Is Google Analytics GDPR compliant?

Two questions hide inside the one you searched

“Is Google Analytics GDPR compliant?” has no yes or no, because a tool is not compliant on its own: the site that installs it is the controller and answers for how it runs. What regulators have actually ruled on splits into two questions. May the data travel to the US? And may the tag store its cookie on the visitor’s device before they agree? Follow one pageview and you can see where each question sits.

The 2021 and 2022 decisions below turned on stop 03, the transfer. The 10 July 2023 adequacy decision answered that stop for organisations on the US list. Stop 01 is a separate rule with its own answer, and it is where most of the day-to-day work still sits.

The decisions, in date order

The story did not stop in 2022. Here are 9 dated steps, from the court ruling that started it to the appeal lodged in 2025. Each row links to the deciding body’s own text, read 22 Oct 2026.

What each finding means now

A decision is only as current as the facts it rested on. These are the findings the 2021 and 2022 decisions turned on, with what has moved since. 2 of the 5 still bind a GA4 site exactly as written.

What the Data Privacy Framework changed

On 10 July 2023 the Commission took exactly that kind of decision for the United States, with one limit written into its first article: the adequate level of protection covers personal data sent to organisations that are on the “Data Privacy Framework List”, kept and published by the US Department of Commerce (Decision (EU) 2023/1795, Art. 1). A US company that is not on the list gets nothing from it. The decision answers where the data may go; it does not answer whether you may set the cookie.

Where Google stands on it

• Google says Google LLC and its wholly-owned US subsidiaries, unless explicitly excluded, have certified that they adhere to the framework’s principles.
• From 1 September 2023 it relies on the EU-US framework to transfer EEA personal information to the US when clients use its ads and analytics products. For UK and Swiss data it relies, in certain circumstances, on the UK Extension and the Swiss-US framework from 16 September 2024.
• Its processing terms keep standard contractual clauses as the fallback where it has not adopted, or is no longer adopting, a framework like this one.

That fallback matters because the Commission says the US safeguards behind the decision apply to transfers made with clauses too. The comparison of PostHog and Google Analytics shows both vendors naming the same two routes.

What could still move it

The decision is reviewed: first after one year, then at intervals set with the member states’ committee and the EDPB, and the Commission can suspend, amend or repeal it if protection slips (Art. 3(4)–(5)). In court, the General Court dismissed an action to annul it on 3 September 2025, and an appeal to the Court of Justice was lodged on 31 October 2025. The Privacy Shield before it was struck down by that same court, so the appeal is worth a calendar reminder.

What the framework did not change: consent before the cookie

Storing information on a visitor’s device, or reading it back, needs their consent after clear and comprehensive information, unless it is strictly necessary for a service they explicitly asked for (ePrivacy Directive, Art. 5(3)). GA4’s _ga cookie, with its 2-year default expiration, is that kind of storage. This rule sits beside the GDPR, not inside it, and no adequacy decision reaches it.

The EU’s regulators have also said what the asking looks like. In their cookie banner taskforce report, a vast majority considered a banner with no reject option on any layer that carries a consent button to be an infringement; cookie placement under Art. 5(3) cannot rest on legitimate interests; and visitors need an easy way to withdraw consent at any time (report adopted 17 January 2023). Our cookie banner checklist walks a banner through each point.

Consent mode is a switch on the tag, not the consent

Google’s consent mode reads the choice your banner records and changes what the tags do. In basic mode the tags are blocked until the visitor interacts with the banner. In advanced mode they load when the page opens and, while consent is denied, send measurements without cookies. Those requests still leave the visitor’s device with its IP address, and the EDPB says tracking that relies only on the IP address can fall under Art. 5(3), though that does not always mean consent is needed (Guidelines 2/2023, ¶ 54–56). If you run advanced mode for EU visitors, that is a decision to take on purpose, not a default to inherit.

The French route to consent-free measurement

France’s CNIL publishes the conditions under which an audience-measurement tool may run without consent under its national cookie law. They are specific enough to work as a settings review even outside France. The right-hand column is the GA4 setting each condition points to, not a finding that GA4 passes or fails.

The set-up sheet: what to be able to show

Regulators ask the site, so the useful question is not whether Google Analytics is compliant but whether you can show how your install handles each stop. This sheet puts the lines from the sections above in one place. If the GDPR reaches you at all, tracking people in the EU is one of the ways in; our guide on whether the GDPR applies to US companies covers that test, and the data map template has a column for each transfer.

Questions