---------------------------
Title: Google Analytics and CCPA: What GA4 Users Need to Know
URL: https://www.cookiebot.com/en/google-analytics-ccpa/
---------------------------

# Google Analytics and CCPA: What GA4 Users Need to Know

Universal Analytics has retired, and Google Analytics 4 changes how the CCPA applies to your site. This article explains why GA4 client identifiers count as personal information under the CCPA and CPRA, what the updated 100,000-consumer and revenue thresholds mean, and how to update your privacy policy, honor Global Privacy Control signals, and use a CMP to support compliance.

## At a Glance

- Google Analytics places first-party cookies containing a ClientID, which the CCPA treats as personal information because it can identify a device or consumer over time.
- CCPA obligations only apply if your business meets one of three thresholds: $25 million+ in annual revenue, 50% of revenue from data sales, or handling PI for 50,000+ California residents.
- Unlike the GDPR's opt-in model, the CCPA is an opt-out law, so no prior consent is required, but a "Do Not Sell or Share My Personal Information" link is mandatory.
- Compliant use of Google Analytics requires updating your privacy policy and having a process to handle disclosure and deletion requests tied to ClientIDs or UserIDs.

## **What Is the CCPA, and Does It Apply to Your Website?**

The [California Consumer Privacy Act (CCPA)](https://www.cookiebot.com/en/what-is-ccpa/) is a state privacy law, amended by the [California Privacy Rights Act (CPRA)](https://www.cookiebot.com/en/cpra/), that gives California residents rights over their personal information and places obligations on the businesses that collect it. It's enforced by the [California Privacy Protection Agency (CPPA)](https://www.cookiebot.com/en/escalating-cppa-enforcement/) and the California Attorney General.

The CCPA applies to for-profit businesses that meet at least one of three thresholds:

- Annual gross revenue exceeding USD 26,625,000 (the current Consumer Price Index-adjusted figure, up from the original USD 25 million)
- Buying, selling, or sharing the personal information of 100,000 or more California consumers or households annually
- Deriving 50 percent or more of annual revenue from selling or sharing personal information

If your business meets any of these thresholds and your site uses Google Analytics, the rest of this article applies to you. For a fuller breakdown of consumer rights, business obligations, and penalties, see this overview for supporting [CCPA compliance](https://www.cookiebot.com/en/what-is-ccpa/).

## **How Does Google Analytics Collect Personal Information?**

Universal Analytics, the previous version of Google Analytics, stopped processing data on July 1, 2023 (July 1, 2024, for 360 properties).

Google Analytics 4 (GA4) is now the only version in operation, and it works differently from its predecessor. It's event-based rather than session-based, and it introduces two features with direct CCPA relevance.

Google Signals links data to signed-in Google accounts for cross-device reporting, and Consent Mode adjusts what GA4 collects based on a visitor's consent or opt-out status.

GA4 works through JavaScript tags inserted into your website's source code, commonly operated through Google Tag Manager. When a visitor lands on and interacts with your site, these tags fire and set a first-party cookie **(_ga)** that contains a Client ID, a string of numbers GA4 assigns to the visitor's device to measure their behavior across a session and over time.

### **Why Google Analytics Data Counts as Personal Information Under the CCPA**

The CCPA defines personal information broadly, as information that "identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

That definition explicitly includes unique and persistent identifiers capable of recognizing a device linked to a consumer over time and across services, which is exactly what a GA4 Client ID is built to do.

GA4 doesn't collect direct identifiers like names or email addresses by default, but that doesn't exempt it from the CCPA. Because the Client ID persists and re-identifies a visitor's device across sessions, using GA4 on a site that meets the CCPA's business thresholds creates a compliance obligation, whether or not the data is ever explicitly tied to a real name.

## **What the CCPA Requires If You Use Google Analytics**

Supporting CCPA compliance while running Google Analytics comes down to four things.

### **1. Update Your Privacy Policy**

Your [privacy policy](https://www.cookiebot.com/en/how-to-write-privacy-policy-guide/) should disclose that your site uses Google Analytics, that it sets cookies (including a Client ID recognized as a persistent identifier), that this data is shared with Google, and that visitors have the right to know, delete, and opt out of the sale or sharing of their information.

## Need a privacy-compliant privacy policy?

Use our free Privacy Policy Generator and get a privacy policy for your website in minutes. Customized to your business operations and regulatory needs. Stay up to date with privacy requirements.

[Generate Policy](https://www.cookiebot.com/us/free-privacy-policy-generator/)

### **2. Display the Correct Opt-Out Link**

The CPRA added "sharing" — cross-context behavioral advertising — as a category distinct from "selling." As a result, the link your site displays must read "[Do Not Sell or Share My Personal Information](https://usercentrics.com/guides/website-disclaimers/do-not-sell-my-personal-information/)," not the original CCPA's "Do Not Sell My Personal Information."

### **3. Honor Global Privacy Control**

California requires businesses to treat a [Global Privacy Control (GPC)](https://www.cookiebot.com/en/global-privacy-control/) signal from a visitor's browser as a valid opt-out of sale and sharing, without requiring the visitor to click anything further. If your site can't detect and honor GPC automatically, a consent management platform can handle this for you.

### **4. Respond to Requests for Disclosure and Deletion**

If a visitor requests access to or deletion of the personal information Google Analytics has collected about them, you'll need their Client ID (found in their browser's **_ga cookie**) or User ID, depending on your GA4 setup, to locate and act on their data.

The CCPA isn't the only U.S. privacy law your site may need to account for, and requirements vary by state. If you're not sure which other regulations apply to your business, Cookiebot's [regulations finder](https://www.cookiebot.com/en/regulations-finder/?step=1) can help you check.

## **Configuring Google Analytics 4 to Support CCPA Compliance**

Beyond the disclosure and opt-out requirements above, a few GA4 settings directly affect your CCPA exposure.

## Actions to Help Limit CCPA Exposure

- **Turn off Google Signals** — If you're not using cross-device advertising features tied to it, this limits the data GA4 links to signed-in Google accounts.
- **Enable Restricted Data Processing (RDP)** — Enable this for California traffic, which signals to Google that a visitor's data should be handled with sale/sharing restrictions in place.
- **Use Consent Mode** — This is so GA4 automatically adjusts data collection based on a visitor's opt-out status, rather than relying on manual configuration per visitor.
- **Use GA4's Data Deletion Requests feature** — This is under Admin > Data Collection and Modification. This is to fulfill a visitor's deletion request. You can find the current setup steps in Google's guide to GA4 data deletion requests.

## **Using a Consent Management Platform to Support CCPA Compliance**

Google Analytics is rarely the only tracker on a website, and the CCPA covers all of them, not just GA4. Cookiebot™ CMP scans your entire site to find every cookie and tracking technology in use, then generates a cookie declaration and banner that display the required "Do Not Sell or Share My Personal Information" link to visitors it detects as being in California.

Cookiebot CMP is built to help support [CCPA compliance](https://www.cookiebot.com/en/what-is-ccpa/) alongside other regulations like the GDPR, detecting a visitor's location and applying the right consent and opt-out logic automatically, including recognition of Global Privacy Control signals.

Need to comply with California privacy laws?
Try Cookiebot™ free for 14 days. Cookie and tracker detection and blocking, geolocation rules, automated updates, and more to support your compliance operations.

[Start free trial](https://admin.cookiebot.com/signup?lang=en)

## Summary

Universal Analytics has retired, and Google Analytics 4 changes how the CCPA applies to your site. This article explains why GA4 client identifiers count as personal information under the CCPA and CPRA, what the updated 100,000-consumer and revenue thresholds mean, and how to update your privacy policy, honor Global Privacy Control signals, and use a CMP to support compliance.

---

## Footer

### Products
- [Cookiebot™ Consent Solution](https://www.cookiebot.com/en/cookie-consent-solution/)
- [Audience Survey](https://www.cookiebot.com/en/audience-survey-add-on/)
- [Usercentrics for Wix](https://www.cookiebot.com/en/cookiebot-for-wix-by-usercentrics-app/)
- [Usercentrics Cookiebot WordPress Plugin](https://www.cookiebot.com/en/new-wp-cookie-plugin/)
- [Cookiebot CMP for Shopify](https://www.cookiebot.com/en/cookiebot-cmp-for-shopify/)
- [Cookie checker](https://www.cookiebot.com/en/cookie-checker/)
- [Usercentrics products](https://usercentrics.com/)
- [Pricing](https://www.cookiebot.com/en/pricing/)

### Regulations
- [DMA (EU)](https://www.cookiebot.com/en/digital-markets-act-dma/)
- [GDPR (EU)](https://www.cookiebot.com/en/gdpr/)
- [CCPA (California)](https://www.cookiebot.com/en/what-is-ccpa/)
- [VCDPA (Virginia)](https://www.cookiebot.com/en/virginia-vcdpa/)
- [LGPD (Brazil)](https://www.cookiebot.com/en/lgpd/)
- [TCF v2.3 (IAB)](https://www.cookiebot.com/en/tcf/)
- [Google Consent Mode (EU)](https://www.cookiebot.com/en/cookiebot-cmp-google-consent-mode/)
- [Microsoft UET Consent Mode](https://www.cookiebot.com/en/microsoft-consent-mode-cmp/)
- [View all regulations](https://www.cookiebot.com/en/regulations-and-frameworks/)

### Partners
- [Become an affiliate](https://www.cookiebot.com/en/affiliates/)
- [Affiliate Login](https://app.impact.com/login.user)
- [Become a partner](https://www.cookiebot.com/en/resellers/)
- [Find a partner](https://www.cookiebot.com/en/cookiebot-reseller/)

### Resources
- [Blog](https://www.cookiebot.com/en/blog/)
- [Customer stories](https://www.cookiebot.com/en/customer-stories/)
- [Customer directory](https://www.cookiebot.com/en/cookiebot-customer-directory/)
- [Digital Markets Act Hub](https://www.cookiebot.com/en/digital-markets-act-dma-resources/)
- [Google Consent Mode Hub](https://www.cookiebot.com/en/google-consent-mode-resources/)
- [Google Consent Mode V2 certification](https://courses.usercentrics.com/course/google-consent-mode-v2)
- [Google Consent Audit Fixes](https://www.cookiebot.com/en/google-consent-audit-fixes/)
- [Cookie Banner Cost Calculator](https://www.cookiebot.com/en/cookie-banner-pricing-calculator/)

### Company
- [About us](https://www.cookiebot.com/en/about/)
- [Careers](https://usercentrics.com/career/)
- [Support](https://support.cookiebot.com/hc/en-us/)
- [Developer documentation](https://www.cookiebot.com/en/developer/)

©2026 Cookiebot. All rights reserved. Cookiebot is a trademark of     Usercentrics     A/S. Usercentrics A/S is registered in Denmark. Company reg. no.: 34624607. Do Not Sell or Share My Personal InformationData Subject RequestsManage Your Preferences

[Privacy Policy](https://www.cookiebot.com/en/privacy-policy/) · [Terms of Service](/en/terms-of-service/) · [Cookie Declaration](https://www.cookiebot.com/en/cookie-declaration/) · [Data Processing Agreement](https://www.cookiebot.com/en/data-processing-agreement/) · [Legal Notice](https://www.cookiebot.com/en/legal-notice/) · [Accessibility Statement](https://www.cookiebot.com/en/accessibility-statement-wcag-compliance/)