Consent for cookies
Google Analytics sets cookies, and the ePrivacy rules and their national versions generally require consent before storing or reading them on a device.
Guide
Is Google Analytics legal in the EU?
The short answer is: it depends on how you use it. This guide explains the main legal issues, consent and international data transfers, and how to reduce the risk.
The short answer
Google Analytics is not banned in the EU, but using it in line with data protection law takes work. You generally need valid visitor consent for its cookies, a transparent privacy policy and a lawful basis for sending data to Google.
This is general information, not legal advice. Rules differ by country and change over time, so check your own situation or ask a data protection professional.
The two main legal issues
International data transfers
Analytics data is processed by Google, a US company. Transfers outside the EU need a valid mechanism. This has been the subject of rulings and regulator opinions.
How the debate developed
After a European court ruling in 2020 invalidated the earlier EU-US Privacy Shield, several data protection authorities, including those in Austria, France and Italy, concluded that specific Google Analytics set-ups were problematic.
The EU-US Data Privacy Framework, adopted in 2023, created a new basis for transfers to certified US companies. Some organisations feel comfortable with it, while others still prefer to avoid US processing altogether.
How to reduce your risk
- Collect valid consent before loading Google Analytics, using a proper consent banner.
- Describe the tool and the data transfer in your privacy policy.
- Review Google's data processing terms and your settings, such as IP handling and retention.
- Document your decisions.
- Or choose an analytics tool that avoids the issues: no cookies, no personal data and EU hosting.
The simpler route: a cookieless alternative
Cookieless, EU-hosted tools such as Noralytic avoid both main issues: they store nothing on the visitor device and do not process personal data. See our Google Analytics alternative comparison.
Frequently asked questions
Is Google Analytics 4 GDPR compliant?
It can be used lawfully with consent and proper configuration, but compliance depends on your set-up and local rules. Many organisations choose a different tool to simplify this.
Is Google Analytics banned in Germany or France?
It is not banned outright. Regulators in several countries have criticised specific set-ups, so organisations need to assess their use carefully.
Do I need a cookie banner for Google Analytics?
In most EU cases yes, because Google Analytics uses cookies and processes personal data.
What is the easiest GDPR-friendly alternative?
A cookieless, EU-hosted analytics tool such as Noralytic, which needs no analytics consent banner in most cases.
Keep reading
Try privacy-friendly analytics for free
Create a free account in seconds, add one line of code and see your first visitors live. No cookies, no credit card.