Google Analytics

Overview

Google Analytics is the most widely deployed web analytics platform, used by millions of websites to measure traffic, user behavior, and conversion performance. The current version (GA4) uses an event-based data model, replacing the session-based Universal Analytics (UA).

What This Script Does

The Google Analytics script (gtag.js or the older analytics.js) loads from googletagmanager.com and collects the following data on every page view and interaction:

Cookies set:

• _ga — Client ID cookie (first-party, 2-year expiry). Generates a unique identifier per browser to distinguish unique visitors and track them across sessions.
• _ga_<MEASUREMENT_ID> — Session cookie (first-party, 2-year expiry). Stores session state including session count, engagement time, and session start timestamp.
• _gid — Daily visitor identifier (first-party, 24-hour expiry). Used in Universal Analytics; deprecated in GA4.
• _gat — Throttle cookie (first-party, 1-minute expiry). Rate-limits requests to Google Analytics.

Data collected per hit:

• Page URL, title, and referrer
• Browser and device information (user agent, screen resolution, language)
• IP address (used for geolocation, then truncated in GA4 by default)
• Client ID (from _ga cookie)
• Event name and parameters (page_view, scroll, click, etc.)
• Traffic source and campaign attribution (utm parameters)
• User-defined custom dimensions and metrics

Network requests fire to google-analytics.com/g/collect (GA4) or google-analytics.com/collect (UA). Each request transmits the above data as query parameters.

Cross-domain tracking: When configured, GA4 decorates outbound links with a _gl parameter containing the client ID, enabling user tracking across multiple domains you own.

Google Signals: When enabled, GA4 links analytics data with Google account data from signed-in users, enabling cross-device reporting and demographics. This significantly expands the personal data scope.

Consent & Compliance

Google Analytics falls under the analytics consent category.

Under GDPR and ePrivacy, Google Analytics requires explicit opt-in consent before loading. The _ga cookie is a persistent unique identifier that constitutes personal data (an "online identifier" under GDPR Article 4). Multiple EU Data Protection Authorities have issued rulings on Google Analytics:

• The Austrian DSB and French CNIL ruled that Google Analytics transfers to US servers violated GDPR (pre-EU-US Data Privacy Framework rulings).
• The EU-US Data Privacy Framework (adopted July 2023) provides a legal basis for US transfers, but requires Google's self-certification and appropriate safeguards.
• Several DPAs have stated that Google Analytics requires consent regardless of IP anonymization settings.

Under CCPA, Google Analytics data collection constitutes processing of personal information. If analytics data is used for cross-context behavioral advertising (e.g., via Google Signals or linked Google Ads accounts), it may constitute "sharing" requiring opt-out rights.

Google Consent Mode v2 allows the GA4 tag to operate in a restricted mode when analytics_storage=denied. In this mode, GA4 sends cookieless pings that do not set the _ga cookie and transmit limited data. Google uses this data for conversion modeling. Whether these cookieless pings require consent is debated — some DPAs consider any data transmission to a third party as requiring consent.

Server-side Google Analytics: Some implementations proxy GA4 through a first-party endpoint to reduce third-party cookie dependencies. This does not eliminate consent requirements — the data still reaches Google's servers and the processing purpose remains analytics.

Should You Block This Without Consent?

Yes. Google Analytics sets persistent tracking cookies, generates unique visitor identifiers, and transmits behavioral data to Google's servers. It is the canonical example of a non-essential analytics tool requiring consent under GDPR/ePrivacy. Block the script entirely until the user grants analytics consent. If using Google Consent Mode v2, you may load the tag in cookieless mode without consent, but consult your DPA's guidance on whether cookieless pings require consent in your jurisdiction.