regulation

Google Analytics and GDPR in 2026: Rulings, Fines, Compliant Alternatives

By Art Kukharenko · Published · Updated

Independent legal reviewer not yet supplied. General information; confirm current obligations with qualified counsel.

Browse regulation resources

Google Analytics 4 can be used lawfully in the EU in 2026, but not by default. The 2022 rulings in Austria, France, Italy and elsewhere found US transfers unlawful before the EU-US Data Privacy Framework (DPF) existed; since July 2023 transfer risk is lower while the Framework stands, yet consent, minimisation and the pending Latombe appeal remain. Treat analytics as a consent-gated flow, especially when it feeds a customer data platform (CDP).

Who this is for: DPOs, analytics owners and architects who serve EU visitors and need to decide between a controlled Google Analytics setup and an alternative. Part of the regulation hub.

What the regulators decided in 2022 and 2023

Regulators concluded that Google Analytics sends identifiers to Google in the United States, and that the contractual safeguards in use after the Court of Justice invalidated Privacy Shield in July 2020 (Schrems II) did not stop access by US authorities 11718.

Scroll horizontally to compare all columns ↔

Comparison — source references are listed below
AuthorityWhenFinding as reportedSource
Austria, DatenschutzbehördePublished 13 January 2022A health-related website's use of Google Analytics breached the GDPR because of US transfers17
France, CNIL10 February 2022Formal notice to a French site operator; use contrary to EU law citing Schrems II. Press reported CNIL guidance in June 2022 that no configuration made it lawful17
Italy, Garante23 June 2022Declared the tool unlawful17

| Finland, Data Protection Ombudsman | Reported 26 January 2023 | Warned Helsinki, Espoo, Vantaa and Kauniainen over library websites using Google Analytics and Tag Manager | 18 |

What changed: GA4 and the Data Privacy Framework

The Commission adopted the DPF adequacy decision, Implementing Decision (EU) 2023/1795, on 10 July 2023 3. Google states it has certified under the DPF and that the Framework applies to restricted European transfers to its certified US entity 12. The CNIL's current guidance accepts that transfers to certified US entities can proceed, while noting that a tool being exempt from consent says nothing about transfers 1.

GA4 also differs from Universal Analytics, which stopped collecting on 1 July 2023 and stopped processing standard properties on 1 July 2024 20. Google says GA4 does not log or store individual IP addresses from EU, Swiss or UK users, collects data from those devices through servers in those regions before forwarding it, and uses the IP only for coarse location before discarding it 6. User-level retention can be set to 2 or 14 months 7.

The supplied fact check records the General Court’s dismissal of Latombe’s challenge on 3 September 2025 and the pending appeal C-703/25 P. A pending appeal is not a decision invalidating the Framework. The current appeal stage and any further filings were not independently confirmed here. See the transfer assessment guide.

Issues that remain after the Framework

Fines and enforcement in 2025 and 2026

Sweden’s IMY announced fines of SEK 12 million for Tele2 and SEK 300,000 for CDON on 3 July 2023 following audits of transfers through Google Analytics. These cases concern the assessed transfers and safeguards, not a universal ban on the product. IMY decision announcement. CNIL separately announced €325 million and €150 million cookie-related penalties for Google and Shein in September 2025; those are distinct cases. CNIL summary.

Compliant setups for Google Analytics 4

Scroll horizontally to compare all columns ↔

Comparison — source references are listed below
ControlWhat to doSource
Consent gateUse a certified consent platform; default analytics and ad storage to denied for regions that need consent9
Consent mode v2Send ad_storage, analytics_storage, ad_user_data and ad_personalization; advertisers must follow Google's EU user consent policy910
Server-side taggingRun a server container in your own cloud project, on your first-party domain, and decide what leaves the server11
Data minimisationSet retention to 2 months; switch off Google signals and granular location and device data where not needed67
ContractsKeep the processor terms, DPF status and standard clauses on file; draft a transfer impact assessment as fallback12

Server-side tagging does not by itself resolve consent or transfer obligations if data is forwarded to another provider. Document the actual destination, fields, recipient access and contract. Confirm the regions and operational controls your chosen hosting configuration supplies. This is an architecture assessment, not a claim that selecting a server-side mode establishes compliance.

Google Analytics alternatives and hosting facts

Scroll horizontally to compare all columns ↔

Comparison — source references are listed below
OptionLicence and modelHostingFacts to weighSource
MatomoGPL v3 or later; self-hosted or Matomo CloudAny country you choose on-premise; Cloud stored in Europe per the vendorThe vendor says CNIL approved it; the CNIL says vendors may not call a solution "certified" or "validated" and that exemption depends on configuration21323
Piwik PROCommercial"Private or public cloud" for Enterprise; on-premises not listed on the pricing pageEnterprise from $25,000 a year; Healthcare Enterprise from $30,000; BAA terms conflict between plan table and FAQ22
PostHogMIT except the ee directorySelf-host or cloudSelf-hosted open-source deployments suit about 100,000 events a month; no support guarantees15
PlausibleAGPLv3 Community Edition; MIT tracker; paid CloudCloud on European-owned infrastructure; entity in EstoniaNo cookies; daily-rotating hash; Community Edition lacks funnels, SSO and the sites API1421

Scroll horizontally to compare all columns ↔

Comparison — source references are listed below
If you needConsiderWhy
Google Ads audiences and attribution in the EUGA4 behind consent mode v2 and server-side taggingKeeps Google integrations; accepts DPF dependence
No US vendor in the path (public sector, health)Self-hosted Matomo or similar, configured for the exemptionRemoves the transfer question; you operate it
Product funnels and event analyticsPostHogEvent model; watch self-host scale limits
Simple site statisticsPlausibleNo cookies; small footprint
Enterprise support or BAAPiwik PROConfirm plan terms
Events already flowing through a customer data platformFeed analytics from the same first-party event stream, gated by your consent recordOne consent record, one pipeline

PrivyCDP is a customer-owned platform that runs on infrastructure you control, so first-party event data and consent records can stay under your control. For pure web statistics a dedicated analytics tool is simpler. See the open-source customer data platforms comparison and first-, second- and zero-party data.

Google Analytics GDPR checklist

  • Map every Google tag, pixel and SDK on EU-facing sites.
  • Block analytics and ad storage until consent; test with the banner declined 9.
  • Implement consent mode v2 and confirm signals reach Google 10.
  • Decide basic or advanced mode with counsel 8.
  • Set retention to 2 months; disable unneeded Google signals and location detail 67.
  • Put a server container on your first-party domain in an EU region and strip identifiers 11.
  • Record Google's DPF status and processor terms; draft a transfer impact assessment as fallback 312.
  • Update the privacy notice and cookie list; record consent evidence.
  • Run a trial of one alternative on a low-risk site.
  • Make sure a consent withdrawal reaches analytics as well as email, see consent withdrawal across channels.
  • Re-check the DPF appeal each quarter using GDPR transfers after Latombe.

If you want one place to record consent and route first-party events without a US vendor in the path, the compliance guide shows how a customer-owned deployment fits GDPR duties; see also the GDPR-ready deployment page and the regulation hub.

Frequently asked questions

Is Google Analytics 4 GDPR compliant?

No regulator certifies it. GA4 can be used lawfully if you obtain consent where required, rely on the DPF or standard clauses for US transfers, minimise data and document the choices. The 2022 rulings concerned the pre-DPF position 1317. Legal sign-off from your DPO is still needed.

Is Google Analytics banned in the EU?

No. Several authorities declared specific uses unlawful in 2022 and 2023, but the DPF adequacy decision of 10 July 2023 changed the transfer analysis, and CNIL guidance now says transfers to certified US entities can proceed 1317. Consent and minimisation duties remain.

Has Google been fined for Google Analytics?

Distinguish fines against website operators from fines against Google. IMY announced fines against Tele2 and CDON concerning their Google Analytics transfers in July 2023. CNIL’s September 2025 Google and Shein penalties concerned cookies and related consent duties. IMY; CNIL.

Does server-side tagging make Google Analytics GDPR compliant?

Not by itself. It gives you a server you control, a first-party domain and control over what is forwarded 11. If hits still go to Google, consent, transfer and minimisation rules apply. The CNIL says changing settings is not enough 1.

Is there EU data residency in GA4?

Google says it collects data from EU devices through EU-based servers before forwarding it, and does not log or store EU users' IP addresses 6. Its processor terms still allow processing in any country with Google facilities 12. Treat it as reduced exposure, not residency.

What is the best Google Analytics alternative for GDPR?

It depends on needs. Matomo and Plausible suit web analytics, PostHog suits product analytics and funnels, and Piwik PRO suits enterprises that want vendor support and possibly a business associate agreement 13141522. Whatever you choose, a tool being consent-exempt under French guidance does not remove duties in other member states 12.

Sources

  1. CNIL, Google Analytics and data transfers (published 15 November 2023) Open source
  2. CNIL, consent-exempt audience measurement evaluation programme (4 July 2025) Open source
  3. Commission Implementing Decision (EU) 2023/1795, EUR-Lex Open source
  4. Court of Justice press release 106/25 on the General Court judgment in T-553/23 (cited from the shared fact base; not re-opened while drafting) Open source
  5. EDPB, Irish DPC fines Google EUR 403,000,000 over location data (published 23 September 2026) Open source
  6. Google Analytics Help, IP addresses and EU data collection Open source
  7. Google Analytics Help, data retention Open source
  8. Google Analytics Help, consent mode (basic and advanced) Open source
  9. Google for Developers, consent mode guide Open source
  10. Google Tag Manager Help, consent mode v2 Open source
  11. Google for Developers, server-side tagging Open source
  12. Google, data processing terms (vendor) Open source
  13. Matomo repository (licence) Open source
  14. Plausible repository (licence, Community Edition) Open source
  15. PostHog repository (licence, self-hosting limits) Open source
  16. DataGuidance, Microsoft admitted as intervener in the Latombe appeal (cited from the shared fact base; not re-opened while drafting) Open source
  17. Wikipedia (French), Google Analytics, section on legality in the EU (tertiary, lists dated decisions with press references) Open source
  18. eWatchers (press repost), Finnish authority on Google Analytics and Tag Manager Open source
  19. Wikipedia, EU-US Data Privacy Framework (tertiary; used for the noyb statement after Trump v. Slaughter) Open source
  20. Wikipedia, Google Analytics (Universal Analytics sunset, IP anonymisation) Open source
  21. Plausible data policy (vendor) Open source
  22. Piwik PRO pricing (vendor) Open source
  23. Matomo, GDPR analytics (vendor) Open source

Put this evaluation into practice.

Review the compliance guide

This article is general information, not legal advice.

Further reading

Published: · Updated:

Publication date recorded for the approved release. Editorial updates do not establish legal approval or a customer result.

Need help?

Ask the PrivyCDP Assistant