← All posts
GDPR-compliant web analytics without consent: a legal guide to cookieless tracking
Mar 21, 2024 • Updated Aug 2, 2026 • Written by Marko Saric
On this page
Is Google Analytics GDPR compliant?
No, not without a valid legal basis and consent. Google Analytics 4 collects detailed behavioral data, uses cookies and can be used for advertising and cross-device tracking, so it doesn’t qualify for the legitimate interest exception under Art. 6(1)(f) GDPR.
It needs explicit user consent under Art. 6(1)(a) GDPR, and separately, under Art. 5(3) of the ePrivacy Directive, because it stores and reads information on the user’s device through cookies.
A Google Analytics GDPR compliance strategy therefore needs a cookie banner, a valid consent flow and a data processing agreement with Google.
Personal data, for the purposes of the GDPR, means any information relating to an identified or identifiable natural person (Art. 4 (1) GDPR). This includes obvious identifiers such as a name or email address, but also location data, an online identifier or IP address, and pseudonymous data where it remains relatively easy to re-identify the individual behind it.
- Is Google Analytics GDPR compliant? A legal guide by a data protection lawyer
- Objectives and purposes of web tracking Purpose 1: Reach measurement and web offer optimization
- Purposes 2-4: Advertising and retargeting
- Methods for carrying out website reach analysis Direct analysis of server logs
- Self-hosted web analytics tools
- Cloud-based analytics services
- Presentation of the analytics tools Google Analytics
- Plausible Analytics
- Comparison of Plausible Analytics and Google Analytics
- Data protection law (GDPR) legal assessment Legal assessment of Plausible Analytics
- Legal assessment of Google Analytics 4
- ePrivacy Directive legal assessment Legal assessment of Plausible Analytics
- Legal assessment of Google Analytics 4
- Conclusion and recommendations for action Key findings
- Recommendations for action
Is Google Analytics GDPR compliant? A legal guide by a data protection lawyer
The full legal reasoning is broken down below by Steffen Gross, an experienced data protection expert and lawyer at Simpliant Legal PartG mbB and external data protection officer at Simpliant GmbH, who explains how web analytics can be implemented in accordance with the strict requirements of the ePrivacy Directive and the GDPR.
Web tracking is crucial for understanding user behavior on websites and plays a central role in optimizing online presence.
It gives website operators the opportunity to gain valuable insights: How many visitors are navigating to their site, what are their motivations and what parts of the world are they coming from? Careful analysis of this data makes it possible to identify the most visited areas and to adapt and improve your website accordingly.
However, traditional web tracking methods, that use cookies and make you show consent banners, (e.g. Google Analytics 4), raise questions about data protection, especially when they are used for advertising purposes.
But many site owners may only need simple stats (‘reach measurement’) instead of complex tracking or complex retargeting techniques or direct advertising measures. A little-known fact: the collection of this data is also possible without cookie banners and direct user consent.
The article provides a practical guide to data protection-compliant web tracking without the need for consent or cookie banners and at the same time presents feasible approaches for legally compliant implementation.