Google Analytics GDPR Compliance: Where It Stands in 2026
Short answer: you can use Google Analytics under GDPR in 2026, but not by just pasting the tag. You need consent for its cookies in the EU and a privacy policy that describes it. You also need a legal basis for sending data to Google in the United States, which today rests on the EU-US Data Privacy Framework. That framework is still being challenged in court.
This guide walks through what regulators decided, what changed since, and what a small site should do. It’s a summary for founders, not legal advice. If your business depends on the answer, ask a lawyer in your country.
Why did regulators say Google Analytics broke GDPR?
In August 2020, the privacy group noyb filed 101 complaints with data protection authorities across the European Economic Area about websites sending visitor data to Google and Facebook in the US.
The first decisions came in early 2022:
- Austria (January 2022). The Austrian data protection authority (DSB) ruled on a complaint against a health website. It found that the site breached Article 44 of GDPR by transferring personal data to Google in the US without adequate protection. It also treated the identifiers, IP addresses and browser data that Google Analytics collected as personal data.
- France (February 2022). The CNIL reached the same conclusion, said Google’s additional measures were not enough to keep the data out of reach of US intelligence services, and ordered the site to comply, if necessary by stopping its use of Google Analytics.
Other authorities, including Italy’s, issued similar decisions in 2022. The core problem was not the analytics itself. It was the transfer of personal data to a country the EU’s top court had found lacking in protection in its 2020 Schrems II ruling.
What changed with the EU-US Data Privacy Framework?
On 10 July 2023, the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework. US companies that certify under it can receive personal data from the EU without extra transfer tools, much like the earlier Privacy Shield.
Two later events matter:
- September 2025. The EU General Court dismissed a challenge to the framework brought by French MP Philippe Latombe (case T-553/23), confirming the adequacy decision.
- October 2025. Latombe appealed to the Court of Justice (case C-703/25 P). As of this writing the appeal is pending.
So the transfer question has a legal basis today, but it depends on a framework that the EU’s highest court has not yet ruled on. Its two predecessors, Safe Harbor and Privacy Shield, were both struck down by that court.
| Date | Event | Effect on Google Analytics |
|---|---|---|
| July 2020 | Schrems II invalidates Privacy Shield | Transfers to the US lose their main basis |
| Jan to Feb 2022 | Austrian DSB and CNIL decisions | Specific sites found in breach |
| July 2023 | Data Privacy Framework adopted | Transfers to certified US firms allowed |
| Sept 2025 | General Court upholds the framework | Basis confirmed for now |
| Oct 2025 | Appeal to the Court of Justice | Outcome pending |
Does GA4 fix the IP address problem?
Partly. Google says Google Analytics 4 does not log or store IP addresses, and that for EU traffic the IP is used only to derive location on EU servers, then discarded. That removes one piece of personal data from what Google keeps.
It doesn’t remove the others. GA4 still sets cookies with client identifiers, and those identifiers, combined with browser data, can still count as personal data. The cookie itself also triggers the ePrivacy rule, which is separate from GDPR.
Do you need consent for Google Analytics?
In the EU and UK, yes in practice. The ePrivacy rule requires consent before storing information on a visitor’s device unless it’s strictly necessary or covered by a specific exemption. Some regulators, such as the CNIL, exempt audience measurement trackers that meet strict conditions, but Google Analytics in its standard setup generally doesn’t meet them because data goes to a third party that can use it for its own purposes.
That’s why most EU sites running Google Analytics show a banner. Google’s consent mode lets the tag send limited cookieless pings when a visitor declines, and Google models the gap. Your reports then mix measured and estimated data.
What should a small site do?
- Decide if you need Google Analytics at all. If you run Google Ads, the integration is valuable. If you don’t, a lighter tool may cover what you read. See is Google Analytics free.
- If you keep it: show a consent banner, load the tag only after consent, describe it in your privacy policy, and check that your Google account settings match what the policy says.
- If you switch: pick a tool that stores no IP addresses and no cross-site identifiers. Our Google Analytics alternative guide compares options, and what is cookieless tracking explains the methods and their legal limits.
A tool hosted outside the US avoids the transfer debate entirely. A tool that stores no personal data narrows what GDPR covers. Indiehacker Studio does the second: no cookies, no stored IP addresses, a random id per site that is never shared with other sites.
FAQ
Is Google Analytics illegal in the EU?
No blanket ban exists. Regulators found specific sites in breach in 2022, based on transfers that lacked a legal basis at the time. Today transfers rely on the Data Privacy Framework, which is under appeal.
Is GA4 GDPR compliant?
GA4 includes privacy features like not storing IP addresses, but compliance depends on how you configure and disclose it, and on consent for its cookies. Compliance is a property of your setup: the tool, its settings, your consent flow and your privacy policy.
Do I need a cookie banner for Google Analytics?
In the EU and UK, generally yes, because it sets cookies that aren’t strictly necessary.
What happens if the Court of Justice strikes down the framework?
Transfers to US companies would again need other safeguards, as after Schrems II. Sites using US-based analytics would face the same questions as in 2022.
A simpler path
If you’d rather keep analytics light, Indiehacker Studio measures visitors without cookies or stored IP addresses and adds chat and bug reports to the same script. Read how we handle data on our privacy policy, then start free.