GDPR and Google: Analytics, Ads, and Fonts Compliance Guide

If your website runs Google Analytics, Google Ads, Google Tag Manager, or even a remotely hosted Google font, GDPR and Google compliance is your responsibility, not Google's. Regulators have repeatedly held site operators liable for tags they placed on their own pages, even when the data ends up with a company the size of Google. This guide explains what the General Data Protection Regulation (GDPR) actually requires when you use Google services, what regulators have enforced, and what to change on your site. It is educational content rather than legal advice, so consult a qualified attorney for guidance specific to your business.

What GDPR and Google Compliance Actually Means

A GDPR compliant Google setup is one where every Google tag on your site has a valid lawful basis under Article 6, a signed data processing agreement under Article 28, a valid transfer mechanism under Chapter V, and accurate disclosure to users under Articles 13 and 14. Google supplies the contracts and the technical controls. You supply the consent, the configuration, and the transparency.

That split matters because enforcement follows it. When a data protection authority investigates a website using Google Analytics, the fine or corrective order usually lands on the website operator, not on Google. The Austrian DSB decision of January 2022 and the CNIL decisions of February 2022 were both directed at the site operators who deployed the tag.

Three separate legal regimes apply at once, and confusing them is the most common mistake:

• The ePrivacy Directive (Article 5(3)) governs storing or reading anything on a user's device. This covers cookies, localStorage, and device fingerprinting, and it requires prior consent for anything not strictly necessary.
• The GDPR governs what happens to the personal data afterwards: lawful basis, purposes, retention, rights, and transfers.
• Google's own contractual policies, including the EU user consent policy, sit on top of both and can cause account-level enforcement independent of any regulator.

Which Google Services Fall Under GDPR

Any Google service that receives an IP address, a cookie ID, an advertising identifier, or a user identifier is processing personal data under Article 4(1) of the GDPR. That definition is broad enough to catch services people rarely think of as tracking tools.

The Google services most commonly found on business websites are:

• Google Analytics 4: sets first-party cookies, sends events and identifiers to Google servers.
• Google Ads (gtag, conversion tracking, remarketing): sets advertising cookies and can build audiences.
• Google Tag Manager: loads other tags, receives the visitor's IP as part of the container request.
• Google Fonts (remote): transmits the IP address to Google on every page load.
• YouTube embeds: set cookies unless you use the youtube-nocookie.com domain, and even then the request itself discloses the IP.
• Google Maps embeds: transmit IP and, if enabled, precise location.
• reCAPTCHA: collects device and behavioral signals for bot detection.
• Google Fonts API, Firebase, and Google Sign-In: all involve transfers of identifiers.

A useful rule: if a request leaves the visitor's browser and lands on a Google domain, personal data has been processed and you need to account for it. Running a compliance scan on your own site is the fastest way to build that inventory, because tag managers and marketing plugins frequently add Google requests nobody documented.

Controller or Processor: How Responsibility Is Split

Google plays different roles depending on the service, and your obligations change accordingly. Getting this wrong produces privacy policies that misstate who is responsible for what.

Google service	Google's role	Governing terms
Google Analytics 4	Processor	Google Ads Data Processing Terms
Google Tag Manager	Processor	Google Ads Data Processing Terms
Google Ads conversion measurement	Processor	Google Ads Data Processing Terms
Google Ads audiences and personalization	Independent or joint controller	Controller-to-Controller Data Protection Terms
Google Fonts, Maps, reCAPTCHA	Independent controller	Google Privacy Policy

When Google acts as your processor, Article 28 of the GDPR requires a written agreement covering processing scope, confidentiality, security, sub-processors, and deletion. Google's Ads Data Processing Terms are accepted inside the Google Ads and Analytics admin interfaces, and many advertisers have never confirmed they are actually accepted for their account.

When Google acts as an independent controller, you are not passing data under your instructions. You are disclosing it to a separate controller, which means you need a lawful basis for that disclosure and must name Google as a recipient category in your privacy notice under Article 13(1)(e).

GDPR and Google Analytics: The Transfer Question

Between January 2022 and 2023, the Austrian DSB, France's CNIL, Italy's Garante, and Denmark's Datatilsynet each found that specific Google Analytics implementations breached Chapter V of the GDPR. The problem was not analytics itself. It was that personal data flowed to the United States without an adequate transfer mechanism after the Schrems II judgment invalidated the Privacy Shield in July 2020.

That situation changed on 10 July 2023, when the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework. Google LLC self-certified under the framework, which means transfers to Google in the US now rest on an adequacy decision under Article 45 rather than on standard contractual clauses plus supplementary measures. The earlier decisions were not overturned; they simply addressed a legal situation that no longer applies in the same form.

Two practical caveats remain. The framework faces ongoing legal challenge, so a Schrems III style annulment is a live risk that would reopen the transfer question overnight. And adequacy solves only the transfer leg. It does nothing for consent, purpose limitation, or retention.

Configuring Google Analytics 4 defensibly

Even with adequacy in place, these settings materially reduce risk and are what regulators look for:

1. Accept the Google Ads Data Processing Terms in the Analytics admin, under Account Settings.
2. Set data retention to the shortest period you can work with. GA4 offers two months or 14 months for user-level and event-level data.
3. Disable Google Signals for EEA traffic unless you have specific consent for cross-device ads personalization.
4. Turn off data sharing with Google for product improvement, benchmarking, and technical support unless you have assessed each one.
5. Do not send personal identifiers into GA4. Passing email addresses or names in event parameters or the URL breaches Google's own terms and creates an unlawful processing operation.
6. Block the tag until consent is granted. GA4 does not log or store full IP addresses, but the request itself still discloses the IP to Google before any anonymization occurs.

GDPR and Google Ads: Consent, Signals, and Audiences

Advertising is where the consent requirement is least negotiable. Ads personalization, remarketing lists, and customer match all rely on data uses that no regulator treats as legitimate interest. Article 6(1)(a) consent is the practical basis, and under Article 7(3) it must be as easy to withdraw as it was to give.

Google added its own enforcement layer on top. Since March 2024, Google's EU user consent policy requires advertisers and publishers serving EEA and UK traffic to pass consent signals to Google using Consent Mode v2. Failure to do so degrades or blocks personalization and audience features for European traffic, regardless of what any regulator does.

Consent Mode v2 works through four signals your consent banner sets before Google tags fire:

• ad_storage: whether advertising cookies may be set.
• analytics_storage: whether analytics cookies may be set.
• ad_user_data: whether user data may be sent to Google for advertising purposes.
• ad_personalization: whether data may be used for personalized advertising.

Two implementation modes exist. Basic consent mode blocks Google tags entirely until consent is granted. Advanced consent mode loads the tags in a restricted state that sends cookieless pings before consent. Advanced mode gives better conversion modeling, but the pre-consent ping still transmits the IP address and page context to Google, which several EU regulators consider a processing operation requiring its own justification. Basic mode is the conservative choice for EEA traffic.

Consent Mode v2 is a signalling mechanism, not a consent mechanism. It tells Google what the user chose. You still need a Consent Management Platform that actually collects and stores that choice, and Google requires a Google-certified CMP for publishers using AdSense, Ad Manager, or AdMob in the EEA and UK.

GDPR and Google Fonts, Maps, and reCAPTCHA

The most common GDPR exposure from Google is not analytics at all. It is the passive third-party requests sitting in a website theme.

On 20 January 2022, the Munich Regional Court (LG München I, case 3 O 17493/20) ruled that embedding Google Fonts from Google's servers transmitted the plaintiff's IP address to Google without a lawful basis and awarded 100 EUR in damages. The ruling triggered a wave of automated warning letters across Germany, many of them opportunistic, but the underlying legal point stands. Self-host your fonts. Download the font files, serve them from your own domain, and the third-party request disappears.

Google Maps embeds and YouTube players raise the same issue. Both send the visitor's IP to Google before any interaction. Use a click-to-load placeholder that only requests the embed after the user opts in, and use youtube-nocookie.com for video.

reCAPTCHA is harder. It collects device signals, browser characteristics, and interaction patterns, and Google acts as an independent controller. Security is a defensible purpose, but the volume of behavioral data collected goes beyond what most sites can justify under legitimate interest without a documented balancing test under Article 6(1)(f). European alternatives such as hCaptcha or Friendly Captcha reduce the analysis you have to do.

Enforcement: What Regulators Have Actually Fined

Specific enforcement history is more instructive than general risk warnings:

• January 2019: CNIL fined Google 50 million EUR for lack of transparency and invalid consent for ads personalization, upheld by the French Conseil d'Etat in June 2020.
• December 2021: CNIL fined Google LLC 90 million EUR and Google Ireland 60 million EUR because refusing cookies took more clicks than accepting them, under Article 82 of the French Data Protection Act implementing the ePrivacy Directive.
• January 2022: The Austrian DSB found a website operator's use of Google Analytics breached Article 44 of the GDPR.
• February 2022: CNIL issued formal notices to French site operators over Google Analytics transfers, followed by Italy's Garante in June 2022 and Denmark's Datatilsynet in September 2022.

Two lessons follow. First, the largest fines targeted the consent interface, specifically the asymmetry between accepting and refusing, rather than the data processing itself. If your banner has a prominent "Accept all" and a buried refusal path, that is the pattern regulators have already penalized. Second, orders against Google Analytics landed on the site operators. Your vendor's size offers no shelter.

Disclosing Google Services in Your Privacy and Cookie Policies

Article 13 of the GDPR requires you to tell users, at the point of collection, what you collect, why, on what lawful basis, who receives it, how long you keep it, and whether data leaves the EEA. Generic language such as "we use third-party analytics" does not satisfy this.

Your privacy policy needs to state, for each Google service:

• The specific service name, for example Google Analytics 4 rather than "analytics tools."
• The purpose, such as audience measurement or conversion attribution.
• The lawful basis, normally consent under Article 6(1)(a) for analytics and advertising.
• Google's role as processor or independent controller.
• The transfer mechanism, currently the EU-US Data Privacy Framework adequacy decision.
• The retention period configured in your Google account.
• A link to Google's own privacy policy.

Your cookie policy needs the individual cookie names, their purposes, their durations, and their categories. Google Analytics 4 sets _ga and _ga_<container-id>, both with a two year default lifetime. Google Ads sets _gcl_au for conversion linking, typically for 90 days. A cookie policy generator that works from an actual scan of your site will list what is really there instead of what you assume is there.

Because Google tags change and marketing teams add new ones, this documentation drifts fast. TermsBox scans a site, identifies the Google services present, and keeps the resulting privacy policy and cookie policy aligned with what the scanner actually finds, with monthly scans on the $12 per month Starter tier and weekly scans on the $25 per month Pro tier.

Practical Compliance Steps for Google Services

Work through these in order. Each step is verifiable, and skipping straight to the banner is why most sites still fail an audit.

1. Inventory every Google request your site makes. Open DevTools, filter the network tab by "google," and load your pages in a fresh session. Note anything that fires before consent.
2. Self-host Google Fonts and replace Maps and YouTube embeds with click-to-load placeholders.
3. Confirm the Google Ads Data Processing Terms are accepted for every Analytics property and Ads account you own.
4. Deploy a consent banner with symmetric accept and reject buttons at the same visual weight, plus granular category controls.
5. Block all non-essential Google tags until consent is granted. Verify by checking that no _ga or _gcl_au cookie exists before you click accept.
6. Implement Consent Mode v2 with all four signals mapped to your banner's categories, and test with Google Tag Assistant that the correct default and update states fire.
7. Set GA4 retention to two months or 14 months and disable Google Signals for EEA traffic unless separately consented.
8. Update your privacy and cookie policies with the specific service, purpose, basis, recipient, retention, and transfer details listed above.
9. Record consent proof. Article 7(1) requires you to demonstrate that consent was given, which means storing the timestamp, the version of the banner, and the categories chosen.
10. Re-scan after every marketing change. New tags arrive through tag managers, plugins, and agencies without touching your codebase.

If you also serve California residents, note that the consent logic differs there. The GDPR vs CCPA comparison covers why an opt-out model changes how you configure the same Google tags for US traffic.

Frequently Asked Questions

Is Google Analytics GDPR compliant?

Google Analytics can be used in a GDPR compliant way, but compliance depends on your configuration rather than on Google alone. You need prior consent under Article 5(3) of the ePrivacy Directive, the Google Ads Data Processing Terms under Article 28 of the GDPR, and a lawful transfer mechanism, which since July 2023 is the EU-US Data Privacy Framework adequacy decision.

Do I need consent before loading Google Analytics?

Yes, for visitors in the EEA and UK. Analytics cookies are not strictly necessary, so Article 5(3) of the ePrivacy Directive requires consent before the script writes or reads anything on the device. France's CNIL is the main exception and exempts tightly configured first-party audience measurement, but that exemption does not currently cover standard Google Analytics deployments.

What is Google Consent Mode v2 and is it required?

Consent Mode v2 is Google's API for passing a visitor's consent state to Google tags using the ad_storage, analytics_storage, ad_user_data, and ad_personalization signals. Google's EU user consent policy has required it since March 2024 for advertisers and Google Analytics 4 users with EEA or UK traffic. It is a contractual requirement from Google, not a GDPR provision, and it does not replace a compliant consent banner.

Does using Google Fonts violate GDPR?

Loading Google Fonts from Google's servers transmits the visitor's IP address to Google without consent, which the Munich Regional Court found unlawful in case 3 O 17493/20 on 20 January 2022 and awarded 100 EUR in damages. Self-hosting the font files removes the third-party request entirely and is the standard fix.

Is Google a data controller or a data processor?

It depends on the service. For Google Analytics, Tag Manager, and Google Ads conversion measurement, Google acts as your processor under the Google Ads Data Processing Terms, so you remain the controller under Article 24 of the GDPR. For advertising functions such as audience targeting and ads personalization, Google acts as an independent or joint controller under its Controller-to-Controller Data Protection Terms.

What are the penalties for GDPR violations involving Google services?

Article 83 of the GDPR allows fines of up to 20 million EUR or 4% of global annual turnover, whichever is higher. CNIL fined Google 50 million EUR in January 2019 over transparency and consent for ads personalization, and in December 2021 fined Google LLC 90 million EUR and Google Ireland 60 million EUR over cookie refusal mechanisms. Site operators are separately liable for how they deploy Google tags on their own sites.