Is Google Analytics illegal in the EU?

Not blanket-illegal, but several EU data protection authorities have found specific GA deployments non-compliant, chiefly over transferring EU visitors' personal data to the US. Legality depends on configuration, consent and current transfer frameworks. Many EU sites avoid the uncertainty by switching to a cookieless tool that stores no personal data.

Can Google Analytics be made GDPR compliant?

It can be configured toward compliance (with valid consent, Consent Mode, IP and data-residency settings, and proper documentation) but it is not compliant by default and remains your responsibility to get right. A cookieless alternative removes the consent and transfer questions rather than answering them.

Do I need a cookie banner for Google Analytics?

In most cases in the EU, yes: GA4 sets cookies and processes identifying data, so it generally requires consent before it runs. Cookieless analytics tools store no cookie and need no banner, which is the main practical reason teams switch.

Which analytics tools are GDPR compliant without a banner?

Cookieless tools that store no personal data (Open Analytics, Plausible, Fathom, Umami and Simple Analytics) need no consent banner because they fall outside the consent requirement. Compliance still depends on the specific tool's data handling, so confirm it does not fingerprint or store identifiers.

BlogCompliance

Is Google Analytics GDPR compliant?

Abbas AgaAugust 19, 2026 · 2 min read

TL;DR:
Google Analytics can be run toward GDPR compliance, but not by default: GA4 sets cookies, so it generally requires consent, and several European data protection authorities have raised concerns about personal data being transferred to the US. A cookieless analytics tool that stores no personal data avoids both the consent requirement and the transfer question altogether.

"Is Google Analytics GDPR compliant?" does not have a clean yes or no, because compliance depends on how it is configured, whether you collect valid consent, and how data transfers are handled. What is clear is that GA is not compliant out of the box, and that avoiding the question entirely is why many EU sites moved to cookieless tools.

The two issues regulators raised

Consent: GA4 sets cookies and processes data that can identify a visitor, so under the EU's ePrivacy rules and GDPR it generally needs freely given, informed consent, a banner. Visitors who decline drop out of your numbers.
Data transfers: several European data protection authorities have found that sending EU visitors' personal data to a US-based service raised questions under GDPR's international-transfer rules. Google has since added EU-based data handling and consent controls, but the configuration is on you to get right.

What Google changed

GA4 introduced Consent Mode, IP handling changes, and data-residency options intended to address these concerns, and the EU–US Data Privacy Framework changed the legal backdrop for transfers. None of that makes GA4 compliant automatically, it still sets cookies, still needs consent in most cases, and still requires you to configure and document it correctly. Compliance is a project, not a checkbox.

How cookieless analytics avoids the question

A tool that stores no cookie and collects no personal data does not trigger the consent requirement and has no personal data to transfer, so the two issues above simply do not arise. That is the appeal of cookieless analytics for EU sites: not a better answer to the GDPR question, but no longer having to answer it. Open Analytics is cookieless by default and processes no personal data.

This is general information, not legal advice. Your obligations depend on your jurisdiction, your configuration and your data. Check with a qualified advisor before relying on any tool's compliance for your specific case.

Open Analytics is cookieless by default: no banner, no personal data, no transfer question.

See how it works

Frequently asked questions

Is Google Analytics illegal in the EU?: Not blanket-illegal, but several EU data protection authorities have found specific GA deployments non-compliant, chiefly over transferring EU visitors' personal data to the US. Legality depends on configuration, consent and current transfer frameworks. Many EU sites avoid the uncertainty by switching to a cookieless tool that stores no personal data.
Can Google Analytics be made GDPR compliant?: It can be configured toward compliance (with valid consent, Consent Mode, IP and data-residency settings, and proper documentation) but it is not compliant by default and remains your responsibility to get right. A cookieless alternative removes the consent and transfer questions rather than answering them.
Do I need a cookie banner for Google Analytics?: In most cases in the EU, yes: GA4 sets cookies and processes identifying data, so it generally requires consent before it runs. Cookieless analytics tools store no cookie and need no banner, which is the main practical reason teams switch.
Which analytics tools are GDPR compliant without a banner?: Cookieless tools that store no personal data (Open Analytics, Plausible, Fathom, Umami and Simple Analytics) need no consent banner because they fall outside the consent requirement. Compliance still depends on the specific tool's data handling, so confirm it does not fingerprint or store identifiers.