By Marc Alexander

Google Analytics 4 collects personal data, which Google's own terms confirm. That puts it within UK GDPR and PECR.

The ICO is checking. In January 2025 it assessed the top 200 UK websites for cookie compliance and found significant concerns with 134 of them. It then extended its checks to the top 1,000, and in December 2025 said 979 of them now pass.

This guide covers what GA4 collects, what the law requires, where consent mode falls short, and what a compliant setup looks like. It explains the rules; it isn't legal advice for your organisation.

Based on guidance from the ICO, 2025 to 2026.

Download the guide (PDF)

What data does GA4 collect?

GA4 collects cookie identifiers (the _ga and _ga_<ID> cookies that recognise users across sessions), IP addresses used for location, device and browser details, and behaviour data such as page views, clicks, scrolls and key events.

With Google Signals or User ID on, it can add demographic estimates and link activity across devices.

This is personal data under UK GDPR. That isn't a grey area.

UK GDPR governs the processing of personal data and requires a lawful basis for all of it. It applies to any organisation processing the personal data of people in the UK.

PECR (the Privacy and Electronic Communications Regulations) governs cookies and similar tracking technologies. It applies whether or not the data is personal, and to anyone running a website used by people in the UK.

The Data (Use and Access) Act 2025 amends both, including PECR. It adds narrow exceptions from cookie consent, including one for some analytics used for "statistical purposes". The changes have applied since 5 February 2026, and the ICO's final guidance followed on 29 April 2026. What changed in 2026 sets out the conditions.

A typical marketing GA4 setup is unlikely to fit that exception, so this guide assumes consent is needed. Only rely on it if your data protection lead confirms your configuration qualifies, and document why. The site's article on GA4 after the Data (Use and Access) Act covers the changes in more detail.

The point that catches most people out: PECR takes precedence over UK GDPR where both apply. Where PECR requires consent to run GA4, consent is also your lawful basis under UK GDPR. You can't use legitimate interests as a workaround for analytics cookies.

Consent for GA4 must be:

  • Freely given: a genuine choice, with no penalty for saying no
  • Specific: separate consent for analytics, advertising and personalisation. Bundled consent isn't valid.
  • Informed: users understand what they're agreeing to before they agree
  • Unambiguous: a clear positive action, such as a tick or a click
  • Withdrawable: as easy to withdraw as it was to give

These don't count as consent: pre-ticked boxes, implied consent ("by continuing to browse you agree…"), consent with no granular options, and cookie walls that block access unless you accept.

GA4 must not fire before the user has responded to the consent banner, while the banner is showing, after the user rejects, or if the user ignores the banner and carries on browsing. It may only fire after a clear, positive indication of consent.

In September 2024 the ICO formally reprimanded Sky Betting and Gaming for setting cookies before consent was given.

Since March 2024 Google has needed Consent Mode v2 signals for its advertising features, such as remarketing and audiences, for visitors in the UK, EU and EEA. It has two modes.

In Basic mode, tags only fire after consent is granted. Set up correctly, this is compliant.

In Advanced mode, tags load but run in a restricted state, sending "cookieless pings" to Google before or without consent. This is where many implementations fall down.

Advanced Consent Mode doesn't give you a lawful basis for tracking people who haven't consented. The consent rules cover storage and access technologies in general, not just traditional cookies, whether or not the data is personal.

So treat any signal sent without consent, including cookieless pings, before a choice or after a rejection, as a compliance risk.

If GA4's consent requirements are the sticking point, the comparison of GA4 alternatives looks at tools built around data ownership and consent.

Consent Mode doesn't replace consent, and it needs a correctly configured consent management platform behind it.

Google as your processor.

When you use GA4, you're the data controller and Google acts as your processor.

Under UK GDPR Article 28 you need a Data Processing Agreement with Google before using GA4. You accept it in Google Analytics under Admin → Account Settings, by accepting the data processing terms.

It's necessary, not sufficient.

GA4 privacy settings to configure.

Data retention: set it to the shortest period you need. The default is two months and the maximum is 14 months. That's data minimisation.

Google Signals: off by default. Keep it off unless you have explicit consent: it turns on cross-device tracking and demographics.

User ID: only for logged-in users who have explicitly consented. It links activity across devices, which makes the data more sensitive.

Data sharing settings: don't share data with other Google products without clear consent and a real business need.

A basic cookie banner isn't enough. Your CMP must:

  • Block GA4 and all non-essential scripts until a consent signal is received
  • Support Consent Mode v2 and pass the four consent parameters in real time
  • Have a "Reject all" button at least as prominent and easy to use as "Accept all"
  • Offer granular categories, with analytics and advertising separate
  • Keep an audit trail of consent records
  • Be IAB TCF v2.2 compliant if you run advertising services

Your privacy policy must say that you use Google Analytics 4, what it collects, the lawful basis (consent), how long data is kept, details of international data transfers, whether Google Signals or advertising features are on, how users can withdraw consent, and how they can exercise their data subject rights.

Your cookie policy must list every cookie GA4 sets, with the purpose and duration of each, and name Google as a third-party recipient.

Consent has to be informed, so a privacy policy that's hard to find or hard to understand can't be relied on to obtain it.

Data subject rights and GA4.

As controller, you handle users' rights over data processed in GA4.

  • Access: the User explorer exploration can help you find a user's data
  • Erasure: GA4 has a data deletion request tool under Admin → Data deletion requests
  • Objection: your CMP must make opting out simple at any time
  • Portability: users also have the right to data portability

You have one calendar month to respond to a request.

What goes wrong in practice.

The GA4 failures that come up most often:

  • GA4 firing before the banner has been answered
  • No "Reject all" button, or one harder to find than "Accept all"
  • Pre-ticked boxes or sliders set to "on"
  • Relying on Advanced Consent Mode, whose cookieless pings send data before consent
  • Treating analytics cookies as "strictly necessary", or as functional, to avoid asking for consent
  • No consent logs, so the organisation can't show compliance
  • No Data Processing Agreement with Google
  • A privacy policy that doesn't mention GA4 or international data transfers

Compliance checklist.

Legal and documentation

  • Accept Google's data processing terms in GA4 Admin
  • Update your privacy policy to cover GA4, data transfers and consent as your lawful basis
  • Create or update your cookie policy listing every GA4 cookie
  • Document consent as your lawful basis

Technical configuration

  • Use a CMP that supports Consent Mode v2
  • Set the default consent state to denied
  • Make sure GA4 is fully blocked until a consent signal arrives
  • Set up granular consent categories
  • Add a clearly visible "Reject all" option
  • Turn on consent logging and audit trails
  • Keep Google Signals off unless you have consent
  • Set data retention to the shortest period you need
  • Keep User ID off unless users have explicitly consented

Testing

  • Use the browser's developer tools to confirm no GA4 requests fire before consent
  • Test rejection: confirm GA4 stays blocked afterwards
  • Test withdrawal: confirm GA4 stops if consent is withdrawn mid-session

The risk of getting it wrong.

The maximum fine under UK GDPR is £17.5 million or 4% of global annual turnover, whichever is higher. PECR fines were capped at £500,000, and the Data (Use and Access) Act 2025 raised them to the UK GDPR level for breaches from 5 February 2026.

The ICO also issues public reprimands and enforcement notices, and in late 2024 third-party collective redress actions on behalf of data subjects were approved.

The ICO is no longer light-touch: it has now checked the UK's 1,000 busiest websites.

Marc Alexander, a GA4 specialist, sets up GA4 and Consent Mode to meet these rules, and the GA4 mini audit checks where your site stands.

Five things to remember.

  • GA4 isn't compliant out of the box. As controller, the setup is your responsibility.
  • Consent comes first. GA4 must not fire before the user chooses, while the banner is showing, or after they reject.
  • Consent Mode doesn't replace consent
  • PECR covers all tracking technologies, including those processing anonymous data, and it takes precedence over UK GDPR

Sources.

Checked on 31 October 2026.