Embedding Google Analytics in a GDPR-compliant way

Google Analytics 4 sets cookies or reads identifiers from the device and transmits usage data to Google (USA). This is not a technically necessary process.

In practice this means: the Google Analytics tag may only run after visitors have actively consented. A banner that is merely displayed while GA already loads in the background does not meet the requirement of Section 25(1) TDDDG — what matters is that before consent no script from googletagmanager.com or google-analytics.com is loaded and no identifier is set.

Even with working consent, the transfer to the USA remains a separate checkpoint: since the EU-US Data Privacy Framework (adequacy decision of 10 July 2023), the transfer to Google LLC is in principle safeguarded as long as Google is certified under the framework. The privacy policy should still name the recipient, purpose, legal basis (consent), storage period and the transfer basis.

Anyone using Google Consent Mode v2 should know the difference between “basic” and “advanced”: in advanced mode GA sends anonymous, cookieless pings even before consent. Whether that is compatible with Section 25 TDDDG is assessed differently among data protection experts — basic mode (no communication at all before consent) is the more conservative choice.

Two GA4 settings are particularly relevant for data protection and are set unfavourably by default: “Google Signals” (Admin → Data Settings → Data Collection) links behaviour to signed-in Google accounts for cross-device tracking and advertising audiences — for plain reach measurement it should stay off. And “Event data retention” (Data Settings → Data Retention) is set to 2 months as the data-frugal value; 14 months is the maximum and only justifiable with a documented reason. The “Reset on new activity” option effectively extends storage indefinitely and should be disabled.

Server-side tagging (GA4 via your own Google Tag Manager server container) is not a way around consent. The measurement hit is sent via your own domain, but the client ID is still set or read in the browser, and the data ends up at Google anyway. The benefit lies in better data quality and control over what is passed on — the server container has to enforce the consent check just as the client-side tag does.

Is this a risk?

Accessing the device for analytics purposes is permitted under § 25 (1) TDDDG only with prior consent; the subsequent processing relies on Art. 6 (1)(a) GDPR. Without working consent (tool loads despite rejection, or no banner) there is no legal basis. Supervisory authorities have repeatedly objected to Analytics embeddings without consent.

What you can do

• Use a consent tool that executes the Analytics tag only after active consent (not just displays the banner).
• Run GA4 with IP anonymisation and without Google signals, set data retention to the minimum.
• In the privacy policy, name Google as recipient, the purpose (audience measurement), legal basis (consent), retention period and US transfer.
• Check whether GA loads before the click on “Accept” — developer tools, “Network” tab, in a private window.

Häufige Fragen

Is Google Analytics with IP anonymisation enough without a cookie banner?

No. GA4 does anonymise IP addresses by default, but it still sets identifiers on the device or reads them. That requires consent under Section 25(1) TDDDG, regardless of the IP truncation.

Is Google Analytics 4 unproblematic again after the Data Privacy Framework?

The US transfer is in principle safeguarded via the DPF as long as Google stays certified. The consent requirement for the access to the device continues to apply independently of that.

How do I check whether GA loads before consent?

Open the page in a private window, filter the developer tools' “Network” tab for “google” and load the page without confirming the banner. If requests to google-analytics.com or googletagmanager.com appear, the tag fires too early.

What happens in the event of a violation?

Supervisory authorities can prohibit the processing and impose fines; affected persons can claim damages under Article 82 GDPR. In practice, complaints and official requests come first.

Do I have to conclude a data processing agreement with Google?

Yes. For Google Analytics, the “Google Ads Data Processing Terms” and the Analytics-specific additional terms serve as the DPA under Article 28 GDPR. They have to be accepted in the Google account and documented in the record of processing activities.

How long may I store Google Analytics data?

The data stored at user and event level should be set to the shortest sensible period — in GA4 that is 2 months, at most 14 months with a reason. Aggregated standard reports are unaffected and remain available.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.