Is Google Analytics compliant with the GDPR?

Google Analytics 4 can be used legally in the EU, but it comes with obligations that cookieless tools avoid. This page summarises the situation in October 2026. It is general information, not legal advice.

Consent is required

GA4 sets cookies (_ga and _ga_<id>, kept up to two years) to recognise returning visitors. Under EU rules that needs the visitor's prior consent, and Google's own EU user consent policy requires sites to obtain it. In practice: a cookie banner, and GA4 only loads after the visitor accepts.

Transfers to the United States

Google LLC is a US company. Between 2020 and 2023, several EU authorities found that using Google Analytics breached the GDPR because data reached the US without adequate protection. In July 2023 the EU adopted the EU-US Data Privacy Framework, and Google is certified under it, which makes the transfer lawful again.

The framework is not settled. A challenge against it (case T-553/23, Latombe) was dismissed by the EU General Court in September 2025 and is now under appeal at the Court of Justice. If the framework falls, as its predecessors did in 2015 and 2020, the question comes back.

Data retention

GA4 keeps event-level data for 2 or 14 months, depending on your setting. Aggregated standard reports are not affected.

What this means for you

• Keep GA4 behind consent and accept that visitors who decline are missing from your reports.
• Document the transfer to Google in your privacy policy and records.
• Watch the Latombe appeal.

Or use analytics that sets no cookies, keeps no personal data and stores everything in the EU, so none of the above applies. That is what Statsdot does; see Statsdot vs Google Analytics.