Google Analytics and GDPR: How to Set It Up Without Breaking the Law

Written by: Marcel van Rijn
April 24, 2026

Google Consent Mode v2 became mandatory in March 2024. Two years later, most websites still have it misconfigured in 2026. The result is straightforward: either you’re losing data or breaking GDPR. Sometimes both.

Here’s the problem. Google Analytics sends visitor data to US servers. It uses cookies to track behavior. It enables behavioral profiling across sessions. All of this needs explicit consent under GDPR before anything fires. Consent Mode v2 was designed to handle this, but the implementation is broken on most websites.

This guide walks you through the correct setup. By the end, you’ll understand what’s actually happening with your data, why it matters and how to configure Google Analytics so it complies with GDPR while still gathering the data you need.

Why a Google Analytics GDPR Compliant Setup Is Not Automatic

Let’s start with the core issue. Google Analytics is designed to collect behavioral data. That data goes to Google’s servers, which are located in the United States. GDPR applies to any organization collecting data from EU residents, regardless of where the servers sit.

The legal problem runs deeper than just data transfer. Google Analytics uses cookies to identify visitors and track their behavior across sessions. It builds profiles of how users interact with your website. It stores this data for extended periods. Each of these activities, under GDPR, requires a legal basis. For most organizations, that basis is consent.

Before Consent Mode v2, many websites handled this poorly. They loaded Google Analytics unconditionally and asked for consent afterward (if at all). They assumed that consent banners solved the problem. They didn’t understand that GDPR requires consent before tracking starts, not after.

Consent Mode v2 was supposed to fix this. In theory, it lets Google Analytics work in two modes: fully functional when users consent, and degraded when they don’t. In practice, most websites misconfigure it in ways that either violate GDPR or lose data entirely.

What Consent Mode v2 Actually Does

Consent Mode v2 is not Google Analytics. It’s a layer that sits between your consent management platform and Google’s tools (Analytics, Ads, Tag Manager). It sends signals to Google’s servers telling them whether the user has consented to measurement, advertising or both.

When a user grants consent, Consent Mode v2 sends “granted” signals. Google Analytics then collects full behavioral data: page views, events, user IDs, custom parameters, everything. The data goes to your Analytics account and is stored for the retention period you’ve configured.

When a user denies consent, Consent Mode v2 sends “denied” signals. Here’s what happens next. Google Analytics still fires, but it operates in a degraded mode. It doesn’t set persistent cookies. It doesn’t create user profiles. It doesn’t send personally identifiable information to Google’s servers. Instead, Google uses a statistical modeling system called Behavioral Modeling to estimate what the denied-consent users would have done based on the behavior of consented users. You see estimated data rather than actual data.

This is crucial to understand. Consent Mode v2 doesn’t mean “don’t use Google Analytics.” It means “use Google Analytics differently depending on what the user consented to.”

The signals are simple. Consent Mode v2 has two main parameters:

analytics_storage: “granted” or “denied” for measurement and analytics
ad_storage: “granted” or “denied” for advertising and marketing

When both are “denied,” Google Analytics collects minimal data. When both are “granted,” you get full data collection.

The modeling gap matters. When users deny consent, you lose roughly 20-30% of actual data but gain estimates for the missing segment. This is better than losing visibility entirely, but it’s not as accurate as actual data. Your reports will show estimated page views, estimated conversion rates and estimated audience segments for the denied-consent users.

The Three Most Common Misconfigurations

We see the same mistakes repeatedly. Here are the three that cause the most damage.

Misconfiguration 1: GA4 Fires Before Consent Mode Is Initialized

This is the most common error. It happens when developers load the Google Analytics script before the consent management platform has a chance to run.

Here’s the typical sequence. Your website loads in a visitor’s browser. Before anything else runs, the HTML includes a direct Google Analytics script tag (the gtag.js script). This script fires immediately and sends data to Google before your consent banner even appears. Meanwhile, your consent platform is loading separately. By the time it sends consent signals to Google, data has already left the visitor’s browser.

This violates GDPR directly. Consent must come before tracking, not after. If Google Analytics fires before Consent Mode v2 is initialized, you’re collecting data without consent, which is a violation regardless of what signals you send later.

The fix is straightforward: load Consent Mode v2 before you load any Google Analytics code.

Misconfiguration 2: Consent Mode Set to “Denied” by Default But Analytics Still Fires

This is subtly dangerous. Some organizations try to be “privacy-first” by defaulting consent to denied. However, they continue to fire Google Analytics immediately, assuming the denied state will make it harmless.

The problem: Google Analytics will still send measurement pings to Google even when analytics_storage is set to “denied.” Without Consent Mode v2 properly initialized, Google Analytics interprets this as “collect data but in degraded mode.” Visitors see the consent banner and think they’ve opted out of tracking. Meanwhile, Google Analytics is still firing, still sending data and still creating tracking profiles.

Additionally, if Consent Mode v2 isn’t properly set before GA loads, the initial pageview fire before the consent state is ever communicated. This means the first visitor interactions are always tracked regardless of the default state.

Misconfiguration 3: Server-Side Data Streams Bypass Consent Entirely

Some organizations run Google Analytics alongside a server-side measurement system (like Google’s Conversions API). The idea is to send conversion data directly from the server to Google without going through the browser, theoretically avoiding some privacy concerns.

However, server-side measurement systems still need consent. They still send user data to Google. They still build profiles. The fact that they bypass the browser doesn’t change the legal requirement for consent. We’ve found implementations where the server-side stream fires conversion data to Google without checking whether the user gave consent at all.

When you use server-side measurement, you must still implement Consent Mode v2 on the client side and honor user choices throughout your entire measurement system.

How to Implement Correctly

Let me walk through the proper setup. This assumes you’re using a consent management platform (like OneTrust, Cookiebot, or others) and Google Tag Manager.

Step 1: Load Consent Mode Before Anything Else

The very first thing that should load on your website is the Consent Mode v2 initialization code. This happens before your consent platform loads, before your Google Analytics code loads, before anything else.

Add this to the of your website, as the very first script tag:

This does three things. First, it creates the dataLayer that Google Tag Manager uses. Second, it sets default consent to “denied” for all storage. Third, the wait_for_update parameter tells Google Analytics to hold off for 2500 milliseconds (2.5 seconds) while your consent management platform runs and updates the consent state. This is critical. Without it, Google Analytics fires before consent signals arrive, creating the misconfiguration we described earlier.

The region array lists EU and UK country codes. Google will apply these consent defaults only to visitors from those regions, letting you handle consent requirements differently for non-EU visitors if needed.

Step 2: Configure Your Consent Management Platform

Your CMP should update the Consent Mode signals when users make consent choices. This usually happens through integration code that your CMP provides.

When a user accepts analytics consent, your CMP should call:

gtag('consent', 'update', {
  'analytics_storage': 'granted'
});

When they reject:

gtag('consent', 'update', {
  'analytics_storage': 'denied'
});

Your CMP should handle this automatically as soon as the user makes their choice. The key is that consent signals update immediately when the user clicks “Accept All” or “Reject All,” not later.

Step 3: Load Google Analytics Through Google Tag Manager

Rather than loading Google Analytics directly, use Google Tag Manager. Create a GA4 tag in GTM, then set a trigger that fires based on consent. The trigger should only allow the tag to fire when analytics_storage equals “granted.”

If you’re using Consent Mode v2 correctly, Google Tag Manager itself should wait for the consent update before firing most tags. However, it’s good practice to explicitly set the trigger condition.

Step 4: Test in GTM Preview Mode

Google Tag Manager has a preview mode that lets you test your configuration before pushing it live. Enable preview mode, load your website and open the GTM preview panel (usually visible at the bottom of the page). Watch the dataLayer events as they fire.

You should see:

The Consent Mode default event firing first with all storage set to “denied”
Your consent banner appearing
Your consent platform calling gtag(‘consent’, ‘update’) with either “granted” or “denied”
Google Analytics tags firing (or not firing) based on the consent state

If Google Analytics fires before step 3 happens, your Consent Mode initialization is in the wrong place or Google Analytics is loading outside of GTM.

Data Retention and IP Anonymization

Even with proper consent, you must configure how long Google Analytics keeps data.

Data retention in Google Analytics determines how long visitor data is stored before Google automatically deletes it. Under GDPR, there’s no universal “correct” retention period. The requirement is that you keep data only as long as you have a legitimate reason to process it. For most websites, 14 months is a reasonable choice. You’re capturing enough data to run annual comparisons, but you’re not storing years of historical visitor behavior unnecessarily.

Set this in your Google Analytics property settings under Data Collection and Modification. Choose “Auto-delete” and set it to 14 months. This means Google deletes all visitor data older than 14 months, reducing your data retention risks.

IP anonymization is handled automatically in Google Analytics 4. GA4 doesn’t store full IP addresses. Instead, it uses IP addresses for geolocation only, then discards them. This is better than older versions of Analytics that required you to manually enable IP masking. With GA4, you get privacy-protective IP handling by default.

The Data Transfer Question: Schrems II and the EU-US Data Privacy Framework

Google Analytics sends data to US servers. This creates a legal question under GDPR: is it legal to send EU resident data to the United States?

For years, the answer was unclear. The Schrems II decision (2020) invalidated the Privacy Shield agreement that many organizations relied on for transatlantic data transfers. Organizations scrambled to find alternative legal bases for sending EU data to US servers.

In July 2023, the EU Commission issued an adequacy decision on the EU-US Data Privacy Framework. This adequacy decision essentially says that data transfers to US companies participating in the Data Privacy Framework can now happen under a lawful basis, provided the recipient company has certified compliance.

Google participates in the Data Privacy Framework. Therefore, as of 2023, transferring data to Google Analytics for analytics purposes is now legally valid on this basis, provided:

Your organization is established in the EU (directly or through a representative)
You’ve implemented appropriate contracts with Google
The transferred data is limited in scope (not more than necessary)
Users understand that their data goes to the US

However, document this. Don’t assume the adequacy decision is sufficient on its own. Maintain a record showing that you’ve considered data transfers, reviewed the Data Privacy Framework adequacy decision and documented why you believe your transfer is lawful.

Many organizations use Standard Contractual Clauses (SCCs) as an additional safeguard alongside the Data Privacy Framework. This provides a backup legal basis if the adequacy decision is challenged. Google will help you execute SCCs if you ask, though they’re technically not necessary under the current adequacy decision.

Detecting Configuration Problems

Testing your configuration manually is tedious. You need to reload your website, check the Network tab, verify timing of requests, repeat across different pages and test both accept and reject scenarios. This is time-consuming for a single website and nearly impossible for large portfolios.

Nixon Pro automates this process. You enter your website URL and Nixon Pro crawls it, checking whether Google Analytics fires before Consent Mode v2 is initialized. It reports back with specific timestamps and violations. If your site is misconfigured, you’ll see exactly what’s wrong and on which pages.

Additionally, Nixon Pro checks other common problems. It verifies that your privacy policy mentions Google Analytics. It identifies other trackers that might also be misconfigured. It gives you a starting point for fixing consent issues across your entire site.

Key Takeaways

Proper Google Analytics implementation under GDPR requires several pieces working together correctly:

Consent Mode v2 must load before Google Analytics, with appropriate defaults and the wait_for_update parameter set
Your consent management platform must update consent signals when users make choices
Google Analytics should only fire (or fire fully) when users grant consent
Data retention should be limited (14 months is reasonable for most cases)
Document your legal basis for US data transfers, whether through the Data Privacy Framework adequacy decision or Standard Contractual Clauses

Most websites fail at step one: they let Google Analytics fire before consent is properly initialized. This single misconfiguration violates GDPR and wastes your compliance effort. Fix this first.

The good news: proper configuration isn’t complicated. It’s straightforward once you understand the logic. But it requires discipline. Many developers will push back on “waiting” for consent. Many marketing teams will worry about data loss. Both concerns are legitimate, but neither overrides the legal requirement. When you implement Consent Mode v2 properly, you get compliant tracking and reasonably complete data through behavioral modeling. You don’t have to choose between compliance and insights.

If you’re unsure whether your configuration is correct, test it. Use Nixon Pro to check whether Google Analytics fires before consent on your pages. Google’s own Consent Mode documentation is the authoritative reference for implementation details. For additional consent validation across your entire stack, see our OneTrust validation guide. And if you want to see what other trackers are running on your website alongside Google Analytics, our guide to finding website trackers walks through the process.

Check your website’s privacy status for free

Audit your website on 4 important GDPR categories and get a clear report in minutes.

Marcel van Rijn

April 24, 2026
17:00

Marcel van Rijn

Marcel van Rijn is the founder of Nixon Digital and an expert in website privacy and compliance. With decades of experience in the digital space, he specializes in helping organizations gain control over their online presence, centralize digital assets, and meet privacy regulations such as the GDPR. His work focuses on delivering lasting oversight and practical solutions that reduce compliance risks.

Author Archive