GDPR and Google Analytics: Is GA4 Legal to Use in the EU?

For a couple of years, this was one of the most unsettled questions in EU privacy compliance: several data protection authorities, including in Austria, France, and Italy, found that Google Analytics, as commonly implemented, violated GDPR by transferring EU personal data to the US without adequate safeguards, following the Schrems II ruling that invalidated the previous transfer framework. The practical answer to “is GA4 legal in the EU” has genuinely changed since then, though it isn’t fully settled either.

Why this was a problem in the first place

The underlying issue wasn’t really about analytics itself, it was about where the data goes. Standard Google Analytics implementations send data, including IP addresses and identifiers, to Google’s US infrastructure. After Schrems II invalidated the EU-US Privacy Shield in 2020, regulators had to evaluate whether the fallback mechanism, Standard Contractual Clauses, actually provided adequate protection given US surveillance law. Several found it didn’t, for Google Analytics specifically. We cover this transfer mechanism problem in more depth in our piece on Schrems II and the SCC problem.

What changed: the EU-US Data Privacy Framework

In July 2023, the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework (DPF), a new legal mechanism the Commission determined provides adequate protection for data transferred to certified US companies. Google is certified under the DPF, which meaningfully changed the legal footing for GA4: transfers to Google’s US infrastructure now have a valid legal basis that didn’t exist during the period when several EU regulators issued their earlier rulings.

So is GA4 legal now?

For most businesses, using GA4 with a properly configured consent setup is on much more solid legal footing than it was in 2022. That said, two things are worth keeping in mind:

• The DPF doesn’t eliminate your other GDPR obligations. You still need a valid lawful basis (almost always consent, not legitimate interest, see our related piece on Google Analytics and CIPA for a different but overlapping risk angle), still need to disclose it in your privacy policy, and still need to gate it behind proper consent for EU visitors.
• Legal challenges to the DPF are expected. Privacy advocacy groups have signaled they may challenge the framework’s adequacy, similar to how Privacy Shield was challenged and struck down. If a future ruling invalidates or narrows the DPF, the underlying transfer question could reopen. This is genuinely a “watch this space” situation, not a permanently closed one.

What to actually do

1. Confirm GA4 is gated behind consent for EU/EEA visitors, not firing by default. This part of the requirement hasn’t changed and doesn’t depend on the DPF at all.
2. Check your IP anonymization and data retention settings, GA4 has settings that reduce the granularity of what’s collected and how long it’s kept, which is good practice independent of the transfer question.
3. Disclose Google Analytics and the DPF-based transfer mechanism in your privacy policy, so your disclosure matches your actual configuration.
4. Stay aware that this could change again. If you’re in a higher-risk sector or jurisdiction that was particularly aggressive about Universal Analytics rulings, keep an eye on DPF-related news rather than treating this as permanently resolved.

This guide reflects the legal landscape as of publication and is not legal advice. The EU-US Data Privacy Framework’s status could change with future legal challenges. Consult a privacy attorney for current guidance on your specific analytics setup.