Is Google Analytics GDPR compliant?
Google Analytics isn't compliant or non-compliant on its own: the GDPR applies to how you use it. Key checks include consent before analytics cookies are set, an accurate privacy notice, keeping personal data out of what you send and a lawful basis for data going to the US. These checks alone do not establish GDPR compliance.
TL;DR
- Google Analytics isn't compliant or non-compliant on its own: the GDPR applies to how you use it.
- Key checks are consent before analytics cookies are set, an accurate privacy notice, keeping personal data out of what you send, and a lawful basis for data going to the US.
- These checks alone do not establish GDPR compliance.
In standard mode Stickybeak sets three first-party cookies on your own domain, for the visitor, the session and the session count, and shares nothing with anyone. It makes no compliance claim and is in early access.
Get early accessThe short answer, and what it depends on
The General Data Protection Regulation (GDPR) is the European Union's data protection law. It covers the personal data of people in the European Economic Area, wherever your site is hosted. Google Analytics collects data about those people, so you are responsible for using it lawfully. Google describes the split this way: it acts as a data processor for Google Analytics, and its customers are the data controllers who keep full rights over the collection, access, retention and deletion of their data.
In practice, four questions decide whether your setup holds up:
- Cookies and consent. Does Google Analytics set cookies before the visitor has agreed? See which cookies it sets and whether you need a cookie banner.
- Consent mode. Are Google's tags told what the visitor chose? See how consent mode works.
- What you send. Is personal data kept out of page addresses, events and user IDs? See the data you send.
- Transfers to the US. What is the legal basis for data leaving the EU? See the state of EU to US transfers.
This is not legal advice. It explains how the pieces fit, using Google's own documentation and public rulings, all checked on 17 October 2026. Rules differ by country and change, so check your national data protection authority or ask a lawyer before you decide. Stickybeak makes no claim that any setup is compliant. If you would rather collect less in the first place, see privacy-friendly analytics.
Does Google Analytics use cookies?
Yes. Google Analytics 4 sets two cookies by default, according to Google's cookie documentation:
| Cookie | Purpose, per Google | Default expiry |
|---|---|---|
_ga | Used to distinguish users | 2 years |
_ga_<container-id> | Used to persist session state | 2 years |
Are they third-party cookies? No. Google Analytics 4 stores its client ID in first-party cookies, which means cookies set on your own domain, not on a Google one. Linking Google Analytics to Google Ads sets additional cookies, which Google lists in its advertising cookies reference. First-party doesn't mean exempt from consent: the law cares about what a cookie is for, not whose domain it sits on.
You can change the expiry in the Google Analytics interface. The cookie names and lifetimes are Google's to change, so check Google's cookie page before you copy them into a cookie policy.
Do I need a cookie banner for Google Analytics?
If you have visitors in the EU or the UK, usually yes. Under the EU's ePrivacy rules, storing or reading information on a visitor's device needs their consent unless it is strictly necessary to provide the service they asked for. Analytics cookies are generally not treated as strictly necessary. Google tells its own customers the same thing: "Google customers need to inform users about the information being stored and give them the opportunity to grant or deny their consent." (Google Analytics Help, Safeguarding your data.)
What a compliant banner does, in short:
- Doesn't set analytics cookies until the visitor accepts them.
- Makes refusing as easy as accepting.
- Remembers the choice and lets the visitor change it later.
- Is backed by a privacy notice that names the tools and what they do.
Details vary by country. Some regulators have published their own rules for analytics, so look up the authority for the countries your visitors are in. If you'd rather avoid a banner by changing the analytics you use, our docs explain analytics without a cookie banner, and the section below covers the choices.
Google consent mode, in plain words
A cookie banner collects a choice. Consent mode is how Google's tags hear about it. Your consent tool tells the tags what the visitor allowed, and the tags change what they do. Four consent types relevant to analytics and advertising are:
| Consent type | What Google says it covers |
|---|---|
analytics_storage | Storage for analytics purposes, such as visit duration |
ad_storage | Storage such as cookies related to advertising |
ad_user_data | Sending user data to Google for online advertising purposes |
ad_personalization | Personalised advertising |
There are two ways to run it:
- Basic consent mode. Google tags don't load until the visitor interacts with the banner. Google says no data is sent before consent, not even the default consent status. Conversions are filled in with general modelling.
- Advanced consent mode. Tags load straight away with your default settings. When consent is denied, they send the consent state and measurements without cookies. Google uses these for more detailed modelling.
When storage consent is denied, no advertising or analytics cookies are written, and Google says Analytics doesn't store the client ID when analytics storage is denied. What consent mode does not do is decide the legal question for you. Whether the cookieless pings that advanced mode sends are acceptable without consent is a question for your lawyer or regulator. Basic mode is the more cautious choice if you aren't sure. Google's own explanation is on its consent mode page.
What data you send to Google Analytics
Consent covers cookies. Separately, the GDPR cares about what ends up in your reports. Two things from Google are worth knowing:
- IP addresses. Google says Google Analytics does not log or store IP addresses when collecting data. It does use them to give you a sense of where in the world users come from, and for security of the service.
- Personal information. Google's terms prohibit customers from sending personally identifiable information to Google Analytics. That is on you: an email address in a page address, a name in an event or an email address passed as a user ID all count. Google does allow a pseudonymous ID you generate yourself as a User-ID, but that can still be personal data under the GDPR, so it belongs in your privacy notice and your lawful basis.
The common leak is the page address itself, such as a password-reset link or a search results page with someone's name in it. Our guide to PII examples shows what to look for and where it hides. Your privacy notice should also name Google Analytics, say what it collects and why, and say how long you keep the data.
Google Analytics and transfers of data to the US
The part of this debate that made the headlines is about where the data goes, not about cookies. Here is the timeline from public sources, checked on 17 October 2026:
| When | What happened |
|---|---|
| 16 July 2020 | The EU Court of Justice's Schrems II decision ends the earlier EU-US arrangement, Privacy Shield. |
| 10 February 2022 | France's data protection authority, the CNIL, says a French site's use of Google Analytics involved unlawful transfers of personal data to the US, and gives it one month to comply. |
| 10 July 2023 | The European Commission adopts an adequacy decision for the EU-US Data Privacy Framework, which lets personal data go to certified US organisations without extra transfer tools. |
| 3 September 2025 | The EU General Court dismisses a challenge to the framework (case T-553/23, Latombe v Commission). |
| 31 October 2025 | The applicant appeals to the Court of Justice (case C-703/25 P). We found no ruling on the appeal as of 17 October 2026. |
So the 2022 decisions were made before the framework existed, and the framework has so far survived its first court test. It is still being appealed, and earlier arrangements fell to court challenges, so it is not a permanent answer. If you rely on it, check whether Google LLC is on the Data Privacy Framework participant list yourself, and have your lawyer confirm what applies to your account and contract.
A checklist for using Google Analytics in the EU
- Add a consent tool that blocks analytics cookies until the visitor says yes, and set up consent mode so Google's tags follow that choice.
- Decide basic or advanced consent mode, with your adviser, and write down why.
- Check what the tags actually do. Load the site in a private window, decline the banner and look at the cookies and requests. Google Tag Manager tags need the same consent settings as the Google Analytics tag.
- Keep personal data out of page addresses, event names and user IDs. See PII examples.
- Update your privacy and cookie notices to name Google Analytics, the cookies above and how to withdraw consent.
- Accept the data processing terms in your Google Analytics account and set the data retention you actually need.
- Review the transfer question with your lawyer once a year, because it is still moving.
If you don't want a consent banner for analytics
You can change tool instead of adding more consent plumbing. Our Google Analytics alternatives guide compares the options, Matomo vs Google Analytics sets Matomo beside it, and how to remove Google Analytics covers taking it off cleanly.
If you look at Stickybeak, here is what its documentation says, so you can judge for yourself. Its standard script sets three first-party cookies (_sbv, _sbs and _sbn) and no third-party cookies. Its privacy mode sets no cookies at all and stores no lasting identifier. You can also load the standard script only after the visitor accepts analytics. The details are in what Stickybeak collects, privacy mode and consent and cookie banners.
Whether any of that removes your need for consent in your country is the same legal question as above, and we don't answer it for you. Stickybeak is in early access.
Questions
Is Google Analytics GDPR compliant?
The GDPR applies to how you use Google Analytics, so the tool alone is neither compliant nor non-compliant. Whether your setup complies depends on consent before analytics cookies are set, an accurate privacy notice, keeping personal data out of what you send, and a lawful basis for data going to the US. This guide is not legal advice.
Does Google Analytics use cookies?
Yes. Google Analytics 4 sets two first-party cookies by default: _ga, which distinguishes users, and _ga_ followed by your container ID, which persists session state. Both default to a two-year expiry. If Google Analytics is linked to Google Ads, further cookies are set.
Does Google Analytics use third-party cookies?
Google Analytics 4 stores its client ID in first-party cookies, set on your own domain. Linking it to Google Ads adds more cookies, which Google documents in its advertising cookies reference.
Do I need a cookie banner for Google Analytics?
If your visitors are in the EU or UK, usually yes: analytics cookies generally need consent before they are set, and Google tells its customers to inform users and give them the chance to grant or deny consent. Rules differ by country, so check your regulator or ask a lawyer.
What is Google consent mode?
Consent mode lets Google tags adjust to your visitor's choice. When analytics_storage is denied, no analytics cookies are written. In basic mode the tags do not load until the visitor chooses; in advanced mode they load straight away and send cookieless pings when consent is denied.
Can I use Google Analytics without cookies?
With consent mode set to deny analytics storage, Google Analytics writes no cookies and does not store the client ID. In advanced mode it still sends cookieless pings to Google, so whether that is acceptable without consent is a question for your legal adviser.
Is it legal to use Google Analytics in the EU?
It is not banned. In February 2022 France's CNIL found that a particular site's use of Google Analytics involved unlawful transfers to the US, but the EU-US Data Privacy Framework has since replaced the arrangement that ruling relied on. A challenge to the framework was dismissed in September 2025 and is under appeal.
Does Google Analytics store IP addresses?
Google says that when collecting data, Google Analytics does not log or store IP addresses. It does use them to work out roughly where in the world users are and for the security of the service.
Sources, checked 17 October 2026: Google Analytics Help, Cookies and user identification and Safeguarding your data; Google for Developers, Consent mode; CNIL decision of 10 February 2022 as reported by Clifford Chance and EDRi; General Court ruling of 3 September 2025 as reported by Jones Day; the appeal as reported by WilmerHale and published in the Official Journal. Stickybeak facts: our data collected and cookie banner docs.