What is Google Analytics?

Google Analytics measures traffic and behavior on websites and apps. GA4, the current version, replaced Universal Analytics and is built around events rather than pageviews and sessions.

What does Google Analytics collect?

GA4 collects device and browser information, geographic data, and on-site activity, and it mainly uses first-party cookies. Google states that when collecting data, “Google Analytics does not log or store IP addresses,” though the IP is used in transit to derive coarse location. On mobile apps it collects an app-instance identifier instead of a cookie. GA4 does not collect hashed user-provided data, such as email addresses, unless you activate user-provided data collection.

Where does the data go?

To Google, where it is processed into the reports in your Analytics property. Settings such as Google signals and data sharing control how Google may use your Analytics data. Google signals adds cross-device and demographic data for signed-in users who have Ads Personalization on.

With and without consent

GA4 can fire on page load, before a visitor consents, unless it is gated. Google Consent Mode changes how GA4 behaves before and after consent. In basic consent mode, Google tags send nothing until the visitor consents. In advanced mode they send cookieless pings when consent is denied, which Google uses for modeling. What your GA4 actually sends in each state depends on your Consent Mode and configuration.

Privacy risk:Medium

GA4 rates medium. It collects a broad set of behavioral data, but Google states it does not store IP addresses, it mainly uses first-party cookies, and it does not collect hashed personal data unless you activate user-provided data collection. The counterweight is that the data goes to Google, where settings such as Google signals and data sharing control how Google may use it. In 2022, data protection authorities in Austria, France and Italy found specific Google Analytics set-ups unlawful because EU data went to the US without adequate protection. The EU-US Data Privacy Framework (July 2023) restored a basis for these transfers. The EU General Court upheld it in September 2025, and that ruling is under appeal. Whether your GA setup is compliant depends on your configuration and region. See the Privacy & Compliance resources for the legal question.

Privacy risk is rated on four factors: breadth and sensitivity of data collected, hashed PII, third-party sharing and reach, and documented enforcement or litigation exposure. It is a data-and-exposure read to help prioritize what to check, not a legal determination.

Is Google Analytics still in use?

Yes. According to W3Techs (September 2026), Google Analytics runs on about 47% of websites and is by far the most used traffic analysis tool. GA4 is the current version: standard Universal Analytics properties stopped processing data on July 1, 2023.

How DataTrue detects Google Analytics

DataTrue recognizes it as the Google Analytics – GA4 tag type. Coverage tests find it across your site, and Simulation tests read the events and parameters it sends at each step and in each consent state, which shows whether it is firing before consent and what it reports. For how this works in the product, see the Web Analytics Testing page.

Sources: Safeguarding your data (GA4), support.google.com/analytics/answer/6004245.