Research guide
Google Analytics privacy policy requirements
The Google Analytics Terms of Service require you to have and abide by an appropriate privacy policy that discloses your use of cookies or identifiers and how Google Analytics collects and processes data, and to display a prominent link to Google's page explaining how it uses information from sites or apps that use its services. You must also obtain consent where the law requires it, including under Google's EU user consent policy for visitors in the EEA, UK, and Switzerland.
What section 7 of the terms requires
Section 7 of the Google Analytics Terms of Service, on privacy, requires customers to have and abide by an appropriate privacy policy and to comply with applicable laws on collecting information from visitors. The policy must provide notice of the use of cookies, identifiers for mobile devices, or similar technology used to collect data, and must disclose the use of Google Analytics and how it collects and processes data. The terms call for a prominent link to Google's page titled How Google uses information from sites or apps that use our services, or equivalent notice.
What data Google Analytics processes
Google Analytics collects page and screen views, events, referrers, campaign parameters, device and browser information, approximate location derived from the IP address, and session and engagement measures, keyed to cookies on the web and app instance identifiers in apps. If you enable user-ID, send custom dimensions, link Google Ads, turn on Google signals, or import cost or CRM data, more data is involved. Describe the features you enabled, not the whole product.
Consent and Consent Mode
In the EEA, UK, and Switzerland, analytics cookies generally require prior consent, and Google's EU user consent policy requires publishers using Google products to obtain consent where legally required and to identify each party that uses personal data. Google's Consent Mode adjusts tag behavior based on consent choices; describe how your implementation behaves before and after a choice, including whether cookieless pings are sent. Do not describe analytics as consent-based if tags run before the banner is answered.
Settings that change your disclosure
Review data retention, data sharing settings with Google, Google signals, advertising personalization, granular location and device data collection, user-provided data collection, and links to Google Ads or BigQuery. Each can change what should appear in the policy, especially if analytics data is used for advertising audiences, which may be sharing or targeted advertising under US state laws.
Transfers and Google's role
Google acts as a processor for Google Analytics data under its data processing terms, while data sharing settings, if enabled, allow Google to use data for its own purposes. Analytics data may be processed in the United States and other countries; your transfer section should name the safeguard relied on, such as the EU-US Data Privacy Framework or standard contractual clauses as set out in Google's terms.
User choices
Explain how users can change consent through your cookie settings link, block cookies in the browser, or install Google's browser add-on for opting out of Google Analytics, and whether you honor opt-out preference signals where required. For apps, describe any in-app analytics toggle.
Apps using Google Analytics for Firebase
In mobile apps, Google Analytics is usually added through the Firebase SDK, which collects app instance identifiers, device information, and in-app events and may read the advertising identifier where enabled. The same terms apply, and the data types must also appear in Google Play Data safety and Apple App Privacy answers. The Firebase disclosure guide explains the app-specific settings.
Generating a Google Analytics disclosure
Select standard product analytics or advertising-linked analytics in the questionnaire, then choose Google Analytics as the provider and describe your tracking-consent behavior. The generated analytics section names Google Analytics and explains cookies, purposes, and choices. Add the link to Google's partner-sites page near that section if your template does not include it, because the terms call for it.
Official sources checked for this guide
Platform rules and legislation can change. Verify the current text before publishing or making a high-risk decision.
Common questions
Is it enough to mention Google Analytics in a cookie banner?
No. The terms require an appropriate privacy policy with the disclosures, and a banner alone does not explain collection, processing, and choices.
Does GA4 remove the need for consent?
No. Consent requirements depend on the law where visitors are, not the product version. GA4 settings can reduce data collected but do not remove the need to disclose it.