Embedding Google Analytics in a GDPR-compliant way

Google Analytics 4 sets cookies or reads identifiers from the device and transmits usage data to Google (USA). This is not a technically necessary process.

Is this a risk?

Accessing the device for analytics purposes is permitted under § 25 (1) TDDDG only with prior consent; the subsequent processing relies on Art. 6 (1)(a) GDPR. Without working consent (tool loads despite rejection, or no banner) there is no legal basis. Supervisory authorities have repeatedly objected to Analytics embeddings without consent.

What you can do

• Use a consent tool that executes the Analytics tag only after active consent (not just displays the banner).
• Run GA4 with IP anonymisation and without Google signals, set data retention to the minimum.
• In the privacy policy, name Google as recipient, the purpose (audience measurement), legal basis (consent), retention period and US transfer.
• Check whether GA loads before the click on “Accept” — developer tools, “Network” tab, in a private window.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.