Is Google Analytics legal?

Yes. You can use Google Analytics legally in the EU when it’s configured correctly. In practice that means GA4, collecting consent before measurement starts, Consent Mode v2, and data transfers to the US resting on the EU-US Data Privacy Framework. The tool itself isn’t legal or illegal, how you use it is what counts.

Why Google Analytics came under suspicion

In July 2020 the EU Court of Justice struck down the Privacy Shield arrangement (the Schrems II ruling), which data transfers to the US had relied on until then. After that, transfers had no clear legal basis, and US intelligence agencies’ access to European data became the central concern.

In 2022, data protection authorities in Austria and France, among others, found that using the Google Analytics of the time, Universal Analytics, violated the GDPR. The reasoning: cookie identifiers and IP addresses are personal data, and they were transferred to the US without adequate safeguards. That produced headlines along the lines of “Google Analytics is illegal”, and many companies considered switching tools.

What has changed since then

Three big things.

First: in July 2023 the European Commission adopted the EU-US Data Privacy Framework. It’s an adequacy decision under the GDPR, which allows personal data to be transferred to US companies certified under the framework. Google is certified. The framework still stands: the EU General Court dismissed a challenge against it in September 2025, though an appeal is pending at the Court of Justice.

Second: Universal Analytics was retired in 2023 and GA4 took its place. GA4 doesn’t store visitors’ full IP addresses. Anonymization is a built-in default, not a separate setting. And the handling of IP addresses was exactly what the authority decisions centered on.

Third: Consent Mode v2 became mandatory in March 2024 for everyone using Google’s advertising features with EU audiences. It tells Google the visitor’s consent status and adjusts measurement accordingly.

What legal use of Google Analytics requires in 2026

Legality doesn’t come from the tool but from your settings and process. At minimum, get these right:

• Consent before measurement: a consent management platform (CMP) that blocks analytics cookies until the visitor accepts them.
• Consent Mode v2 connected to your CMP, so Google gets accurate consent signals.
• GA4 settings chosen deliberately: keep data retention short, and turn on Google Signals and advertising features only with consent.
• An up-to-date privacy policy: state what you measure, on what basis, and where the data is transferred.

One caveat is worth saying out loud. An appeal against the Data Privacy Framework is pending at the EU Court of Justice, so the legal situation can still change, as it has changed before. This article isn’t legal advice: verify your own situation with a privacy lawyer where needed, especially if you process sensitive data.

If you want to make sure your measurement is both compliant and genuinely useful, take a look at analytics.