The General Data Protection Regulation (GDPR) is the European Union's data protection law, in force since May 2018, with a near-identical UK version. It applies to personal data of people in the EU, including online identifiers such as cookie IDs and, in many cases, IP addresses. For analytics teams, it affects which data you collect, the legal basis for collecting it, how long you keep it and which vendors process it. This entry describes the practical touchpoints; it is not legal advice.
Where GDPR meets analytics
Most analytics setups touch several GDPR principles at once.
- Lawful basis: often consent for analytics cookies, decided with ePrivacy rules
- Data minimization: collect only what you need, no names or emails in analytics
- Storage limitation: set retention periods deliberately
- Transparency: describe tools and purposes in your privacy notice
- International transfers: assess where vendors process data
- Data subject rights: be able to handle access and deletion requests
Google Analytics and transfers
In 2022 several European data protection authorities found specific uses of Google Analytics unlawful because of data transfers to the US. The EU-US Data Privacy Framework, adopted in 2023, created a new transfer mechanism, and Google says it participates. The framework has faced legal challenges, so this area may change again.
Google also states that GA4 does not log or store IP addresses for users in the EU. Settings such as Google signals, data retention and user deletion still need deliberate choices.
Practical steps
Map every analytics and marketing tool, its purpose and its data. Run a consent banner wired to your tags. Remove personal data from URLs and event parameters. Set retention, sign data processing terms with vendors, and record the decisions.
Example
Personal data hiding in page URLs
Suppose Kestrelmark, a SaaS for legal teams, reviews its GA4 page paths and finds email addresses in the query string of a password-reset page. The team stops the app from putting the email in the URL, adds a transformation to redact it from collected data, and uses GA4's data deletion request to remove what was already stored.
Common mistakes
Assuming pseudonymous IDs are not personal data
Cookie IDs that single out a browser are generally treated as personal data under the GDPR.
Treating GDPR as only a banner
Consent is one part. Minimization, retention and transfers matter too.
Questions
It can, if the company offers services to people in the EU or monitors their behavior. Get legal advice for your specific situation.
