The question behind the question
"Is Google Analytics GDPR compliant?" is usually asked by someone who needs to give a yes-or-no answer to a client, a legal team or a procurement form. The honest answer is that it depends on your configuration, your legal basis and your appetite for regulatory risk — which is exactly the answer nobody wants.
This article lays out what is actually known, so you can make the call yourself. It is general information, not legal advice: for a binding answer, ask a qualified data protection lawyer in your jurisdiction.
What happened
Following the Schrems II ruling in 2020, which invalidated the Privacy Shield framework, several European data protection authorities examined the use of Google Analytics on European websites. Between 2022 and 2023, authorities in Austria, France and Italy, among others, found specific implementations unlawful, primarily on the grounds of personal data transfers to the United States without sufficient supplementary safeguards.
A central point in those decisions was that identifiers such as IP addresses and analytics cookie IDs constitute personal data under the GDPR, even without a name attached.
What changed
In July 2023 the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework, which provides a legal basis for transfers to certified US companies. This materially changed the picture: transfers to participating organisations now have an adequacy basis rather than relying solely on contractual clauses.
Two caveats matter. First, the framework has been challenged, and previous frameworks have been struck down twice. Second, adequacy addresses the transfer question — it does not by itself resolve questions about consent, data minimisation and the lawful basis for the processing.
What you have to get right regardless
Even setting transfers aside, using any analytics tool in the EU requires:
- A lawful basis. For non-essential cookies and similar technologies, the ePrivacy rules generally require consent, obtained before the tracker fires.
- Genuine consent. Freely given, specific, informed, and as easy to refuse as to accept. A banner with a prominent "Accept" and a buried "Reject" does not meet that bar, and enforcement on this point has been active.
- Transparency. Your privacy policy must say what is collected, why, on what basis, for how long and with whom it is shared.
- Data subject rights. You must be able to respond to access and erasure requests.
- A processor agreement with the analytics provider.
Hardening a Google Analytics setup
If you stay with Google Analytics, the measures commonly recommended are: enable IP anonymisation, disable data sharing with Google products and advertising features, shorten data retention to the minimum useful, deploy behind a compliant consent management platform that blocks the tag until consent is given, and document the assessment you carried out.
That is a real amount of work, and it produces a defensible position rather than a certainty.
The alternative route
The reason many European sites moved to privacy-first analytics is not that Google Analytics is definitively unlawful — it is that the question disappears. A tool that stores no personal data, sets no cookies and keeps data in the EU does not raise a transfer question, does not need a consent banner for analytics, and can be described to a client in one sentence.
For a site where analytics is a modest input to decisions rather than the engine of a large ad budget, removing the question entirely is often worth more than the features being given up.
A practical checklist
- Do you know exactly which trackers fire on your site, and when?
- Does anything fire before consent?
- Is refusing consent as easy as accepting?
- Does your privacy policy match what actually happens?
- Do you have a processor agreement in place?
- Could you answer an access request about a visitor tomorrow?
If several of those are uncomfortable, the tool is not your first problem — the setup is.