GDPR Compliance: What GA4 Can and Cannot Do
The question of whether Google Analytics is GDPR-compliant doesn't have a simple yes or no answer. The reality is more nuanced, and understanding it matters if you operate a website targeting European visitors.
The default installation is not GDPR-compliant
Out of the box, GA4 sends user data, including IP addresses and browsing behaviour, to Google's servers in the United States. Since the Schrems II ruling in 2020, such transfers without adequate safeguards have been considered illegal under GDPR.
Between 2022 and 2024, the data protection authorities of France (CNIL), Austria, Italy, the Netherlands, Denmark, Sweden, and Norway all issued rulings finding that standard Google Analytics usage violated GDPR. Several French companies received formal orders to comply.
GA4 can be made compliant, but it takes real effort
Following the adoption of the EU-US Data Privacy Framework in July 2023, the legal basis for transatlantic data transfers was partially restored. GA4 can now be used in compliance with GDPR, but only when all of the following conditions are met:
- Implement Google Consent Mode v2 (mandatory in the EU/EEA since March 2024)
- Obtain explicit, purpose-specific opt-in consent before any GA4 tag fires
- Sign a Data Processing Agreement with Google
- Disable Google Signals and unnecessary tracking features
- Set data retention to the minimum available (2 months)
- Publish a privacy policy that explicitly discloses international data transfers



