GA4 processes data in Google's data centres, most of them in the United States. For a UK website that's an international transfer under UK GDPR, and the question of whether it's allowed has a short answer today and a longer one about tomorrow.
How the data bridge works.
Since 12 October 2023 the UK has had the UK Extension to the EU-US Data Privacy Framework, usually called the UK-US data bridge. A US company that's certified under the Framework and has opted into the UK extension can receive personal data from the UK without any further safeguard.
Google is certified and has opted in. So GA4's transfer of UK visitor data to the US is covered.
What that asks of a UK site is modest: a privacy notice that says data goes to Google in the US under the data bridge, a record of that in the processing documentation, and the usual care that GA4 isn't collecting more than it should.
The longer answer.
The data bridge isn't a treaty of its own. It stands on the EU's Framework, which replaced Privacy Shield after the Court of Justice struck that down in 2020. If the EU decision falls, the UK's extension has nothing to stand on, and the UK government would have to decide what to do.
The EU Framework has been challenged. A French member of parliament, Philippe Latombe, asked the EU General Court to annul it; the court dismissed the case on 3 September 2025, finding the US safeguards adequate.
He appealed to the Court of Justice at the end of October 2025, and the appeal is pending, with the United States, Ireland and Microsoft among those supporting the Commission. A judgment is some way off. The Data Privacy Framework after Latombe covers the EU side.
What happens if it falls.
Google's data processing terms say that where the Framework can't be relied on, the standard contractual clauses apply instead. That's the fallback most UK businesses used between 2020 and 2023, and it kept GA4 lawful then with a transfer risk assessment alongside. It would again. The practical cost is paperwork, not a rebuild.
What to do now.
- Say it in the privacy notice. Name Google, say data is processed in the US, and name the data bridge as the basis.
- Collect less. No IP addresses are stored by GA4 anyway, but Google Signals, user-provided data and user IDs are choices. Turn on only what has a purpose.
- Keep the clauses handy. Google's terms already include them; know where they are.
- Consider server-side tagging if you want control over what leaves the browser. It changes what's sent, not where Google processes it, as where your server-side GTM runs explains.
What to check.
- Does the privacy notice mention the transfer and its basis?
- Is Google Signals on, and if so, why?
- Is any personal data being sent in event parameters or page addresses? The GA4 mini audit looks for exactly that.
The guide to GA4 and UK GDPR covers the rest of the rules. Marc Alexander is a GA4 consultant in London.