If your website uses Google Analytics, your privacy policy should explain what data GA4 collects, how cookies and identifiers are used, why the data is collected, Google’s role in processing it, and what choices visitors have. Google requires these disclosures, and privacy laws such as the GDPR and CCPA expect the same level of transparency. This guide explains the key requirements and includes a sample Google Analytics privacy policy you can customize for your website.
What is Google Analytics?
Google Analytics is a measurement platform that helps website and app owners understand user activity. Website owners add Google’s measurement code to their pages. When a visitor opens a page, that code collects information about the visit and sends it to Google Analytics for processing.
The measurement code may collect information from the browser, including language settings, browser type, device type, operating system, and traffic source. A traffic source can be a search engine, an ad, or an email campaign. For a business, this becomes a dashboard. For a visitor, it means their website interaction may be measured through cookies, identifiers, device data, and event data.
Why do Google Analytics users need a privacy policy?
Google Analytics Terms of Service require website owners to maintain a privacy policy and disclose their use of Google Analytics, cookies, and similar technologies.
You need a privacy policy for Google Analytics for two reasons.
First, Google requires it. Under the Google Analytics Terms of Service, users must have an appropriate privacy policy, comply with applicable privacy laws, provide notice of cookies or mobile identifiers, and disclose the use of Google Analytics and how it collects and processes data.
Second, privacy laws generally require transparency when personal data is collected. Under GDPR Article 13, controllers must inform users about the purposes and legal basis of processing, recipients of personal data, retention periods, user rights, and other key details at the time data is collected.
The same idea appears in California privacy law. The CCPA gives California residents the right to know what personal information a business collects, the sources of that information, the purposes for use, the third parties it is shared with, and whether it is sold or disclosed. So, a Google Analytics privacy policy explains the tracking that happens when the tool runs on your website.
Using Google Analytics on your website?
Generate a privacy policy with the disclosures your visitors and privacy laws expect to see.
Create Privacy Policy14-day free trialCancel anytime
What data does Google Analytics collect?
Google Analytics can collect different types of data depending on your configuration. A basic setup usually involves:
- first-party cookies
- device and browser data
- IP address information
- on-site or in-app activity
- traffic source data
- user interaction events
- app instance identifiers for apps
Google states that Analytics usually collects this data to measure and report statistics about user interactions. If Google Analytics is linked with Google Ads, additional cookies may be set to help measure interactions with your business.
What should a Google Analytics privacy policy include?
Google does not require a separate privacy policy for Google Analytics. Instead, it requires websites using Google Analytics to maintain a privacy policy that explains how analytics data is collected and used. Specifically, Google requires you to disclose your use of cookies or similar technologies, your use of Google Analytics, and how Google Analytics collects and processes data. These requirements closely align with the transparency obligations found in privacy laws such as the GDPR and CCPA.
So, rather than creating a standalone Google Analytics privacy policy, the better approach is to incorporate these disclosures into the relevant sections of your existing privacy policy. The sections below explain what information to include and where it should appear.
Keeping cookie disclosures accurate can be difficult because cookies change whenever you add new tools, plugins, or marketing tags. A cookie scanner can help identify active cookies and generate an up-to-date cookie inventory for your privacy policy.
Say that you use Google Analytics
First on the checklist is to inform your users that you use Google Analytics. Here is an example from KPMG’s privacy policy.
Morgan Stanley gives this information in their cookie policy like this:
Sample clause:
We use Google Analytics to understand how visitors use our website and to improve website performance. To know more about how we use Google Analytics, visit https://policies.google.com/technologies/partner-sites.
Explain what data is collected
Your privacy policy should specify all categories of personal data that your organization collects. Use plain language. For example, Western Union keeps it this way:
Mention cookies and identifiers
Google Analytics commonly uses cookies to distinguish one user’s session from another. Your privacy policy should say this clearly. And if you have a cookie policy, link to it from your privacy policy.
Pearson gives the cookie information and relevant links to Google’s resources within their privacy policy.
State purpose of data collection
Do not stop at “improve our website.” Be more specific.
You may use Google Analytics to:
- measure website traffic
- understand page performance
- identify popular content
- detect navigation issues
- measure campaign performance
- improve user experience
The above example from Pearson specifies the purposes clearly.
Here is another example from CookieYes cookie policy:
Disclose Google Analytics Advertising features
If you use Google Signals, remarketing, Google Ads linking, demographics and interests reporting, or advertising personalization, a standard analytics disclosure is not enough. These features enable Google advertising cookies to be collected and used for ad targeting on the Google Display Network, so your privacy policy must go further. It should clearly state:
- Which Google Analytics Advertising Features you use
- That Google advertising cookies are collected and used as a result
- Links to Google’s Privacy Policy and the Google Analytics Advertising Features policy
- How users can opt out, via Google’s Ads Settings, the Google Analytics opt-out browser add-on, or industry tools such as the Network Advertising Initiative opt-out page
Here is how NN/G discloses this in their privacy policy
Note: Google now requires websites targeting the EU, UK, or Switzerland to use a certified Consent Management Platform (CMP). Generic cookie banners are no longer enough; your site must pass explicit compliance signals.
Include your data retention period
Your privacy policy should state how long you retain personal data, the criteria used to determine that period, and whether users have the right to request deletion. This applies to all personal data you collect, not just analytics data.
For Google Analytics specifically, the retention period depends on your GA4 property settings. GA4 gives you control over how long user-level and event-level data is stored before automatic deletion. The _ga_* cookie, for example, persists in the user’s browser for 1 year and 4 months, as shown in the cookie policy table below. Make sure to check your actual setting before writing your privacy policy.
Explain opt-out options
Users should know how to stop or limit analytics tracking. Google offers a Google Analytics Opt-out Browser Add-on that allows users to disable data use by Google Analytics JavaScript, including analytics.js and gtag.js.
Also inform them about other ways to control information shared with Google through tools such as Ad Settings, My Activity, browser cookie settings, and the Google Analytics browser add-on.
Add user rights
If your website is subject to GDPR, your policy should explain user rights such as access, rectification, erasure, objection, restriction, portability, and withdrawal of consent where consent is used. GDPR Article 13 requires disclosure of user rights and the right to withdraw consent where processing is based on consent.
If your website is subject to CCPA/CPRA, your policy should explain rights such as the right to know, delete, correct, opt out of sale or sharing, limit sensitive personal information, and non-discrimination.
Google Analytics sample privacy policy template
Use this as a starting point. Edit it based on your actual GA4 setup, cookie banner, retention settings, and advertising features.
Privacy Policy
[Company Name] (“we”, “us”, or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit our website or use our services. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.
By visiting [website URL] (the "Site") or using our services or apps, you are accepting and consenting to the practices described in this Privacy Policy.
1. Information We Collect
We may collect information that you provide directly to us, such as your name, email address, phone number, company name, billing information, and any details you submit through forms or support requests.
We may also collect certain information automatically when you visit our website, including IP address information, browser type, device information, operating system, pages visited, time spent on pages, referring website, and interactions with our website.
Other information we collect includes:
- [personal info]
- [personal info]
We may also collect the following sensitive information when necessary with your consent or as otherwise permitted by applicable law:
- [Sensitive info]
- [Sensitive info]
Some of this information is collected through cookies and analytics tools, including Google Analytics.
1.1 If You Fail to Provide Personal Data
Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.
2. How is Personal Data Collected
We use different methods to collect data from and about you, including via:
- Source name: Description
- Source name: Description
3. How We Use Your Information
We have set out below, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate. Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.
- [Purpose, category of data used, legal basis]
- [Purpose, category of data used, legal basis]
4. Cookies and Similar Technologies
We use cookies and similar technologies to operate our website, remember preferences, improve user experience, and analyze how visitors interact with our website.
A. Strictly Necessary Cookies
These cookies are required for our website to function and cannot be disabled. They are typically set in response to actions you take, such as logging in, setting privacy preferences, or completing forms.
| Cookie Name | Purpose | Provider | Duration |
|---|---|---|---|
| [Cookie Name] | [Explain what the cookie does] | [Company placing the cookie] | [Session / 30 days / 1 year / etc.] |
B. Functional Cookies
Functional cookies enable enhanced features and personalization. They may be set by us or by third-party providers whose services we have added to our pages.
| Cookie Name | Purpose | Provider | Duration |
|---|---|---|---|
| [Cookie Name] | [Explain what the cookie does] | [Company placing the cookie] | [Session / 30 days / 1 year / etc.] |
C. Analytics Cookies
Analytics cookies help us understand how visitors interact with our website.
They may collect information about pages visited, navigation paths, time spent on pages, website performance, user interactions, and traffic sources.
We may use Google Analytics and similar analytics services to generate reports about website usage and improve our services.
| Cookie Name | Purpose | Provider | Duration |
|---|---|---|---|
| [Cookie Name] | [Explain what the cookie does] | [Company placing the cookie] | [Session / 30 days / 1 year / etc.] |
D. Advertising and Targeting Cookies
Advertising cookies help deliver relevant advertisements and measure campaign effectiveness.
These cookies may be used to build audience segments, limit ad repetition, measure advertising performance, support remarketing activities, and personalize advertisements.
Advertising cookies may be placed by us or by third-party advertising partners.
| Cookie Name | Purpose | Provider | Duration |
|---|---|---|---|
| [Cookie Name] | [Explain what the cookie does] | [Company placing the cookie] | [Session / 30 days / 1 year / etc.] |
5. Google Analytics
We use Google Analytics, a web analytics service provided by Google LLC, to analyze how visitors use our website. Google Analytics uses cookies to collect information about website usage, including pages visited, session duration, device type, geographic location, and traffic sources.
The data collected through Google Analytics is transmitted to and stored on Google servers, which may be located outside your country.
Google may use this data in accordance with its own privacy policy. You can opt out of Google Analytics by installing the Google Analytics opt-out browser add-on.
For more information about how Google uses data from websites that use its services, visit:
https://policies.google.com/technologies/partner-sites
6. Google Analytics Advertising Features
[Include this section only if applicable.]
We may use Google Analytics Advertising Features, including remarketing, Google Signals, demographic reporting, interest reporting, or Google Ads integration.
These features may use additional cookies or identifiers to help measure advertising performance and show relevant ads.
You can manage ad personalization through Google Ad Settings:
https://adssettings.google.com
7. Sharing Your Information
We may share personal information with service providers that help us operate our website and services, including hosting providers, analytics providers, payment processors, marketing platforms, and customer support tools.
We may also disclose information where required by law, to protect our rights, prevent fraud, enforce agreements, or complete a business transaction.
We do not sell personal information to third parties.
[Optional: Include the following section if you sell, share, or disclose personal information in a way that may be considered a sale or sharing under applicable privacy laws.]
We may sell, share, or disclose certain categories of personal information to third parties for purposes such as advertising, marketing, analytics, business partnerships, or other commercial activities, where permitted by applicable law.
The categories of personal information that may be sold or shared include:
- [Personal information]
- [Personal information]
The categories of third parties that may receive this information include:
- [Category]
- [Category]
Depending on your location, you may have the right to opt out of the sale or sharing of your personal information. To exercise this right, please use our "Do Not Sell or Share My Personal Information" link or contact us using the details provided in this Privacy Policy.
8. Data Retention
We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by law.
You can request deletion of your data as described in the “Your Rights” section.
9. Security of Your Information
We implement reasonable technical, administrative, and organizational measures designed to protect personal information against unauthorized access, loss, misuse, disclosure, alteration, or destruction.
However, no method of transmitting information over the internet or storing information electronically is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security.
If we become aware of a security incident affecting your personal information, we will take appropriate steps to investigate, mitigate the impact, and provide any notifications required by applicable law.
10. Your Rights and Choices
Depending on your location, you may have certain rights regarding your personal information, including the right to access, correct, delete, or restrict processing of your data. You may also have the right to object to certain processing activities or to receive a copy of your data in a portable format.
To exercise these rights, please contact us using the information provided at the end of this policy.
You may also manage your cookie preferences at any time through our cookie consent tool or by adjusting your browser settings.
11. Children’s Privacy
Our website is not intended for children under the age required by applicable law, and we do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without appropriate authorization or consent, we will take reasonable steps to delete the information as soon as practicable.
If you believe a child has provided personal information through our website, please contact us using the details provided in this Privacy Policy.
Optional: If your website, app, or service is intended for children or knowingly collects children's personal information
Where we knowingly collect personal information from children, we do so in accordance with applicable laws and obtain parental or guardian consent where required. Parents or legal guardians may contact us to review, update, correct, or request deletion of their child's personal information.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page with a revised effective date. We encourage you to review this policy periodically.
13. Contact Us
If you have questions about this Privacy Policy, contact us at:
[Company Name][Address]
[Email Address]
[Phone Number]
Note: This template is for general guidance and does not constitute legal advice. Customize it to reflect your actual data collection, cookies, third-party services, and privacy practices.
Generate a custom Privacy Policy in minutes
Create a customized privacy policy for your website without writing every clause from scratch.
Generate your privacy policy14-day free trialCancel anytime
Do you need cookie consent for Google Analytics?
Yes, in most cases. Under Google’s Terms of Service, you must provide clear information about any cookies or similar technologies stored on users’ devices and obtain consent where applicable law requires it.
Under the GDPR and UK GDPR, analytics cookies are not strictly necessary and therefore require prior, informed consent from EU and UK visitors before they fire. A narrow exemption exists in a small number of jurisdictions for purely statistical, non-cross-site analytics, but it does not apply in most cases and does not apply to GA4 when used with advertising features, remarketing, or audience targeting. In those scenarios, analytics data feeds into ad personalization, which carries the stricter requirements of consent under the ePrivacy Directive. If you serve EU or UK traffic, you need a compliant consent mechanism, such as a Google-certified CMP, before loading Google Analytics.
CookieYes automatically blocks Google Analytics until consent is obtained, supports Google Consent Mode v2, maintains consent records, and allows users to update their preferences through a persistent consent widget.
Make Google Analytics consent-ready
Automatically manage consent preferences, block analytics cookies before consent, and keep a record of user choices.
Sign up for free14-day free trialCancel anytime
Common Google Analytics privacy policy mistakes
- Saying only “we use analytics“: That does not explain what happens. Name Google Analytics and describe the data categories.
- Forgetting cookies: GA4 commonly uses first-party cookies. Your policy should mention them by name where possible.
- Missing the Google disclosure: Google’s Terms require you to disclose the use of Google Analytics and how it collects and processes data.
- Copying a template without checking GA4 settings: A sample privacy policy for Google Analytics is useful, but only if it matches your setup.
- Ignoring advertising features: Google Analytics with advertising features has different privacy implications from basic analytics. Mention remarketing, ad personalization, demographics, interests, or Google Ads linking if you use them.
- No opt-out information: Users should know how to manage analytics cookies and where to find Google’s opt-out browser add-on.
Use the Advanced Cookie Scanner to identify every cookie and tracker currently active on your website. Compare the results against what your privacy policy or cookie policy discloses.
Free Privacy Policy Template for Google Analytics
Creating a privacy policy for Google Analytics does not require starting from zero. Use a Free Privacy Policy Generator to create a privacy policy tailored to your site’s data collection activities.
Where and how to display your privacy policy
Footer and data collection points
A footer link is the minimum standard. At every data collection point, including sign-up forms, checkout pages, and contact forms, display a short notice with a link to the full policy. For mobile apps using GA4, the privacy policy must appear in the app store listing and be accessible within the app.
Cookie banner
You can also link your privacy policy from the cookie banner. If the GA4 specific cookie details are in your cookie policy, you should link that too.
What happens if you use Google Analytics without a proper privacy policy?
Non-compliance with privacy laws can lead to regulatory investigations, enforcement actions, fines, and reputational damage. Under the GDPR, certain violations may result in fines of up to €20 million or 4% of annual worldwide turnover, whichever is higher. In addition, failure to comply with the Google Analytics Terms of Service may result in Google suspending or terminating your access to Google Analytics.
Ready to publish your privacy policy?
Create a customized privacy policy for your website without writing every clause from scratch.
Generate your privacy policy14-day free trialCancel anytime
Frequently Asked Questions
Yes. Both Google’s own Terms of Service and applicable privacy laws like GDPR and CCPA require you to maintain a publicly accessible privacy policy that discloses your use of Google Analytics, the data collected, the legal basis for processing, and how users can opt out.
Under GDPR, GA4 scripts must be blocked until the user gives consent. A Consent Management Platform handles this automatically, fires Google Analytics post-consent, and passes consent signals via Google Consent Mode v2.
Here are three methods:
(1) Deploy a cookie consent banner that blocks GA before consent is given
(2) Provide a link to the Google Analytics Opt-out Browser Add-on
(3) Offer a “Do Not Sell or Share My Personal Information” link (CCPA) if Advertising Features are active.
In many jurisdictions, including the EU and UK, analytics cookies generally require consent before they are set. Therefore, websites using Google Analytics typically need a consent mechanism before analytics tracking begins.
CIPP/E from the International Association of Privacy Professionals (IAPP) | Data privacy writer at CookieYes.
