GA4 Privacy and Compliance

GA4 Privacy and Compliance

Expert guidance for GA4 privacy including GDPR, CCPA, Consent Mode v2, and data deletion.

Overview

GA4 provides privacy-focused features for GDPR, CCPA, and global privacy regulations including Consent Mode, data controls, and compliance workflows.

Consent Mode v2

What is Consent Mode

Google's API for communicating user consent status to GA4, Google Ads, and other Google tags.

Consent Parameters

Consent Mode v2 Requirements

As of March 2024, v2 parameters required for EU/EEA:

• ad_user_data
• ad_personalization

Without these, remarketing lists won't populate for EU users.

Implementing Consent Mode

Basic gtag.js Implementation

Step 1: Set Default Consent (BEFORE gtag.js loads)

<script>
  // Set default consent to denied
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}

  gtag('consent', 'default', {
    'ad_storage': 'denied',
    'ad_user_data': 'denied',
    'ad_personalization': 'denied',
    'analytics_storage': 'denied'
  });
</script>

<!-- Then load gtag.js -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"></script>
<script>
  gtag('js', new Date());
  gtag('config', 'G-XXXXXXXXXX');
</script>

Step 2: Update Consent After User Choice

// User accepts all cookies
gtag('consent', 'update', {
  'ad_storage': 'granted',
  'ad_user_data': 'granted',
  'ad_personalization': 'granted',
  'analytics_storage': 'granted'
});

// User accepts only analytics
gtag('consent', 'update', {
  'ad_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied',
  'analytics_storage': 'granted'
});

// User denies all
gtag('consent', 'update', {
  'ad_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied',
  'analytics_storage': 'denied'
});

GTM Implementation

Method 1: Using CMP Template

Most CMPs (OneTrust, Cookiebot, etc.) provide GTM templates:

1. Install CMP template from Community Gallery
2. Configure default consent in template
3. Template auto-updates consent on user choice

Method 2: Manual GTM Setup

Create Consent Initialisation Tag:

1. Tag Type: Custom HTML
2. Code:

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('consent', 'default', {
    'ad_storage': 'denied',
    'analytics_storage': 'denied',
    'ad_user_data': 'denied',
    'ad_personalization': 'denied'
  });
</script>

3. Trigger: Consent Initialisation - All Pages
4. Tag firing priority: 999 (fires first)

Create Consent Update Tag:

1. Tag Type: Custom HTML
2. Trigger: Custom event from CMP

Regional Settings

EU-Specific Consent

// Denied for EU countries, granted elsewhere
gtag('consent', 'default', {
  'ad_storage': 'denied',
  'analytics_storage': 'denied'
}, {
  'region': ['AT', 'BE', 'BG', 'HR', 'CY', 'CZ', 'DK', 'EE', 'FI',
             'FR', 'DE', 'GR', 'HU', 'IE', 'IT', 'LV', 'LT', 'LU',
             'MT', 'NL', 'PL', 'PT', 'RO', 'SK', 'SI', 'ES', 'SE', 'GB']
});

// Granted for non-EU
gtag('consent', 'default', {
  'ad_storage': 'granted',
  'analytics_storage': 'granted'
});

California (CCPA)

gtag('consent', 'default', {
  'ad_storage': 'granted',
  'analytics_storage': 'granted'
}, {
  'region': ['US-CA']
});

Consent Mode Behaviour

When analytics_storage = "denied"

When analytics_storage = "granted"

Conversion Modelling

When consent denied, GA4 uses:

• Machine learning to estimate conversions
• Aggregated, anonymised data
• Behavioural patterns
• "Modelled" label in reports

Data Retention

Configuration

Path: Admin -> Data Settings -> Data Retention

What's Affected

Affected (user/event data in Explorations):

• User-level data
• Event-level data
• User Explorer report

Not Affected (aggregated data):

• Standard reports
• Conversion data
• Audience data

Reset on New Activity

• ON: Timer resets when user returns
• OFF: Data deleted at fixed date

Data Deletion Requests

GDPR Article 17 (Right to Erasure)

Path: Admin -> Data Settings -> Data Deletion Requests

Process

1. Click "Create deletion request"
2. Select parameter:
   • User ID
   • Client ID (user_pseudo_id)
   • App Instance ID
3. Enter identifier value
4. Choose date range or "All time"
5. Submit request

Processing

• Takes up to 72 hours
• Deletes ALL events for identifier
• Cannot be undone
• Confirmation email sent

Best Practice

• Maintain deletion request log
• Respond within 30 days (GDPR)
• Document process in privacy policy

IP Anonymisation

GA4 Default Behaviour

• GA4 does NOT log or store IP addresses
• IP used only for geolocation derivation
• No additional anonymisation needed
• Privacy-first by design

Unlike Universal Analytics

• No anonymize_ip parameter needed
• IP never in reports or exports
• Location derived, IP discarded

Google Signals

What It Enables

• Demographics (age, gender)
• Interests reporting
• Cross-device tracking (without User ID)
• Remarketing audiences

Privacy Implications

• Requires consent for personalised ads
• Subject to data thresholds
• User opt-out via Ads Settings

Configuration

Path: Admin -> Data Settings -> Data Collection

• Enable only with proper consent
• Respect user opt-outs
• Document in privacy policy

GDPR Compliance Checklist

Legal Requirements

• Privacy policy updated with GA4 usage
• Cookie consent banner implemented
• Legal basis documented (consent/legitimate interest)
• DPA with Google signed
• Cross-border data transfer disclosures

Technical Implementation

• Consent Mode v2 configured
• All 4 v2 parameters set (ad_storage, analytics_storage, ad_user_data, ad_personalization)
• Default consent = denied for EU
• Consent updates on user acceptance
• Data retention configured

Operational Processes

• Data deletion process documented
• User opt-out mechanism available
• Regular privacy audit schedule
• Staff training on procedures

CCPA Compliance

Requirements

• Allow opt-out of "sale" of personal information
• "Do Not Sell My Personal Information" link
• Honor Global Privacy Control (GPC)

GPC Implementation

// Detect GPC signal
if (navigator.globalPrivacyControl) {
  gtag('consent', 'update', {
    'ad_storage': 'denied',
    'ad_user_data': 'denied',
    'ad_personalization': 'denied',
    'analytics_storage': 'granted'  // Analytics OK, ads denied
  });
}

GTM Variable for GPC

1. Variable Type: JavaScript Variable
2. Global Variable Name: navigator.globalPrivacyControl
3. Use in consent logic

Consent Management Platforms

Popular CMPs

• OneTrust
• Cookiebot
• Termly
• Osano
• TrustArc

GTM CMP Templates

1. Community Template Gallery -> Search CMP
2. Install template
3. Configure settings
4. Auto-updates consent to GA4

Testing Consent Mode

Verification Steps

1. DebugView Test:

• Before consent: Check analytics_storage = denied
• After consent: Check analytics_storage = granted

2. Check Event Parameters:

• Look for gcs parameter (Google Consent State)
• Events include consent status

3. Cookie Inspection:

• Before consent: No _ga cookie
• After consent: _ga cookie set

4. GTM Preview:

• Consent Initialisation fires first
• GA4 tag respects consent
• Consent update fires on user action

Chrome DevTools Check

// Check current consent state
dataLayer.filter(item => item[0] === 'consent')

Server-Side Consent

Measurement Protocol

{
  "client_id": "client_123",
  "consent": {
    "ad_storage": "denied",
    "analytics_storage": "granted",
    "ad_user_data": "denied",
    "ad_personalization": "denied"
  },
  "events": [...]
}

Best Practice

• Pass consent from frontend to backend
• Include in all Measurement Protocol requests
• Store user preferences in database

Quick Reference

Consent Parameters (v2)

gtag('consent', 'default', {
  'ad_storage': 'denied',
  'analytics_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied'
});

Update After Consent

gtag('consent', 'update', {
  'ad_storage': 'granted',
  'analytics_storage': 'granted',
  'ad_user_data': 'granted',
  'ad_personalization': 'granted'
});

Data Deletion

Admin -> Data Settings -> Data Deletion Requests -> Create

Key Compliance Points

• v2 parameters required for EU (March 2024)
• Default to denied, update on consent
• Data retention: 2 or 14 months
• No IP storage in GA4
• Respond to deletion within 30 days