Quick answer: Treat Google Analytics as personal data processing when client IDs and online identifiers can relate to individuals. Before 25 May 2018, update your privacy notice, decide how you obtain consent or other lawful bases for analytics cookies where required, review data retention and sharing settings in your Analytics account, and document the decisions. You do not need to delete Analytics to be thoughtful; you do need clarity and controls.
This guide is practical preparation for site owners using Universal Analytics, gtag.js or analytics.js, and Google Tag Manager. It is not legal advice. Laws and guidance differ by country; if you process EU resident data, talk to a qualified lawyer or DPO for your situation.
What changes on 25 May 2018
The EU General Data Protection Regulation becomes enforceable. It strengthens rules on transparency, lawful bases for processing, data subject rights, and vendor (processor) relationships. Many organisations outside the EU still need to care if they offer goods or services to people in the EU or monitor their behaviour.
Analytics cookies and identifiers commonly fall into that conversation. Parallel ePrivacy cookie rules already expected consent for non-essential cookies in many EU contexts; GDPR raises the stakes on documentation and user rights.
Personal data in Google Analytics
Google Analytics typically stores online identifiers (client IDs), approximate location, device info, and the pages people view. Combined with other data, that can be personal data under GDPR’s broad definition. Features such as User-ID, remarketing, demographics and interest reports, and linking to AdWords or CRM systems increase sensitivity.
If you never send clear names or emails to Analytics, you are not automatically “out of scope.” Identifiers alone can still count.
Consent and cookie notices (practical stance)
Common steps organisations are taking ahead of May:
- Inventory tags on the site (Analytics, Ads pixels, heatmaps, embeds).
- Classify which are strictly necessary vs which need consent under your counsel’s guidance.
- Update the privacy policy to name Google Analytics, purposes, retention and rights.
- Implement a consent mechanism that blocks non-essential scripts until accepted, where that is your chosen approach.
- Record consent version and timestamp when you rely on consent.
Avoid pre-ticked boxes and vague “by using this site you agree” banners as your only control if you target EU users; regulators have been clear that consent must be specific and informed.
Google Tag Manager helps you fire Analytics tags only after a consent event, but you must design that logic deliberately. Do not assume a banner alone equals compliance.
Google Analytics settings to review now
Data processing / processor terms
Google provides Data Processing terms for Analytics. Review acceptance in your Analytics admin account settings so processor obligations are in place.
Data retention
Analytics has been rolling out controls that let admins choose how long user-level and event-level data is retained before automatic deletion from Analytics servers (with options that vary by property settings). Check your property’s current retention controls in Admin and pick a period that matches your stated purposes. Shorter retention can reduce risk; keep it long enough for the reporting you truly need. Document the choice in your privacy notice when you describe Analytics.
If your Admin UI does not yet show a control you read about in a blog post, do not invent settings. Use what is available, note the date you checked, and revisit as Google ships updates through spring.
IP anonymization
Enable IP anonymization (anonymizeIp) so full IP addresses are masked before storage where that feature applies. It is a widely recommended hardening step for EU-oriented properties; it is not a complete GDPR solution by itself.
Sharing settings
In Account settings, review data sharing with Google products and support. Disable what you do not need.
Advertising features and remarketing
Remarketing and advertising reporting features have extra implications. Turn off what you do not use. If you use them, make sure your consent and policies cover that purpose.
User-ID and CRM joins
Joining Analytics to known identities increases obligations. Limit access, minimise data and be explicit in notices.
What about deleting Analytics?
Some organisations pause Analytics for EU traffic; others keep it with stronger consent and configuration. Deletion without a plan can blind your conversion rate optimization and reporting. A measured approach: fix legal basis and transparency first, minimise data, then decide product choices. Server-side logs are not automatically “safer” if they still identify people without a lawful basis.
Coordinating with other tools
Hotjar-style session tools, live chat, AdWords conversion tags and Facebook pixels need the same inventory treatment. See related setup hygiene in Google Analytics setup, AdWords conversion tracking and cross-domain tracking (consent must cover each domain you measure).
Internal checklist before May
| Area | Action |
|---|---|
| Legal | Confirm roles (controller/processor), update policies, vendor list |
| Analytics Admin | Processor terms, retention, sharing, anonymizeIp |
| Tagging | Consent gate via GTM or equivalent where required |
| Rights | Process for access/erasure requests that touch Analytics |
| Training | Marketing team stops adding random tags without review |
| Evidence | Keep screenshots and dated notes of settings |
Things this article deliberately avoids
- Claiming a single cookie banner product makes you “GDPR compliant”
- Invented fines or scare statistics
- Describing Google Analytics 4 or Consent Mode (they are not part of the current mainstream stack)
- Pretending US-only sites never need to think about EU visitors
Working with agencies and freelancers
Give contractors least-privilege access to Analytics and GTM. When a project ends, revoke users. Add a clause in statements of work that new tags require approval. Many “mystery pixels” appear because a media buyer added them during a campaign and nobody removed them afterward. GDPR preparation is a good moment for a tag amnesty: list every tag, keep what you need, delete the rest.
If an agency operates Analytics on your behalf, clarify controller/processor roles in the contract and ensure they follow your retention and consent choices rather than their default client template.
Cross-border data transfers
Google Analytics data may be processed in the United States and other countries. Review Google’s documentation on international transfers and the safeguards they describe, and reflect transfer realities in your privacy notice. Legal mechanisms evolve; your counsel should confirm what is acceptable for your organisation as May approaches. Do not ignore transfers because “everyone uses Analytics.”
FAQ
Is Google Analytics illegal under GDPR?
No blanket ban exists as of this writing. Lawful use depends on configuration, lawful basis, transparency and how you combine data. Watch regulator guidance as it evolves.
Do we need consent for Analytics cookies?
Often yes under ePrivacy-style rules for non-essential cookies in the EU, but your counsel should confirm for your model. Legitimate interests analyses are sometimes discussed; they require real balancing and easy objection, not a slogan.
Will retention settings remove data from our BigQuery exports?
Exports and other linked products may follow different rules. Trace each pipeline.
What if we only use Analytics for aggregated dashboards?
You still collect identifiers at hit time. Aggregation in reporting does not erase collection obligations.
Next step
Use the weeks before 25 May to inventory tags, tighten Analytics settings and align notices with reality. If you want measurement that stays useful after the legal review, our know what’s working work covers Analytics, Tag Manager and reporting hygiene together.
