk tolerance should implement fallback SCCs alongside DPF reliance and monitor CJEU proceedings.
GA4 vs Universal Analytics: GDPR Differences
Universal Analytics (UA), which was sunset in July 2023, was more problematic under GDPR than GA4:
| Feature | Universal Analytics | GA4 |
|---|---|---|
| IP anonymisation | Manual — had to be configured | Default — applied at collection |
| Default data retention | 26 months | 14 months (configurable to 2 months) |
| Cookie identifiers | _ga, _gid, _gat (multiple persistent cookies) | Primarily _ga (one persistent cookie) |
| Google Signals | Optional | Optional but more integrated |
| Server-side option | Limited | Full server-side tagging support |
| Cross-device tracking | Limited | Expanded via Google Signals |
GA4's default IP anonymisation is a genuine improvement. It does not eliminate personal data processing entirely, but it reduces the IP address risk that featured prominently in the 2022 DPA rulings.
Practical Steps to Make GA4 More GDPR-Compliant
Step 1: Implement proper cookie consent. GA4's JavaScript tag must not fire until the user has actively accepted analytics cookies. Use a consent management platform (CMP) that integrates with Google Consent Mode v2. In Consent Mode v2, GA4 uses modelled data when consent is denied — giving you some analytics data without personal data collection for non-consenting users.
Step 2: Reduce data retention to 2 months. In GA4 Admin > Data Settings > Data Retention, set both user-level and event-level data retention to 2 months. Disable "Reset on new activity."
Step 3: Disable Google Signals unless necessary. Google Signals links GA4 data to users' Google accounts, enabling cross-device and cross-site tracking. Unless you specifically need cross-device reporting for advertising, disable it. Admin > Data Settings > Data Collection > Google Signals.
Step 4: Review and accept Google's DPA. Google's Data Processing Amendment (DPA) for GA4 must be explicitly accepted in your Google Analytics account settings. Go to Admin > Account Settings > Data Processing Amendment.
Step 5: Update your privacy policy. Your privacy policy must specifically mention Google Analytics, describe what data is collected, state the lawful basis (consent), reference the DPF as the transfer mechanism, and explain how users can opt out (via your cookie consent panel and via google.com/settings/ads).
Step 6: Consider server-side tagging. Server-side tagging routes GA4 data through your own server before sending it to Google. This lets you strip personal identifiers (full IP, user agent) before the data reaches Google, significantly reducing personal data transfers. It requires technical implementation but is increasingly common for privacy-conscious large sites.
Decision Table: GA4 vs Privacy-First Alternatives
| Tool | Hosting | Cookies set | Consent required | US data transfer | Price |
|---|---|---|---|---|---|
| GA4 (with consent) | Google (US, DPF) | Yes — _ga persistent cookie | Yes — required before tracking | Yes — covered by DPF | Free |
| GA4 (server-side, anonymised) | Your server + Google | Reduced | Yes — still required | Reduced personal data | Free + server cost |
| Matomo (self-hosted) | Your server (EU) | Optional — can be cookieless | Not required (cookieless mode) | None | Free (self-hosted) |
| Plausible Analytics | EU servers (Estonia) | No cookies | Not required | None | €9/month |
| Fathom Analytics | Canada/EU (GDPR-compliant) | No cookies | Not required | None | $15/month |
GA4 with proper consent implementation remains a viable option for most websites in 2026, provided the DPF holds and Consent Mode v2 is correctly configured. It gives you the most detailed analytics data.
Plausible or Fathom are appropriate for businesses that want to eliminate the consent banner requirement, simplify their data processing register, and avoid DPF uncertainty. The trade-off is less granular data — no user-level reporting, no funnel analysis, no integration with Google Ads.
Matomo self-hosted is the most privacy-protective option if you need feature-rich analytics. When configured in cookieless mode, Matomo requires no consent banner and involves no third-party processing. The trade-off is server setup and maintenance cost.
Updating Your Privacy Policy for Google Analytics
If you continue using GA4, your privacy policy must include:
- Name of the tool: Google Analytics 4 (Google LLC)
- What data is collected: cookie identifiers (_ga), IP address (anonymised at collection), page views, events, device and browser information
- Lawful basis: Consent (Article 6(1)(a) GDPR)
- Data transfer: To Google LLC in the United States, covered by the EU-US Data Privacy Framework (adequacy decision of 10 July 2023)
- Retention: Data retained for [X] months per your GA4 settings
- Opt-out: Via the cookie consent panel on this website, or via Google's Ads Settings (google.com/settings/ads)
Use our GDPR Privacy Policy Generator to generate a policy with the correct Google Analytics disclosure pre-populated. For cookie consent banner implementation, see our Cookie Consent Generator.