At the other end, these JavaScript tags running Google Analytics set tracking cookies<\/a> on users\u2019 browsers that collect personal data. These cookies are used to track individual behavior across pages of the site and over multiple sessions.<\/p>\n\n\n\n Universal Analytics was Google\u2019s primary analytics tool until July 2023, when it was deprecated in favor of Google Analytics 4, which was launched in October 2020. Google Analytics 4 introduced several key differences in its approach to data measurement and user privacy.<\/p>\n\n\n\n Since Universal Analytics no longer collects new data, this article will focus on Google Analytics 4.<\/p>\n\n\n\n Let\u2019s go into a bit more detail on the EU\u2019s GDPR, what implications it has for your website, and what kind of cookies Google Analytics uses.<\/p>\n\n\n\n The GDPR is a data privacy regulation that covers the European Union and European Economic Area. It protects all personal data of individuals residing in those regions. (It doesn\u2019t matter if companies using GA4 and collecting data are not located in the EU.) The GDPR has strict requirements for how websites, companies, and organizations all around the world are allowed to collect and process such data, including through cookie consent<\/a>.<\/p>\n\n\n\n The GDPR applies to any website, anywhere in the world, if it processes personal data from residents of the EU. It requires you to ask for and obtain the explicit consent from EU residents prior to any processing of their personal data. <\/p>\n\n\n\n The GDPR allows for six legal bases for data processing, of which consent is one. It\u2019s among the most commonly used where consumers\u2019 data and privacy are concerned.<\/p>\n\n\n\n Personal data under the GDPR is any kind of data that could identify an individual either directly or indirectly, alone or combined with other data points. Included in this definition are common online identifiers such as:<\/p>\n\n\n\n Cookies serve a range of purposes, including functionality, performance, statistics and targeted advertisement. Some cookies are necessary for your website to work, and some are not, but are valuable for business operations. Some enhance user experience, some serve for monitoring and user profiling, and some do both. This is where Google Analytics and the GDPR overlap, because Google Analytics uses cookies to track your website\u2019s users<\/a> and their behavior.<\/p>\n\n\n\n Google Analytics 4\u2019s gtag.js JavaScript library uses first-party cookies to distinguish between users and unique sessions from users.<\/p>\n\n\n\n Only necessary or essential cookies are allowed to function on your website without user consent, because they are strictly necessary for the basic functions and user experience on your domain.<\/p>\n\n\n\n Google Analytics 4 sets the following cookies when in use on your website:<\/p>\n\n\n\n Google Analytics 4 cookies are stored in your users\u2019 browsers when they arrive on your website. This is how Google Analytics 4 can distinguish among and remember each individual user and present you with a detailed map of their journey to and from your domain, as well as their activities while there.<\/p>\n\n\n\n These cookies are used for tracking and analytics purposes rather than being essential for website functionality, so they do not fall into the \"necessary cookies\" category. If you use Google Analytics 4, it is suggested that you obtain explicit user consent prior to their activation to be compliant with the GDPR.<\/p>\n\n\n\n Google Analytics 4\u2019s data collection categories<\/a> from cookies include:<\/p>\n\n\n\n Google Analytics 4 has some features that are part of Google\u2019s EU-focused data and privacy approach. These include:<\/p>\n\n\n\n However, GDPR compliance is complex, and Google Analytics 4 use on its own is neither compliant nor noncompliant with the GDPR. So how can you make sure your website\u2019s use of Google Analytics 4 is GDPR compliant? And how do you balance Google Analytics 4, cookies, and end-user consent on your website to still get valuable statistics and insights without breaking European data protection laws, and the trust of your users?Let\u2019s do a quick breakdown of Google Analytics 4 GDPR compliance on your website.<\/p>\n\n\n\n Here\u2019s a step-by-step guide on how to get valid GDPR consent for Google Analytics 4 and cookie use on your website.<\/p>\n\n\n\n You must ask for and obtain the explicit and informed consent from your users in order to use Google Analytics in compliance with the GDPR on your website.<\/p>\n\n\n\n Valid consent under the GDPR looks like this:<\/p>\n\n\n\n Using a GDPR-compliant cookie banner<\/a> via Cookiebot consent management platform (CMP) enables you to obtain user consents that meet GDPR consent requirements.<\/p>\n\n\n\n Your privacy policy<\/a> must provide detailed information about the data processing on your site, including the purposes for which you collect data, the kinds of data you collect, and who you share it with.<\/p>\n\n\n\n Your cookie policy<\/a> can be a separate document, or it may be a part of your privacy policy. It must include detailed information about all cookies and other tracking technologies in use on your website, including Google Analytics 4 cookies, what purposes they serve, and how users can consent to or deny their use.<\/p>\n\n\n\n With Google Consent Mode<\/a>, you can manage Google Analytics, cookies, and GDPR user consent all at once to secure privacy-compliant analytics and insights for your website. Google Consent Mode launched on September 3, 2020 and was updated in November 2023. It is a huge step in achieving a balance on your website between data privacy compliance and analytics insights. It\u2019s designed to signal users\u2019 consent preferences to Google tags and other services.<\/p>\n\n\n\n The \u201canalytics_tag\u201d tag setting enables Google Consent Mode to adjust the behavior of analytics cookies or statistics cookies so that they don\u2019t fire unless the user gives explicit consent.<\/p>\n\n\n\n If users don\u2019t give their consent to statistics cookies, Google Consent Mode makes sure that you still get aggregate and non-identifying insights into your website\u2019s performance, such as:<\/p>\n\n\n\n Google Consent Mode helps enable compliance with the GDPR and requirements Google has levied on its customers, while also contributing to optimized analytics data, respecting both end-user privacy and your need for data and user insights to drive marketing operations.<\/p>\n\n\n Achieve GDPR compliance without sacrificing analytics accuracy or campaign performance<\/p>\n <\/div>\n <\/div>\n A Data Processing Agreement (DPA) is a legally binding contract required in some instances under the GDPR, that sets out the rights and obligations of the data controller \u2014 in this case, your company \u2014 and the data processor \u2014 in this case, Google \u2014 regarding the processing and protection of personal data.<\/p>\n\n\n\n The GDPR mandates that a DPA must include certain provisions, such as:<\/p>\n\n\n\n The DPA can be a critical element in the GDPR framework, helping to ensure that when a data controller outsources data processing activities to a data processor, the latter handles personal data in compliance with the regulation. While processors do have responsibilities for security and compliant processing, ultimate responsibility for GDPR-compliant processing and data protection lies with the data controller. <\/p>\n\n\n\n You can follow these steps to accept Google\u2019s DPA<\/a> from your Google Analytics account.<\/p>\n\n\n\n Google Analytics is a statistics and marketing tool that digital advertisers often use to measure the effectiveness of their online advertising campaigns, segment audiences, track conversions and create remarketing campaigns.<\/p>\n\n\n\n There are also requirements from Google for advertisers, including those that use Google Analytics 4, that collect data from or serve ads to users in the EU and EEA in compliance with the GDPR.<\/p>\n\n\n\n The Interactive Advertising Bureau (IAB) Europe\u2019s Transparency and Consent Framework (TCF) enables standardized user consent collection and management in accordance with GDPR requirements.<\/p>\n\n\n\n From January 2024, advertisers that want to serve ads to users in the EU, EEA, and the United Kingdom using Google\u2019s advertising services are required to use a CMP that integrates with the IAB TCF v2.2<\/a>.Cookiebot CMP integrates with the IAB TCF v2.2 and is a Google-certified CMP<\/a>. Google has started requiring customers to use a certified CMP that integrates with Consent Mode and the TCF 2.2 to continue to access all functions of various services, including the personalization features of Google Ads.<\/p>\n\n\n Google\u2019s EU user consent policy applies to data collected from end users located in the EU, EEA and\/or the UK, if the business collecting the data:<\/p>\n\n\n\n Businesses using Google Analytics advertising features<\/a> must comply with the EU user consent policy, which mandates explicit and informed user consent for collecting and using personal data, clear communication regarding the purposes of data processing, and providing options for users to grant or revoke consent.<\/p>\n\n\n One of the significant compliance issues with Universal Analytics involved the storage of EU residents\u2019 personal data on servers based in the United States. This storage practice raised concerns regarding GDPR compliance, especially given the GDPR mandates that international data transfers must only occur to countries or entities that provide an adequate level of protection in line with EU standards.<\/p>\n\n\n\n The invalidation of the EU-US Privacy Shield framework by the European Court of Justice in July 2020 further complicated data transfers between the EU and the US. After the ruling, European Data Protection Authorities (DPAs) in Austria, France, Italy, the Netherlands, Norway, Denmark and Sweden declared that the use of Universal Analytics was noncompliant with the GDPR.<\/p>\n\n\n\n These decisions emphasized the need for additional safeguards when transferring personal data to the U.S., as the country's surveillance laws were found to be incompatible with EU privacy rights.<\/p>\n\n\n\n Organizations using Universal Analytics had to reassess their data transfer and storage practices to achieve and maintain compliance with the GDPR, often involving the use of additional contractual safeguards, such as Standard Contractual Clauses (SCCs), or seeking alternative solutions that offered data storage within the EU.<\/p>\n\n\n\n In July 2023, the European Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework<\/a> to govern data transfers between the EU, EEA, and U.S., enabling alignment with the GDPR.<\/p>\n\n\n\n There are formal challenges pending against the Framework, but it is in effect, and EU-US data transfers under Google Analytics 4 can be valid. Organizations using Google Analytics 4 should remain vigilant and seek legal advice to ensure ongoing compliance with the GDPR and any future changes in data protection regulations or adequacy decisions.<\/p>\n\n\n\n The Digital Markets Act (DMA)<\/a> introduced new rules for large digital platforms operating in the EU, which could influence how Google Analytics 4 operates, especially in terms of data handling and user privacy.<\/p>\n\n\n\n As a user of Google Analytics 4, you may need to adjust your approach to data handling to align with the regulation\u2019s requirements. Here's a straightforward plan to help you prepare:<\/p>\n\n\n\n Learn more about the Digital Markets Act<\/a>.<\/p>\n\n\n\n Cookiebot CMP is a cookie consent solution<\/a> that streamlines the process of using Google Analytics in a GDPR-compliant manner by focusing on user consent and data transparency.<\/p>\n\n\n\nWhat is the difference between Google Analytics 4 and Universal Analytics?<\/h2>\n\n\n\n
\n
Google Analytics 4 and GDPR compliance<\/h2>\n\n\n\n
\n
![\"\"](\"https:\/\/www.cookiebot.com\/us\/wp-content\/uploads\/sites\/8\/2025\/03\/google_analytics_4_and_gdpr_compliance.svg\")
<\/figure>\n\n\n\nDoes Google Analytics 4 use cookies?<\/h2>\n\n\n\n
\n
What are the categories of data that Google Analytics 4 collects?<\/h2>\n\n\n\n
\n
Is Google Analytics 4 GDPR compliant?<\/strong><\/h2>\n\n\n\n
\n
![\"\"](\"https:\/\/www.cookiebot.com\/us\/wp-content\/uploads\/sites\/8\/2025\/03\/is_google_analytics_4_gdpr_compliant_.svg\")
<\/figure>\n\n\n\nSteps for GDPR-compliant Google Analytics 4 data collection<\/h2>\n\n\n\n
Step 1: Obtain valid end-user consent for Google Analytics 4<\/h3>\n\n\n\n
\n
Step 2: Create a comprehensive privacy and cookie policy<\/h3>\n\n\n\n
Step 3: Use Google Consent Mode with Google Analytics 4<\/h3>\n\n\n\n
\n
\n Cookiebot CMP integrates with Google Consent Mode <\/h2>\n
\n Unlock consent-driven marketing opportunities with Cookiebot CMP and Google Consent Mode v2 <\/h2>\n <\/div>\n
Step 4: Enter into a Data Processing Agreement with Google<\/h3>\n\n\n\n
\n
Google Analytics 4 and GDPR-compliant advertising practices<\/h2>\n\n\n\n
IAB Transparency and Consent Framework integration<\/h3>\n\n\n\n
\n Secure your ad revenue with the TCF v2.2 and Cookiebot CMP <\/h2>\n <\/div>\n
Google EU user consent policy<\/h3>\n\n\n\n
\n
\n Read more on Usercentrics: What is the Google EU User Consent Policy and who does it apply to?<\/a> <\/h2>\n <\/div>\n <\/div>\n <\/div>\n<\/div>\n\n\n\n
Google Analytics 4 data transfers and the EU-U.S. Data Privacy Framework<\/strong><\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.cookiebot.com\/us\/wp-content\/uploads\/sites\/8\/2025\/03\/ga4_data_transfers_and_the_eu-us_data_privacy_framework.svg\"){kind=spacer}
<\/figure>\n\n\n\nThe Digital Markets Act and its impact on Google Analytics<\/strong><\/h2>\n\n\n\n
\n
Cookiebot CMP: Your partner for Google Analytics GDPR Compliance<\/h2>\n\n\n\n
\n
\n Want to use Google Analytics cookies in GDPR compliance? Get started in 3 simple steps with Cookiebot CMP. <\/h2>\n <\/div>\n