Is Google Analytics legal in the EU in 2026? What changed, what to do

Yes. As of November 2026, Google Analytics 4 can be used lawfully in the EU, as long as visitors consent to its cookies and the property is set up with care. The decisions that found Google Analytics illegal in Austria, France and Italy in 2022 and in Sweden in 2023 were about sending visitor data to the US, and the EU-US Data Privacy Framework of July 10, 2023, under which Google LLC is certified, gave those transfers a legal basis again.

That basis is under pressure. An appeal against the framework is pending at the EU Court of Justice, and in July 2026 the European Data Protection Board asked the European Commission to reassess it after a US Supreme Court ruling on the Federal Trade Commission.

Is Google Analytics GDPR compliant in 2026?

Google Analytics 4 can be used in line with the GDPR in 2026, but compliance comes from your setup, not from the product. Two separate laws apply, and they give different answers:

Why did EU regulators rule Google Analytics illegal in 2022?

EU regulators ruled Google Analytics illegal because it sent visitor data to Google LLC in the US without a valid basis for the transfer. The Court of Justice had struck down the EU-US Privacy Shield in Schrems II (C-311/18) on July 16, 2020, and regulators found that standard contractual clauses (SCCs) could not protect the data from US surveillance law on their own.

The cases began with 101 complaints that noyb filed in August 2020 against websites in all 30 EEA countries, as the CNIL’s decision recounts. Four regulators reached the same conclusion about Google Analytics:

Three findings from these decisions still describe how regulators look at GA4:

• Pseudonymous IDs are personal data. Austria’s DSB held that the _ga cookie IDs let the site and Google tell visitors apart, in a case where the site had not even turned on Google signals.
• IP truncation is not anonymisation. Italy’s Garante called it pseudonymisation, since Google can re-identify a visitor with the other information it holds. Sweden’s IMY agreed.
• The problem was US law, not the settings. The CNIL found that none of Google’s measures could “prevent access possibilities of US intelligence services or render these accesses ineffective”.

IMY did not fine Coop and Dagens Industri, which had taken more extensive measures than CDON, but it still ordered both to stop using the tool. Mitigation lowered the penalty; it did not fix the transfer.

What changed: the EU-US Data Privacy Framework

The EU-US Data Privacy Framework (DPF) changed the answer for transfers. On July 10, 2023 the European Commission adopted Implementing Decision (EU) 2023/1795, finding that the US adequately protects personal data sent to US companies certified under the framework. Transfers to those companies need no SCCs or extra safeguards (Commission Q&A).

The decision rests on Executive Order 14086 of October 7, 2022, which limits US signals intelligence to what is necessary and proportionate and, with an Attorney General regulation, set up a Data Protection Review Court for complaints from Europeans. The Commission says these safeguards apply to every transfer to a US company, whatever the transfer tool, so they also support SCCs (Commission).

Google LLC is on the list. When we checked Google’s Data Privacy Framework entry on November 3, 2026, its EU-US certification was active for HR and non-HR data, with the next certification due on September 13, 2027. Google says it has relied on the framework for EEA personal data in its advertising and analytics products since September 1, 2023 (Google).

Regulators adjusted. On the day of adoption, the CNIL told French organisations that transfers to companies on the list can now take place freely, without SCCs. On November 13, 2025, the Dutch regulator, the Autoriteit Persoonsgegevens, wrote that transfers meeting the DPF’s requirements also meet the GDPR’s transfer rules, so its 2022 investigation of the old Universal Analytics cannot be applied one to one to Google Analytics today (AP letter).¹

The framework does not clean up the past. IMY’s fine against Tele2 covered August 2020 to May 2023, and Swedish courts upheld it on October 17, 2024 and again on October 15, 2025 (IMY).

Did the EU court uphold the Data Privacy Framework?

Yes, at first instance. On September 3, 2025 the EU General Court dismissed the action that French MP Philippe Latombe brought to annul the framework, in Latombe v Commission (T-553/23). The appeal is pending before the Court of Justice, the court that struck down both earlier frameworks.

The General Court found that the Data Protection Review Court’s judges have enough safeguards of independence, since only the Attorney General can dismiss them, and only for cause. It held that Schrems II requires bulk collection to face at least judicial review after the fact, not prior authorisation, and that the review court provides it. It judged the framework as it stood in July 2023, and noted that the Commission must keep monitoring US law and can suspend, amend or repeal the decision if that law changes.

Latombe appealed on October 31, 2025 as case C-703/25 P (notice of appeal). His four grounds attack the findings on the review court’s independence, on whether it was established by law, on bulk collection without prior authorisation, and on the President’s power to update the objectives of bulk collection in secret. As of November 3, 2026, the Court of Justice’s judicial calendar lists no hearing or Advocate General opinion in C-703/25 P, so no ruling date can be predicted.

What does Trump v. Slaughter mean for the Data Privacy Framework?

Trump v. Slaughter removed one of the assumptions behind the Data Privacy Framework, but it did not change the framework’s legal status. On June 29, 2026 the US Supreme Court held that the rule letting the President remove Federal Trade Commission commissioners only for cause is unconstitutional (opinion). The FTC enforces the commitments certified companies make, and Google’s DPF entry names the FTC as the US statutory body for its certification.

On July 31, 2026 the European Data Protection Board pointed out that the adequacy decision expressly relies on FTC commissioners being removable only for “inefficiency, neglect of duty, or malfeasance in office”, and asked the Commission to “closely assess” whether the ruling affects the decision (EDPB letter). A day after the ruling, noyb, the privacy group founded by Max Schrems, wrote to the Commission asking for an orderly exit from the framework and said it plans to challenge the decision in court (noyb letter).

As of November 3, 2026 the decision is in force: the Commission has not amended, suspended or repealed it. Its report on the first periodic review, of October 9, 2024, set the next review for three years later and listed appointments to the US Privacy and Civil Liberties Oversight Board among the developments it would watch (report).

What does Google say about GA4 and EU data?

Google says Google Analytics 4 does not log or store IP addresses, and collects EU traffic on EU servers before forwarding it to Analytics servers for processing. GA4 has no setting to keep data in the EU, and Google relies on the DPF to move EEA personal data to the US.

Does Google Analytics 4 still need cookie consent in the EU?

Yes. The Data Privacy Framework only settles the transfer; cookie consent comes from a different law. Article 5(3) of the ePrivacy Directive requires consent before storing or reading information on a visitor’s device, and GA4 sets the _ga and _ga_<container-id> cookies for two years by default (Google’s cookie list).

Google’s EU user consent policy and the Google Analytics terms both make you obtain that consent where the law requires it. Consent Mode changes what the tag sends after the visitor chooses; it does not replace the banner. Our guide to cookie banners for analytics covers the EU, UK and US rules, including how Consent Mode’s cookieless pings fit the EDPB’s reading of Article 5(3).

GA4 GDPR checklist for EU sites in November 2026

A site using Google Analytics 4 for EU visitors should have these eight things in place:

1. Consent before the tag runs. Use a banner where refusing is as easy as accepting, with all four Consent Mode signals denied by default. In basic consent mode, gtag.js does not load until the visitor agrees, so Google receives nothing before then (consent mode).
2. A privacy policy that names the transfer. Name Google Analytics and Google LLC, the cookies and their lifetime, what is collected, how long it is kept, and that data goes to the US under the DPF. Article 13(1)(f) requires the transfer and its basis to be disclosed; the Garante found Caffeina Media in breach of exactly that.
3. Data processing terms. Businesses established in the EEA, the UK or Switzerland already have the Google Ads Data Processing Terms. Others accept them in Admin, under Account details, Data Processing Amendment.
4. A deliberate retention period. In Admin, under Data collection and modification, Data retention, choose 2 or 14 months, the shortest that serves your explorations (data retention). With “Reset on new activity” on, a visitor who keeps coming back never reaches the limit. Article 5(1)(e) GDPR asks you to keep data no longer than needed.
5. Data sharing off. In Admin, under Account details, turn off “Google products & services” unless you rely on it.
6. Less data collected. In Admin, under Data collection and modification, Data collection, leave Google signals off, or off for EU regions, and turn off granular location and device data for the EU if you never read city, device model or user agent (Google signals).
7. No personal data in hits. The GA terms forbid sending anything Google could recognise as personally identifiable: no email addresses or names in URLs, event parameters or user IDs.
8. A transfer note in your records. In your record of processing (Article 30), note Google’s DPF certification, the date you checked it, and the SCC fallback in Google’s terms, so you know what to revisit if the framework changes.

Basic consent mode with gtag.js, adapted from Google’s setup guide:

<script>
  window.dataLayer = window.dataLayer || []
  function gtag() {
    dataLayer.push(arguments)
  }
  gtag('consent', 'default', {
    ad_storage: 'denied',
    ad_user_data: 'denied',
    ad_personalization: 'denied',
    analytics_storage: 'denied',
  })
  gtag('js', new Date())
  gtag('config', 'G-XXXXXXXXXX')

  // gtag.js is only fetched once the visitor has accepted analytics, now or on an earlier page.
  function loadAnalytics() {
    gtag('consent', 'update', { analytics_storage: 'granted' })
    const tag = document.createElement('script')
    tag.async = true
    tag.src = 'https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX'
    document.head.appendChild(tag)
  }

  // Call from the banner's "Accept analytics" button.
  function acceptAnalytics() {
    localStorage.setItem('analytics-consent', 'granted')
    loadAnalytics()
  }

  if (localStorage.getItem('analytics-consent') === 'granted') loadAnalytics()
</script>

The ad signals stay denied, so accepting analytics does not also switch on ads personalisation.

What happens to Google Analytics if the DPF is struck down?

If the Court of Justice annuls the Data Privacy Framework, transfers to Google that rely on it lose their legal basis, and the questions of 2022 come back. The last two times there was no grace period: Safe Harbor fell on October 6, 2015 in Schrems I (C-362/14), and the EDPB confirmed that Schrems II invalidated the Privacy Shield “without maintaining its effects” (EDPB FAQ).

Google’s terms already name the fallback, SCCs. Whether SCCs would carry GA4 depends on why the framework falls. This is our reading, not a regulator’s:

• If the court finds the US surveillance safeguards or the review court inadequate, as Latombe argues, that reasoning reaches SCC transfers too, because the Commission says those safeguards apply to all transfers. That is where regulators stood in 2022.
• If the problem stays with the FTC’s independence, the commercial side that Trump v. Slaughter touched, SCCs rest on contract rather than FTC enforcement, and the effect on them may be smaller.

Exposure builds up by the month: Tele2’s fine covered almost three years of use. The decisions treated access by US authorities as the problem, and no GA4 setting changes that, so if your policy cannot carry the risk, use a tool that keeps visitor data out of the US.

EU-hosted, cookieless alternatives to Google Analytics

An EU-hosted, cookieless analytics tool takes most of the transfer question away and shrinks the consent one. Whether a cookieless tool needs a banner still depends on how your country reads Article 5(3), as our cookie banner guide explains. “EU-hosted” can also hide a US company in the path, so read the subprocessor list.

invisit, the tool we build, sets no cookies and stores nothing on the visitor’s device. It tells visitors apart with a keyed hash of the site, the date, the device, browser and operating system type and the IP address, mixed with a random salt generated for each UTC day. The salt is deleted about 25 hours after the day ends, after which nobody, invisit included, can recompute that day’s hashes, so no visitor is followed from one day to the next. Raw IP addresses are never stored, Global Privacy Control and Do Not Track can be honoured if you turn them on, and a DPA is available.

invisit is not entirely outside the DPF question either: visitor requests pass through Cloudflare, which is on the DPF list, before reaching servers in Falkenstein, Germany. Plausible, with only EU-owned providers, sits further from it. invisit also keeps analytics data with no time limit, so the storage limitation in Article 5(1)(e) is yours to address. If your policy asks for consent anyway, invisit’s requireConsent sends nothing until your banner says yes.

GA4 is still the better choice if you buy Google Ads, export raw events to BigQuery or measure mobile apps. Our GA4 comparison covers those trade-offs, and 12 Google Analytics alternatives compared covers prices and script sizes.

What to watch next

The trap to avoid is treating the 2023 framework as a permanent fix. The DPF covers the transfer, consent covers the cookie, and either can fail without the other. Put these on your calendar:

• Case C-703/25 P at the Court of Justice: a hearing date, an Advocate General opinion, then the judgment.
• The Commission’s answer to the EDPB’s July 2026 letter on Trump v. Slaughter.
• Any court action by noyb against the decision.
• The Commission’s next periodic review, due three years after its October 2024 report.
• Google LLC’s DPF recertification, due September 13, 2027.