GA4 is not compliant by default. Whether it becomes compliant depends entirely on what you do with it. Most small businesses using Google Analytics are getting at least one of three things wrong: consent, data transfer documentation, or how they have configured Consent Mode v2.
This post covers each one, in plain English.
---
When a visitor lands on your website and GA4 loads, several things happen at once. The `_ga` cookie is set on the visitor's device. Data about their session (IP address, browser, pages visited, referral source) is sent to Google's servers. That data is processed in the United States.
Each of those three steps creates a separate legal obligation under UK law.
Step one: setting the cookie. The Privacy and Electronic Communications Regulations (PECR) govern whether you can set a cookie on someone's device at all. PECR and UK GDPR operate as two separate layers: PECR applies first at the device-access layer (can you set this cookie?) and UK GDPR applies second at the data-processing layer (how can you use the data collected?). Even if you have a legitimate interest under UK GDPR for processing analytics data, that does not bypass PECR. Cookie consent is consent-only. There is no menu of lawful bases for device access.
Step two: processing the data. UK GDPR Article 6 requires a lawful basis for processing. For analytics cookies, the ICO is clear: analytics cookies are not strictly necessary and require consent. The ICO has also explicitly stated that implied consent (scrolling, continuing to browse, closing a banner) does not meet the UK GDPR standard for consent. It must be a clear, affirmative action.
Step three: the international data transfer. When Google processes your visitors' data in the US, that is a restricted transfer under Chapter V of the UK GDPR. You need a valid transfer mechanism in place. More on this below.
One important wrinkle: the new DUAA analytics exception. The Data (Use and Access) Act introduced five new consent exceptions to PECR, including one for statistical purposes. The ICO's interpretation is strict: first-party analytics used purely to understand how visitors interact with a service, and purely to improve that service, can be deployed without consent. But the conditions are tight. The data must be used for that sole purpose, with no permitted secondary use. The output must be aggregate statistical information that cannot identify individuals. If an analytics provider is involved, that provider must be a processor (not a joint controller), and must not link the data to data from other sources. Given how Google uses GA4 data, most businesses should not assume this exception applies to them without proper assessment.
---
This is the part most small businesses have never looked at.
When your UK visitors' data flows to Google's US servers, you are making a restricted transfer under UK GDPR. The US does not have a UK adequacy decision. That means you need one of the mechanisms listed in Article 46 of the UK GDPR.
There are two main options for UK-to-US transfers:
1. The IDTA (International Data Transfer Agreement). The UK's standalone transfer mechanism, which came into force on 21 March 2022. 2. The EU SCCs with the UK Addendum. A short attachment that converts the new EU Standard Contractual Clauses into a compliant solution for UK transfers. This works especially well when the same data transfer involves both EU and UK personal data.
For GA4 specifically, Google has gone a different route. Since September 2024, Google has adopted the UK Extension to the EU-US Data Privacy Framework (DPF) as a transfer mechanism for UK data. The UK Extension to the DPF is a separate instrument from the EU-US DPF: it was negotiated between the UK and US governments and provides an equivalent adequacy bridge for UK personal data flowing to certified US organisations.
This matters because Google is certified under the EU-US Data Privacy Framework, and the UK Extension operates on the same certification model. In practice, if you are using GA4 under Google's standard terms, the transfer mechanism for your UK visitors' data is the UK Extension to the DPF, backed by Google's DPF certification.
That said, the EU-US DPF's legal durability is not fully settled. A challenge at the EU General Court was dismissed in September 2025, but the claimant appealed to the Court of Justice of the EU in October 2025 (Case C-703/25 P), and that appeal is pending. The UK Extension rides on the same political and legal architecture. If the EU DPF were invalidated, the UK Extension would face similar pressure. This is a real but speculative risk. You do not need to act on it today, but you should be aware of it.
The DPA: do not skip this. UK GDPR Article 28 requires a written data processing agreement between you and any processor handling personal data on your behalf. Google provides this through its Ads Data Processing Terms, which cover both GA4 and Google Tag Manager. For businesses established in the EEA or the UK, these terms have already been incorporated into the customer agreement, but you should verify this is in place for your account. Log into your GA4 account, go to Admin, and check that the Data Processing Amendment has been accepted.
---
Picture a small e-commerce business. They installed GA4 two years ago by pasting the tag into their site header. They added a cookie banner six months later after reading something online. The banner has a single button: "Got it."
The single most common GDPR failure is loading GA before the visitor has consented to analytics cookies. In this business's case, GA4 fires on every page load, regardless of whether the visitor clicked anything. The `_ga` cookie is set. Data is sent to Google. No consent was collected.
The "Got it" banner makes this worse, not better. Implied consent (scrolling, continuing to browse, closing a banner) does not meet the UK GDPR standard. A notice-only banner with no real opt-in is not consent.
This is also a PECR breach, not just a UK GDPR breach. PECR has its own enforcement regime. Under recent DUAA amendments, PECR penalties can now reach £17.5 million or 4% of global turnover under Regulation 6.
The ICO has been conducting reviews of UK websites' cookie compliance. The ICO's audit of prominent UK websites' cookie usage has made clear that online service providers cannot overlook compliance with UK GDPR and PECR. Enforcement does not have to mean a fine. Since 2022, the ICO has published details of all reprimands it issues, naming the organisation and explaining what went wrong. For SMEs, a reprimand with published findings can be more damaging commercially than a modest fine: clients, particularly in professional services, will search the ICO register before instructing a firm.
---
Here is a practical checklist. None of these steps require a lawyer, though you should get advice if your situation is complex.
1. Audit how GA4 loads on your site. Open your site in a browser with cookies cleared. Before clicking anything, open your browser's developer tools and check the Network tab. If you see requests to `google-analytics.com` before you have clicked any consent button, GA4 is firing without consent. That is the breach.
2. Implement a real Consent Management Platform (CMP). The fix is a Consent Management Platform or cookie banner that blocks GA's script and prevents the `_ga` cookie from firing until the visitor actively opts in to analytics cookies. The gate must be real: not a notice-only banner, not a pre-checked checkbox. The visitor must make an active choice.
3. Enable Consent Mode v2. Google enforced Consent Mode v2 parameters for EEA and UK users from March 2024. If you are still running only the original v1 parameters (`analytics_storage` and `ad_storage`), you need to update. Consent Mode v2 adds two new signals: `ad_user_data` and `ad_personalization`. With consent denied, GA4 switches from cookie-based tracking to cookieless pings. Google uses those pings and its machine-learning models to estimate conversion behaviour for users who declined. You will see less data from users who decline. That is correct. Consent Mode makes that absence compliant, not lossless.
4. Confirm your DPA is in place. Log into your GA4 Admin panel. Confirm that Google's Ads Data Processing Terms have been accepted for your account. If you are outside the EEA or UK, you may need to accept them manually in your Account Settings.
5. Check your transfer mechanism. For most businesses using GA4 under standard Google terms, the UK Extension to the DPF covers the transfer. Confirm Google's current DPF certification status at the US Department of Commerce's DPF list. If you are using custom server-side setups or routing data through additional processors, you may need additional transfer documentation.
6. Record everything in your ROPA. UK GDPR Article 30 requires most organisations to maintain a Record of Processing Activities (ROPA). GA4 should appear as a processing activity: purpose (website analytics), lawful basis (consent), data categories (online identifiers, behavioural data), processor (Google Ireland Limited), transfer mechanism (UK Extension to the DPF), retention period (set in your GA4 data retention settings, default 2 months for user-level data).
---
If you are not sure whether your business is covered, Rowpa generates your full ROPA in 15 minutes. Start free at rowpa.app.
---
This post is for information only and does not constitute legal advice.