Google Analytics and the GDPR: what a small business should do.

The short answer

Google Analytics is not unlawful in itself, and it is not compliant on its own either. Whether your use of it meets the GDPR depends on how you set it up. Two questions decide it:

• Can the data go to the US? Since 10 July 2023, yes. The European Commission's adequacy decision for the EU-US Data Privacy Framework covers transfers to US companies certified under it, and Google LLC states that it is certified.
• Do you have consent for the cookies? In the EU, analytics cookies need the visitor's consent before they are set, under the ePrivacy rules. Google Analytics sets cookies, so it must wait for a yes.

So the minimum for a small business with visitors in the EU is a consent banner that holds Google Analytics back until the visitor agrees, with saying no as easy as saying yes, a privacy notice that names Google Analytics, and settings that collect no more than you use.

If all you want is to know how many people visit and which pages they read, a simpler tool without cookies may do the job with less to manage.

What the 2022 rulings were about

In July 2020 the Court of Justice of the EU struck down the Privacy Shield, the previous framework for sending personal data to the US, in the case known as Schrems II. From then on, transfers to US companies needed other safeguards, and regulators questioned whether those were enough given US surveillance law.

In 2022, data protection authorities in Austria, France and Italy each found that a website's use of Google Analytics broke the GDPR's rules on transfers to the US. The Italian decision, announced on 23 June 2022, shows the reasoning. It said visitors' IP addresses, browser details and visit times were sent to the US without adequate protection, that an IP address is personal data even when shortened, and it urged every Italian website operator to check its use of analytics tools.

The rulings were about transfers. None of them said that counting visitors is unlawful.

What changed in 2023

On 10 July 2023 the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework. Personal data can now go from the EU to US companies that have certified under the framework without extra transfer tools, and Google LLC says it has certified.

The framework was challenged in the EU courts. On 3 September 2025 the General Court dismissed the challenge in Latombe v Commission and confirmed that the US offered an adequate level of protection when the decision was adopted. Further challenges remain possible, so it is worth watching, but for now the transfer question has an answer.

Google has changed the product too. It says Google Analytics 4 does not log or store IP addresses from users in the EU, Switzerland or the UK. It uses them only to work out a rough location, on servers in those regions, and then discards them.

Why the cookies still need consent

The transfer question and the cookie question come from different laws. Article 5(3) of the ePrivacy Directive says that storing or reading information on a visitor's device needs their consent, unless it is strictly necessary for a service they asked for. Analytics cookies are not strictly necessary in that sense, so in the EU Google Analytics needs consent before it runs.

Google's own terms point the same way. Its EU user consent policy requires sites using its products to get consent for cookies where the law requires it, and the Google Analytics terms require a privacy policy that discloses your use of Google Analytics and how it collects data. A valid banner:

• Loads nothing that tracks until the visitor answers.
• Offers Reject as plainly as Accept.
• Lets the visitor change their mind later, from a link in the footer.
• Keeps a record of each choice.
• Names the tools and what they do, in plain words.

The UK now differs. After the Data (Use and Access) Act 2025, the ICO's guidance describes an exception for analytics used only to improve your own site, provided you give clear information and a simple, free way to object. It does not cover advertising, and an analytics provider must act only on your behalf. Check whether your setup fits before you rely on it.

The EU may change too. The Digital Omnibus proposals include a consent exemption for some audience measurement, but in late October 2026 the Council had agreed its position and the European Parliament had not, so the current rules still apply.

What consent mode does, and does not do

Consent mode is Google's way of passing the visitor's banner choice to its tags. It does not collect consent for you. You still need a banner, and consent mode reads its answer. It can be set up in two ways:

• In basic mode, Google's tags do not load until the visitor accepts. If they refuse, nothing goes to Google.
• In advanced mode, the tags load straight away with consent set to denied. If the visitor refuses, the tags send Google pings without cookies, which Google uses to model the visits and conversions you cannot see.

The consent types it passes include analytics_storage for analytics cookies, and ad_storage, ad_user_data and ad_personalization for advertising. If you run Google Ads, these signals decide what the advertising side may do with the data.

For a small business, basic mode is the cautious choice: when a visitor says no, nothing is sent. In advanced mode, the pings after a refusal still carry the time, browser details, the page that sent the visitor and a random number for each page view. Whether that is acceptable where you are is a question for your adviser, and European regulators read the cookie rule as covering more than cookies.

Settings to check in Google Analytics

If you keep Google Analytics, tighten it:

• Choose the data retention period: 2 or 14 months on a standard property. It applies to explorations and funnel reports, not to the standard reports, so the shorter setting costs a small business little.
• Turn off Google signals for EU regions unless you use its demographic reports.
• Turn off granular location and device data for EU regions if city-level detail is more than you need.
• Never send names, email addresses or phone numbers to Google Analytics. Its terms forbid it, and a form that puts the visitor's email address into the page address does exactly that.
• Remove tags for tools you no longer use, including old Universal Analytics code.
• Name Google Analytics, and the settings above, in your privacy notice.

Ask whoever set it up for admin access in your own Google account, and keep the property in the business's name. If you are moving to a new site, keep analytics running through the switch so you can compare before and after, as part of the website redesign.

Cookieless analytics: when it is the better choice

If what you want from analytics is visit counts by page and by source, tools that count without cookies can give you that with less to set up and explain. Some count from server logs, others with a small script that stores nothing on the device. Plausible, Fathom, Simple Analytics, and Matomo with cookies turned off, are examples.

Cookieless does not automatically mean consent-free. In October 2024 the European Data Protection Board adopted guidelines that read the cookie rule as covering more than cookies, including scripts that make the browser send information from the device. What lets a simple counter run without a banner is an exemption. France's regulator, for example, exempts audience measurement used only for the site owner, producing anonymous statistics, with no tracking across other sites and data kept for limited periods. Other countries take different views, so check yours.

There is a trade-off. Cookieless tools count visits rather than following one person across days, so returning-visitor figures are estimates, and you lose Google Ads audiences and the link between Analytics and Ads. An online store that spends heavily on Google Ads may still want Google Analytics with consent. A service business that only needs to know which pages bring enquiries usually does not.

How we count visits on our own site

GGSites does not use Google Analytics on ggsites.com. The site counts visits with its own code, without cookies and without storing anything on the visitor's device. Our privacy notice lists what it records for each page view:

• The page, the time and the website that sent the visitor, by domain only.
• Campaign tags in the link, so we can see which ads and posts bring visits, without keeping the ad click ID.
• Device type, browser, operating system, language and screen width.
• A country worked out from the time zone setting. The time zone itself is not stored.

To count unique visitors, the server combines the IP address and browser details with a random value that is replaced every day, and turns them into a short code. The IP address is not stored and the daily value is thrown away, so the code cannot be linked to a person or to other days. Browsers that send Do Not Track or Global Privacy Control are not counted, and the records are kept for 13 months.

Visitors get no cookies by default, as our cookies page explains. If we start measuring Meta ads, the site will ask first, and only a yes loads Meta's pixel. The cost of this approach is that we cannot follow one person's path across several visits.

If you run ads, the picture changes

Advertising tags need consent in the EU for the same cookie reasons, and Google's EU user consent policy also requires consent for using personal data to personalise ads. If you run Google Ads or Meta ads, your banner has to cover both, and your ad tags must wait for the answer just as analytics does.

To see which ads bring enquiries without relying on cookies alone, carry the campaign tags into the enquiry itself. Our guide to tracking leads from Meta ads shows how, and the same method works for Google Ads. A landing page for ads should have its banner, tags and form tested together on a phone before the first campaign.

On the websites we build, a banner appears only when the site uses tracking that needs consent, and that tracking waits for the answer.

What to write about analytics in your privacy notice

Whichever tool you use, the privacy notice should describe it plainly. For a physiotherapy clinic using Google Analytics with consent, a paragraph like this covers the basics:

"With your consent, we use Google Analytics to see which pages are visited and how people find our site. It sets cookies on your device. Google processes this data for us and may transfer it to the US under the EU-US Data Privacy Framework. Detailed data linked to your device is kept for 14 months. You can change your choice at any time with the Cookie settings link at the bottom of every page."

Change the details to match your setup: the retention period you chose, whether Google signals are on and the name of the link that reopens the banner. Our guide to what a privacy policy needs covers the rest of the notice.

A checklist for a small business

• Decide what you need to know from analytics, and whether Google Analytics is the right tool for it.
• If you keep it: a banner that holds it back until consent, basic consent mode, tightened settings and admin access in your own account.
• If you switch: choose a cookieless tool, read its terms and where it stores data, and ask your adviser whether your country's exemption covers it.
• Remove old tags and tools you no longer look at.
• Update the privacy notice: which tool, what it collects, the lawful basis, where the data goes and for how long.
• Check the banner on a phone: it must not cover the page's main button, and Reject must be as easy as Accept.
• Look again when the EU's Digital Omnibus changes are adopted, or if the Data Privacy Framework is struck down.

Our GDPR checklist covers the rest of the site, from contact forms to access requests.