Google Analytics and GDPR: Is Your Tracking Legal?

Updated August 2026. Google Analytics is on millions of websites — and it is one of the most common sources of GDPR problems for small businesses. The short answer to "is Google Analytics GDPR-compliant?" is: it can be, but only if visitors consent before the script loads. Most sites get this wrong.

The rule: consent comes first

Two pieces of EU law apply:

GDPR Art. 6 — processing personal data (and IP addresses are personal data) requires a legal basis. For marketing analytics, that basis is almost always consent.
ePrivacy Directive (the "cookie law") — storing or accessing information on a user's device requires prior consent, except strictly necessary cookies. Analytics cookies are not strictly necessary.

Together they mean: the GA tag must not fire until the visitor clicks "Accept." A cookie banner that appears at the same time as the tracking script — or after it — does not count. The data was already collected.

What happens when you get it wrong

This is not theoretical:

Case	Issue	Outcome
Austrian DSB rulings (2021–)	GA transfers IP data to the US without adequate safeguards	Dozens of sites found non-compliant
Danish Datatilsynet (2024–2026 practice)	Analytics tags firing before consent	Orders to block scripts until consent
French CNIL guidance	Same — consent required before measurement cookies	Fines up to €20M / 4% turnover under GDPR

Regulators have focused on large sites first, but enforcement against small and mid-sized businesses is growing — and a competitor complaint is enough to trigger an audit of any site.

How to check your own site (2 minutes)

Open your homepage in an incognito window with DevTools open (Network tab). If requests to google-analytics.com, googletagmanager.com/gtm.js, connect.facebook.net, or similar fire before you accept cookies — your tracking loads without consent.
Check your consent platform. A CMP like Cookiebot, Usercentrics, CookieYes or Complianz must be present AND configured to actually block these tags until consent. Many CMPs are installed but set to "notify only."
Run a free automated check. Our scanner detects 12 common trackers and whether a working consent platform is present — no installation needed.

Check any site free

Enter a URL and see which trackers load and whether consent is handled — works on WordPress, Shopify, Wix, Squarespace, Webflow, custom HTML, anything.

Run the free scan →

If you fail: how to fix it

Install a CMP that blocks by default. Configure it so analytics/marketing tags are held back until explicit consent. In Google Tag Manager, use Consent Mode v2 with default state denied.
Set Consent Mode v2 defaults correctly. This code goes before every tag:
```
<script>
gtag('consent', 'default', {
  'ad_storage': 'denied',
  'analytics_storage': 'denied'
});
</script>
```
Only after the visitor accepts do you call gtag('consent', 'update', {...'granted'}).
Consider consent-less alternatives. Tools like Plausible or Fathom use no cookies and don't collect personal data, so they need no consent banner. Matomo can be configured cookieless too.
Anonymize where possible. Enable IP anonymization and keep data-retention periods short (14 months max is a defensible default).

Common mistakes we see in scans

Banner exists, but GTM loads anyway — the CMP is installed but not connected to the tags.
"Necessary only" still fires Meta Pixel — misconfigured tag categories.
Consent works on desktop but not mobile — responsive bugs in the banner mean mobile visitors never see it while trackers run.
No consent platform at all — the most serious finding, and the one our scan flags hardest.

FAQ

Is Google Analytics banned in Europe?

No. But loading it without prior consent violates GDPR and ePrivacy. With a proper CMP and Consent Mode v2, it is legal.

Do I need consent for anonymous analytics?

Cookieless tools that don't store device identifiers generally fall outside the ePrivacy consent requirement. Standard Google Analytics is not anonymous.

Does this apply outside the EU?

If your site serves visitors from the EU — even from a US company — GDPR applies to those visitors. Location-based consent gating is possible but adds complexity; applying consent EU-wide is simpler and safer.

How do I prove compliance?

Keep consent logs (your CMP does this), document your configuration, and re-scan regularly. EUComply Pro includes monitoring that alerts you when a new tracker appears on your site without consent coverage.

Scan your site now — free, no sign-up