“Can we use Google Analytics without breaching the GDPR?” Many companies have asked this since 2022, when the Italian Data Protection Authority, like other European regulators, challenged its use because of data transfers to the United States. Since then the picture has changed significantly.
In this article we recap what happened, where things stand today and which settings to adopt to use Google Analytics 4 correctly.
Note: this article is for information only and is not legal advice. For your specific case, consult your DPO or privacy adviser.
What happened: the key milestones
| When | What |
|---|---|
| 2020 | The EU Court of Justice (“Schrems II” ruling) invalidates the Privacy Shield, the framework governing personal data transfers between the EU and the US. |
| 2022 | Several European authorities, including the Italian one in June 2022, challenge the use of Google Analytics (Universal Analytics) because of data transfers to the US without adequate safeguards. |
| July 2023 | Universal Analytics stops processing data and Google Analytics 4 becomes the only version. In the same month the European Commission adopts the EU-US Data Privacy Framework, once again allowing data transfers to certified US companies, including Google. |
| 2024 | Google makes Consent Mode v2 mandatory for advertisers using ad features with European users. |
| 2025 | The EU General Court dismisses a challenge to the Data Privacy Framework, upholding it at first instance. Further appeals remain possible. |
So is Google Analytics legal today?
In short: yes, Google Analytics 4 can be used in a compliant way, provided it is configured correctly and the rules on consent and user information are followed. Data transfers to the US are currently covered by the Data Privacy Framework, but the picture may change in future, so it pays to adopt cautious settings and stay up to date.
Settings to check
- Cookie banner and consent: as a general rule, with Google Analytics 4 you should collect consent before measurement starts. Italian guidelines allow an exemption for analytics cookies only under strict conditions (aggregated data, masked IP addresses, no data combination by the provider), to be checked case by case.
- Consent Mode v2: passes users’ choices to Google and adapts data collection accordingly. Essential if you use Google Ads or advertising features.
- Data retention: set a retention period that matches your purposes, not the maximum out of habit.
- Google Signals and advertising features: enable them only if you really need them and consent allows it.
- No personal data in reports: make sure emails, names or phone numbers do not end up in URLs or tracked events.
- Up-to-date privacy and cookie policies, naming Google as a provider and mentioning the data transfer.
- The data processing terms accepted in your account settings.
More advanced solutions
- Server-side tracking: data first goes through a server controlled by the company, preferably in Europe, which can filter or anonymise it before sending it to Google. It gives more control but requires skills and running costs.
- Alternative tools: there are European or self-hosted web analytics solutions. They can be a good choice for organisations with particularly strict privacy needs, at the cost of less integration with the Google ecosystem.
A good setup often relies on Google Tag Manager: read more in Google Tag Manager: an essential tool.
Why giving up measurement is not the answer
Without data you cannot assess campaigns, content and investments. The goal is not to stop measuring but to measure correctly: collect the data you really need, with users’ consent, and use it to make better decisions. A privacy-respecting approach also builds trust in the brand.
FAQ
Do I need consent to use Google Analytics 4?
In most cases, yes. The exemption for analytics cookies requires specific technical conditions that must be checked against your configuration.
What happens if the Data Privacy Framework is struck down?
Data transfers to the US would once again require additional safeguards. That is why a cautious configuration and options such as server-side tracking are worth considering now.
Does Google Analytics 4 log IP addresses?
According to Google, GA4 does not log or store users’ IP addresses, but uses them to derive approximate location. Consent and information rules still apply.
Want to check your setup?
E-Business Consulting helps companies set up measurement correctly and effectively: Google Analytics 4 and Google Tag Manager configuration, Consent Mode, campaign integration and reporting, as part of a data-driven digital strategy. Get in touch with us for a review of your setup.
