Is Google Analytics Legal Without Consent in the EU?

Short answer: no. Google Analytics sets cookies (such as

_ga

) that are not strictly necessary, so under EU rules you need the visitor's consent before it loads. Analytics helps you, not the visitor, so the "strictly necessary" exception doesn't apply.

Why consent is required

The ePrivacy rules require consent before reading or storing anything on a visitor's device unless it is strictly necessary for the service they asked for. Measuring traffic is useful to you, but the page works fine without it. So Google Analytics needs consent first, whether you use GA4 or an older version.

What about the data transfers to the US?

Between 2022 and 2023, several regulators found that using Google Analytics broke the GDPR because personal data was sent to the US without enough protection. That included Austria's and France's regulators and, in Sweden, IMY, which in July 2023 fined Tele2 SEK 12 million and CDON SEK 300,000.

In July 2023 the EU adopted the EU-US Data Privacy Framework, which allows transfers to certified US companies, including Google. That eased the transfer question, but it did not remove the consent requirement for cookies. You still need consent before Google Analytics runs.

How to use Google Analytics legally

1. Load it only after consent. Your cookie banner should block Google Analytics until the visitor accepts statistics cookies.
2. Use Google Consent Mode v2 so Google's tags know what the visitor chose. See What is Google Consent Mode v2?
3. Turn on IP truncation and data minimisation where available, and set a sensible data retention period.
4. Mention Google Analytics in your privacy policy, including that data may be processed in the US.

A note on "cookieless pings": Consent Mode's advanced mode lets Google tags send limited signals without cookies when a visitor declines. Regulators haven't settled whether that needs consent too, so the safest choice is basic mode: no Google tags at all until consent.

Check your site

Run a free cookie scan to see whether Google Analytics loads before visitors consent. Cookiefy blocks it until consent and sends Consent Mode v2 signals automatically. Free for 1 website.

This is general information, not legal advice. For your specific situation, ask a lawyer or your data protection authority.