Google Analytics and CCPA: What GA4 Users Need to Know

What Is the CCPA, and Does It Apply to Your Website?

The California Consumer Privacy Act (CCPA) is a state privacy law, amended by the California Privacy Rights Act (CPRA), that gives California residents rights over their personal information and places obligations on the businesses that collect it. It's enforced by the California Privacy Protection Agency (CPPA) and the California Attorney General.

The CCPA applies to for-profit businesses that meet at least one of three thresholds:

• Annual gross revenue exceeding USD 26,625,000 (the current Consumer Price Index-adjusted figure, up from the original USD 25 million)
• Buying, selling, or sharing the personal information of 100,000 or more California consumers or households annually
• Deriving 50 percent or more of annual revenue from selling or sharing personal information

If your business meets any of these thresholds and your site uses Google Analytics, the rest of this article applies to you. For a fuller breakdown of consumer rights, business obligations, and penalties, see this overview for supporting CCPA compliance.

How Does Google Analytics Collect Personal Information?

Universal Analytics, the previous version of Google Analytics, stopped processing data on July 1, 2023 (July 1, 2024, for 360 properties).

Google Analytics 4 (GA4) is now the only version in operation, and it works differently from its predecessor. It's event-based rather than session-based, and it introduces two features with direct CCPA relevance.

Google Signals links data to signed-in Google accounts for cross-device reporting, and Consent Mode adjusts what GA4 collects based on a visitor's consent or opt-out status.

GA4 works through JavaScript tags inserted into your website's source code, commonly operated through Google Tag Manager. When a visitor lands on and interacts with your site, these tags fire and set a first-party cookie (_ga) that contains a Client ID, a string of numbers GA4 assigns to the visitor's device to measure their behavior across a session and over time.

Why Google Analytics Data Counts as Personal Information Under the CCPA

The CCPA defines personal information broadly, as information that "identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

That definition explicitly includes unique and persistent identifiers capable of recognizing a device linked to a consumer over time and across services, which is exactly what a GA4 Client ID is built to do.

GA4 doesn't collect direct identifiers like names or email addresses by default, but that doesn't exempt it from the CCPA. Because the Client ID persists and re-identifies a visitor's device across sessions, using GA4 on a site that meets the CCPA's business thresholds creates a compliance obligation, whether or not the data is ever explicitly tied to a real name.

What the CCPA Requires If You Use Google Analytics

Supporting CCPA compliance while running Google Analytics comes down to four things.

1. Update Your Privacy Policy

Your privacy policy should disclose that your site uses Google Analytics, that it sets cookies (including a Client ID recognized as a persistent identifier), that this data is shared with Google, and that visitors have the right to know, delete, and opt out of the sale or sharing of their information.

2. Display the Correct Opt-Out Link

The CPRA added "sharing" — cross-context behavioral advertising — as a category distinct from "selling." As a result, the link your site displays must read "Do Not Sell or Share My Personal Information," not the original CCPA's "Do Not Sell My Personal Information."

3. Honor Global Privacy Control

California requires businesses to treat a Global Privacy Control (GPC) signal from a visitor's browser as a valid opt-out of sale and sharing, without requiring the visitor to click anything further. If your site can't detect and honor GPC automatically, a consent management platform can handle this for you.

4. Respond to Requests for Disclosure and Deletion

If a visitor requests access to or deletion of the personal information Google Analytics has collected about them, you'll need their Client ID (found in their browser's _ga cookie) or User ID, depending on your GA4 setup, to locate and act on their data.

The CCPA isn't the only U.S. privacy law your site may need to account for, and requirements vary by state. If you're not sure which other regulations apply to your business, Cookiebot's regulations finder can help you check.

Configuring Google Analytics 4 to Support CCPA Compliance

Beyond the disclosure and opt-out requirements above, a few GA4 settings directly affect your CCPA exposure.

Actions to Help Limit CCPA Exposure

Turn off Google Signals

If you're not using cross-device advertising features tied to it, this limits the data GA4 links to signed-in Google accounts.

Enable Restricted Data Processing (RDP)

Enable this for California traffic, which signals to Google that a visitor's data should be handled with sale/sharing restrictions in place.

Use Consent Mode

This is so GA4 automatically adjusts data collection based on a visitor's opt-out status, rather than relying on manual configuration per visitor.

Use GA4's Data Deletion Requests feature

This is under Admin > Data Collection and Modification. This is to fulfill a visitor's deletion request. You can find the current setup steps in Google's guide to GA4 data deletion requests.

Using a Consent Management Platform to Support CCPA Compliance

Google Analytics is rarely the only tracker on a website, and the CCPA covers all of them, not just GA4. Cookiebot™ CMP scans your entire site to find every cookie and tracking technology in use, then generates a cookie declaration and banner that display the required "Do Not Sell or Share My Personal Information" link to visitors it detects as being in California.

Cookiebot CMP is built to help support CCPA compliance alongside other regulations like the GDPR, detecting a visitor's location and applying the right consent and opt-out logic automatically, including recognition of Global Privacy Control signals.