Is Google Analytics 4 illegal in Europe? The actual answer in 2026

Asking whether GA4 is illegal in Europe is asking three questions in one. The answers differ depending on which one you mean. Compliance teams that conflate them either over-react (rip out GA4, lose all analytics signal) or under-react (assume DPF fixed everything, ship pre-consent firing). Neither is right in 2026.

The three questions

1. Is the transfer of EU personal data to Google’s US servers lawful under Chapter V GDPR? This is the Schrems II question.
2. Does setting a GA4 cookie or storing a client ID require consent under ePrivacy? This is the cookie banner question.
3. Does GA4 process personal data lawfully under Articles 5 and 6 GDPR? This is the legal-basis question.

All three must be answered yes for GA4 to be deployed compliantly. Most coverage collapses them into one.

Question 1, Schrems II and the DPF

Schrems II (C-311/18, July 2020) invalidated Privacy Shield as a basis for EU-US transfers, finding US surveillance law incompatible with GDPR adequacy. From 2020 to 2023 the only lawful basis was Standard Contractual Clauses plus “supplementary measures”, a legal posture the EDPB explicitly characterized as difficult to satisfy for cloud services.

That changed on 10 July 2023 when the Commission adopted an adequacy decision for the EU-US Data Privacy Framework. Google self-certified under the DPF. As a matter of black-letter law in 2026, transfers to Google for GA4 purposes are lawful provided Google’s DPF certification is current.

The challenge to the DPF has already happened. It was not brought by noyb. MEP Philippe Latombe asked the General Court to annul the adequacy decision, and on 3 September 2025 the Court dismissed the action (T-553/23), holding among other things that the US Data Protection Review Court is sufficiently independent. An appeal was lodged on 31 October 2025 and is pending before the Court of Justice as C-703/25 P. So the DPF stands today, but it stands subject to appeal, and its legal architecture is close enough to Privacy Shield that an eventual invalidation would put GA4 back in the pre-2023 state: transfer-unlawful without supplementary measures. Treat the DPF as current law and keep a documented fallback; do not treat it as settled.

Question 2, ePrivacy consent

ePrivacy Article 5(3) requires informed consent for “the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user.” This applies to all non-essential storage, cookies, localStorage, IndexedDB, fingerprinting techniques.

GA4 sets first-party cookies and stores a client ID. It is non-essential by every reasonable definition. Article 5(3) consent is required before the storage occurs.

The DPF does not change this. The DPF addresses GDPR Chapter V (transfers); ePrivacy 5(3) is a separate framework whose national-level transpositions all require pre-collection consent. A site that fires GA4 on first page load before the banner is clicked is in breach regardless of where the data ends up.

Question 3, Lawful basis under Article 6

Once you have consent (Question 2 satisfied) and a lawful transfer mechanism (Question 1 satisfied), the GA4 processing itself needs an Article 6 lawful basis. For consent-gated analytics this is Article 6(1)(a), the same consent. Legitimate interest (6(1)(f)) cannot be the basis because the EDPB has repeatedly held that tracking technologies requiring ePrivacy consent cannot then be processed under a different Article 6 basis post-collection.

What this means in practice

• You can use GA4 in the EU. Provided you obtain ePrivacy consent before any GA4 cookie is set or any client ID stored, the deployment is lawful under the current DPF.
• You must gate GA4 behind consent. No first-load firing, no “legitimate interest” arguments, no “but the data is anonymous.” Pre-consent firing is the single most common GA4 violation Veracly sees on SMB sites.
• Consent Mode v2 is not a workaround. Google’s Consent Mode v2 sends modeled aggregates when consent is denied, but it still requires consent to set any cookie. The marketing pitch can be misleading; the actual mechanism is consent-gated.
• Plan a contingency. The adequacy decision survived first instance and is under appeal (C-703/25 P). Sites with significant EU traffic should have a documented analytics fallback (Matomo, Plausible, server-side first-party analytics) that does not depend on US transfers.

The non-Google alternatives

Two categories of GA4 alternative reduce the legal-basis stack to just ePrivacy consent:

• EU-hosted analytics. Matomo (Cloud EU), Plausible (self-hosted or Plausible Cloud, EU servers). Both eliminate the transfer question. Both still require consent unless deployed in cookie-less mode.
• Cookie-less analytics. Plausible default, Cabin, Vercel Web Analytics, Fathom. These do not set cookies and use techniques (daily-rotated hashed IPs, no cross-session identifiers) designed to stay outside Article 5(3). Be careful how far you push that. The only regulator that has published a conditional exemption is the CNIL (délibérations 2020-091 and 2020-092), and it is conditional: strictly limited purpose, no cross-site tracking, aggregate output only. § 25(2) TDDDG contains no analytics exemption at all, and EDPB Guidelines 2/2023 confirm that Article 5(3) is technology-neutral, so “cookie-less” does not by itself put a tool outside its scope. Verify the specific tool in the specific member state before assuming.

Veracly’s rule entry for GA4

Veracly matches GA4 on its firing endpoints, not on the tag that loads it: google-analytics.com/g/collect, google-analytics.com/mp/collect, analytics.google.com/g/collect, and the region1 / region2.google-analytics.com regional hosts. A pre-consent hit against any of those is a pre-consent-tracker finding, graded critical under the GDPR rule pack, carrying a Schrems II jurisdictional note.

googletagmanager.com/gtag/js is deliberately not on that list, and the reason is a mistake we made and had to fix. While the loader was matched as GA4, every site whose Consent Mode v2 was correctly deferring /collect was still being reported as “GA4 firing pre-consent”. Loader scripts now produce a separate, softer pre-consent-tracker-loaded finding graded high, which says only what was actually observed: the script arrived before consent, but no data hit was seen leaving the browser. The same split applies to the Meta Pixel (/tr is the firing endpoint; connect.facebook.net is the loader).

Two limits worth stating plainly. Veracly only sees what the browser sends to a third-party host, so server-side GA4 and first-party-proxied deployments — a Measurement Protocol call made from your own server, or a tagging server on your own domain — are invisible to the scan. An absent finding is not a clean bill of health. And the absence of a post-consent finding does not mean the engine judged your post-consent deployment lawful: Veracly never clicks your cookie banner, because clicking would itself be a consent gesture and would pollute the pre-consent reading. Everything the report says is about the state of the page before anyone has consented to anything.

See also: GDPR vs ePrivacy: which one actually governs cookies? · GDPR cookie audit explained