André Kipphard
Start a project
← Back to blog
SEOJuly 11, 20264 min read

GDPR-Compliant Google Analytics: How to Implement Consent Correctly

GDPR-Compliant Google Analytics: The Legal Starting Point

Google Analytics sets cookies and transmits IP addresses to US servers. That constitutes access to the user's end device – which under § 25 TDDDG (the German Telecommunications Digital Services Data Protection Act) requires prior, informed consent. In parallel, Art. 6(1)(a) GDPR requires a valid legal basis for processing personal data.

In practice, this means: legitimate interest (Art. 6(1)(f) GDPR) is not sufficient for tracking tools like GA4 in Germany. The European Data Protection Board and German data protection authorities are unambiguous on this point. You need opt-in – not opt-out, not "continued browsing equals consent".

Two Approaches: Load-after-Consent vs. Google Consent Mode

When deploying GDPR-compliant Google Analytics, there are two main technical paths:

Load-after-Consent (stricter, cleaner)

You do not load gtag.js until the user has explicitly agreed. Until then, no Google script runs, no cookie is set, no IP is transmitted. This is the cleanest approach and what I use on this site.

// Only call after explicit consent
function loadGoogleAnalytics(measurementId) {
  const script = document.createElement('script');
  script.src = `https://www.googletagmanager.com/gtag/js?id=${measurementId}`;
  script.async = true;
  document.head.appendChild(script);

  window.dataLayer = window.dataLayer || [];
  function gtag() { dataLayer.push(arguments); }
  gtag('js', new Date());
  gtag('config', measurementId);
}

Google Consent Mode v2

Here you load gtag.js immediately but send consent signals that tell Google what is permitted. Google then uses modelling (machine learning) to fill in gaps from users who decline. This is technically sophisticated, but legally harder to defend: the script runs before the user consents, and whether that satisfies § 25 TDDDG is disputed among German legal experts. Consent Mode is better suited for scenarios where you connect GA with Google Ads and need conversion modelling.

Building a Legally Sound Cookie Consent Banner

A consent banner that holds up legally must meet these requirements:

  • Real choice: Declining must be as easy as accepting – no buried "reject" link, no dark patterns
  • Granularity: Analytics cookies must be separated from technically necessary cookies
  • No pre-ticked boxes: GA tracking must not be enabled by default
  • Revocability: Users must be able to withdraw consent at any time – a footer link is the minimum
  • Auditability: You should be able to record when and to what version someone consented (consent timestamp, version string)

Libraries like vanilla-cookieconsent take care of much of this, as long as you configure them correctly. If you prefer building it yourself: a localStorage entry with a timestamp and consent version is a solid starting point.

IP Addresses in GA4: What Changed

Google states that GA4 anonymises IP addresses server-side before storing them. Unlike Universal Analytics, there is no separate anonymize_ip flag – anonymisation is supposed to be on by default. That is an improvement over GA3, but it does not remove the consent obligation: transmitting data to US servers (even without a full IP) remains a cross-border transfer that requires a legal basis. Since 2023, the EU-US Data Privacy Framework provides that basis for certified organisations – as long as Google maintains its certification.

Privacy Policy: What Must Be Documented

Your privacy policy must fully document GA4 usage:

  • Name and provider of the tool (Google Ireland Ltd. / Google LLC)
  • Purpose of processing (website analytics, reach measurement)
  • Legal basis: Art. 6(1)(a) GDPR (consent)
  • Third-country transfer to the US and the applicable safeguard (EU-US DPF)
  • Data retention period in GA4 (configurable; default is 14 months)
  • Link to Google's privacy policy and to the browser opt-out mechanism
  • How users can withdraw their consent

If anything changes – new measurement ID, different retention setting – the privacy policy needs to be updated immediately.

How I Implemented It on kipphard.com

On this site, GA4 is loaded exclusively after explicit consent. The gtag.js script is absent from the HTML until the user actively agrees to tracking. Consent status is stored in localStorage so returning visitors are not asked again – unless they revoke consent. The privacy policy documents this in full.

The result: no uninvited network requests to Google, no unnecessary legal exposure – and complete analytics data from visitors who do agree.

The Bottom Line

Running GDPR-compliant Google Analytics is not complicated, but it requires careful implementation. The safe path: get consent first, then load the script. Consent Mode is an option for specific scenarios, but not a free pass.

If you need help setting up analytics in a GDPR-compliant way or building a consent banner, feel free to reach out. I will look at your specific setup and give you a straight answer.

DSGVOGoogle AnalyticsConsent

You might also like