Key points
- Configuring Google Analytics 4 in compliance with the GDPR improves audience measurement while limiting the risk of a penalty from the CNIL (French data protection authority).
- The key principles are lawfulness, data minimisation and security of processing, with identification of purposes and transparency towards users.
- GA4 processes data such as the connection IP address or identifiers, which are personal data subject to the GDPR and call for minimisation and pseudonymisation.
- The retention period must follow the minimisation principle; standard event data ranges from 2 to 14 months depending on the configuration.
- Consent Mode adapts the script’s behaviour to the user’s choice; no collection that requires consent should start before consent is given.
- Keeping a register that archives the record, content and date of consent helps you demonstrate compliance during a CNIL inspection.
Mastering the configuration of Google Analytics 4 (GA4) to ensure compliance with the GDPR is a key issue for any organisation that wants to improve its audience measurement while limiting the risk of penalties. Adopting good practices, setting up each step carefully and integrating user consent management are now essential to reconcile performance and personal data protection. This guide explains how to configure GA4 in line with the requirements of the General Data Protection Regulation, taking into account in particular the recommendations published by the CNIL and the specific features of proxying and Consent Mode.
Core GDPR principles applied to GA4
Regulatory compliance requires several principles to be respected whenever data collection takes place through a tool such as Google Analytics 4. These mainly concern the lawfulness, minimisation and security of the processing carried out.
Identifying the purposes of audience measurement in advance, limiting the scope of the data collected, effectively controlling its storage and ensuring transparency towards users are at the heart of this approach. An unsuitable configuration increases the risk of non-compliance in the eyes of authorities such as the CNIL.
Deploying GA4: essential configuration settings
Setting up Google Analytics 4 takes more than simply adding a script to the website. Several settings need to be adjusted to ensure a configuration that respects the legal and ethical expectations set by the GDPR.
Calling on the expertise of a law firm well versed in digital regulation, such as a GDPR lawyer, can make it easier to bring every detail of your analytics configuration into compliance.
What data does GA4 collect automatically?
By default, the native configuration of Google Analytics 4 collects various information such as the pages viewed, time spent and certain technical browsing identifiers.
Some items, such as the IP address or login identifiers, are personal data within the meaning of the GDPR. Their processing is therefore subject to the GDPR: their collection should be limited, pseudonymisation preferred, and their use restricted to strict analytics needs.
How do you choose data retention settings in GA4?
Setting the data retention period must meet the minimisation principle imposed by the GDPR.
On this basis, it is recommended to choose the shortest period offered by GA4 where this is compatible with your objectives. The following table shows the main options available:
| Type of data | Minimum period (months) | Maximum period (months) |
|---|---|---|
| Standard event data | 2 | 14 |
| Aggregated data | Indefinite | Indefinite |
| User ID | Varies depending on configuration | Varies depending on configuration |
User consent management and Consent Mode configuration
Obtaining users’ consent in advance remains a key requirement for data collection linked to audience measurement. Implementing the Consent Mode of GA4 makes it easier to adapt the script’s behaviour dynamically to the user’s choice regarding cookie management.
To provide specific support to start-ups or organisations facing complex digital transformation issues, it makes sense to seek dedicated assistance from a digital law firm able to anticipate regulatory changes.
What should you check when configuring Consent Mode?
Configuring Consent Mode requires precise targeting of the cookie categories activated or not depending on the consent or refusal given by the user.
You will also need to make sure that the script does not start any data collection until the user has given prior consent, where consent is required (Article 82 of the French Data Protection Act, Law No. 78-17 of 6 January 1978 (in French)), failing which the rules would be breached. It is also important to allow users to change their choice as easily as they first expressed it.
Should you keep proof of user consent?
Where processing is based on consent, the controller must be able to demonstrate that it was given (Article 7(1) of the GDPR). Keeping a register that archives the record of consent, as well as its content and date, helps you demonstrate your compliance during any CNIL inspection.
Several technical solutions can automate this management, but you still need to check regularly that the chosen solution covers all the requirements imposed by the GDPR for personal data protection.
Proxying GA4: achieving advanced anonymisation
To strengthen personal data protection in GA4, many professionals choose proxying of analytics traffic. This approach places a relay server between the visitor’s browser and the analytics platform, in order to transform or filter the data transmitted.
Such a configuration avoids any direct contact between the visitor’s device and the measurement tool’s servers, and therefore the direct sending of personal data to those servers, including outside the European Union. It also allows pre-processing to delete, pseudonymise or truncate certain technical fields before transfer. This contributes significantly to the regulatory compliance sought.
Steps to deploy an analytics proxy
Setting up a proxy requires a suitable technical architecture, including:
- A secure entry point hosted in the European Union
- Strict rules for transforming or excluding data
- A detailed log of access and changes made to each data flow
Each change must be approved in advance to avoid any break in the chain of trust or any loss of quality in the analyses carried out with GA4.
What precautions keep you compliant with the CNIL?
Adopting a proxying policy means incorporating the CNIL’s recommendations, updated on 15 November 2023. Since the European Commission’s adequacy decision of 10 July 2023 (“Data Privacy Framework”), transfers to certified US entities can take place freely; proxying remains a solution for transfers to non-certified entities or other countries not covered by an adequacy decision, and a good practice. It must avoid any direct contact between the device and the tool’s servers, and the data transmitted must not allow any re-identification.
In principle, the CNIL considers the following necessary: no transfer of IP addresses to the measurement tool’s servers, replacement of the user identifier by the proxy server, and deletion of any data that could lead to re-identification.
Good practices and specific recommendations for GA4/GDPR compliance
Ensuring regulatory compliance always requires regular vigilance over settings and the documentation of internal procedures. Several areas prove their effectiveness when implemented proactively.
Training teams, continually adjusting GA4 settings and carrying out frequent technical audits help prevent legal risks. Here are some essential initiatives to maintain over time:
- Limit the granularity of the data collected to what is genuinely useful
- Schedule automatic deletion of obsolete data
- Regularly consult the CNIL’s publications on audience measurement
- Adjust the cookie configuration to block cookies when consent is missing
- Run recurring tests of the robustness of Consent Mode
FAQ on configuring GA4 in compliance with the GDPR
How do you enable IP anonymisation in GA4?
In GA4, there is no IP anonymisation feature to enable: according to Google’s official help, masking is not needed because visitors’ IP addresses are neither logged nor stored. The IP address is nevertheless sent to the tool’s servers with every direct request from the browser, as the CNIL points out. It is advisable to check the settings regularly and to avoid adding customisations that could transmit additional personal data.
What are the differences between measuring audience with a standard script and through proxying?
Using a standard script sends the data directly to the analytics service, often located outside the European Union, which raises issues linked to international data transfers. Proxying, by contrast, places a European server in between that can filter, anonymise or even delete certain types of information. The table below illustrates these key differences:
| Method | Place of processing | Level of anonymisation | Legal exposure |
|---|---|---|---|
| Standard script | Outside the EU (depends on the provider) | Medium (partial anonymisation) | Higher |
| Proxying | Within the EU | High (advanced control) | Reduced |
How do you draft a compliant privacy policy for audience measurement?
Drafting a GDPR-compliant privacy policy means clearly stating the purposes of collection, the nature of the data processed via GA4 and the rights available to users. You should list the parties involved in the processing, include a description of cookie management and state the exact arrangements for withdrawing or adjusting consent. Add a transparent passage on the data retention period and describe any use of a proxy.
- Transparent description of audience measurement activities
- Information on consent management and cookies
- How to exercise the rights of access, rectification and erasure
- Dedicated contact for questions relating to personal data protection
What automated checks can you put in place to maintain GA4 compliance?
Various tools make it possible to monitor the compliance of the GA4 configuration with the GDPR effectively. Examples include cookie scanners that check consent is actually obtained before any activation, alert systems that detect attempts to transmit non-compliant data, and regular logs tracking changes to analytics scripts. These tools should be an integral part of the periodic checks carried out rigorously.
- Checking that analytics cookies are blocked at the outset
- Analysing server logs to identify outgoing transmissions
- Regular audit of application-side settings and back-end
