Is Google Analytics Personal Data?
Why GA4 data counts as personal data under GDPR, what EU regulators have actually ruled, and how to configure and disclose it.
Yes. Under GDPR Article 4, personal data is any information relating to an identifiable person, and Recital 30 names online identifiers explicitly. An IP address, a client ID stored in a cookie, and a GA4 user pseudo-ID all qualify — 'pseudonymous' is not the same as anonymous, and pseudonymous data is still in scope.
What regulators have decided
Between 2022 and 2023 the Austrian, French, Italian and Danish authorities found specific implementations of Universal Analytics unlawful, chiefly because data was transferred to the US without adequate safeguards at the time. The EU-US Data Privacy Framework, adopted in July 2023, changed that transfer analysis for certified companies including Google, and GA4 also removed raw IP storage. The transfer question is therefore softer than it was, but the consent question never went away.
The durable takeaway: analytics cookies are non-essential, so under the ePrivacy Directive you need prior consent to set them for EU and UK visitors, regardless of where the data lands.
How to configure it defensibly
Load GA4 only after consent, or use Google's consent mode v2 so that tags run in a restricted state until the visitor agrees. Accept Google's data processing terms in the admin panel. Shorten data retention from the default where you do not need the full window. Turn off Google signals if you do not need cross-device reporting, since it changes the character of the processing. And never send an email address, name or order details into GA — that is both a policy breach and a real privacy problem.
What to say in your policy
Name Google Analytics rather than saying 'we use analytics'. State what it collects (pages viewed, approximate location, device and browser, referring source), the basis (consent for the cookies, legitimate interests for aggregate measurement where applicable), the retention window you selected, and how to withdraw consent — including a link back to your cookie settings. If you also fall under the CCPA and run Google's advertising features, that combination can amount to 'sharing' and needs an opt-out link.
The alternative worth knowing about
Cookieless, EU-hosted tools such as Plausible or Fathom, and server-side log analysis, collect materially less and in some configurations avoid the consent question altogether. If your reporting needs are 'which posts get read', that trade is often worth making. If you rely on Google Ads conversion data, it is not.
General information only, not legal advice — regulatory positions on analytics have moved several times and may move again.