GA4 and KVKK: What Is the Right Question?
The short answer to "Is Google Analytics 4 KVKK-compliant?" is: it is not the tool itself but how you configure it that decides. GA4 is an analytics tool that places cookies in the browser and measures user behaviour. Analytics cookies are non-essential cookies; that is, under KVKK they cannot run without the user's explicit consent.
Therefore, using GA4 compliantly means setting up several configurations and processes correctly together: blocking analytics cookies before consent, data retention and IP handling settings, Google Consent Mode signals, accepting the data processing terms with Google, and an appropriate safeguard for cross-border transfer. We address each of these below.
Core Compliance Levers
- Blocking before consent. The GA4 tag must not write cookies or send data until the user gives explicit consent to analytics.
- Consent Mode signals. The user's consent status (such as
analytics_storage) must be communicated to Google correctly. - Data retention period. In GA4 admin settings, keep the user and event data retention period aligned with your purpose and as short as possible.
- IP and data processing. Minimise unnecessary personal data during collection; accept the data processing terms with Google.
- Cross-border transfer safeguard. Since data is transferred abroad, an appropriate legal transfer safeguard must be in place.
GA4 Compliance Checklist
- Map analytics cookies to your consent management platform and block GA4 until consent is given.
- Set up Google Consent Mode and verify that the consent signals (
analytics_storage) work in sync with your banner decision. - Review the data retention period in the GA4 admin panel and reduce it to the shortest period suited to your purpose.
- Check that you have accepted the data processing terms with Google (at the account level).
- Confirm that an appropriate safeguard mechanism exists for cross-border transfer.
- Enable advertising/marketing signals (such as Google Signals) only where separate, explicit consent exists.
- State GA4's purpose, retention period, and transfer clearly in your cookie policy and privacy notice.
- Test the setup so that no analytics request goes out before consent is given.
Relationship Between Settings and Purpose
| Compliance Area | What to Do | Why It Matters |
|---|---|---|
| Consent Mode | Send consent signals to Google | Technically enforcing the decision |
| Data retention | Shorten the period | Data minimisation principle |
| Data processing terms | Accept Google's terms | Establishing the processor relationship |
| Cross-border transfer | Provide a proper safeguard | Rules for cross-border transfers |
| Advertising signals | Enable with separate consent | Marketing is a distinct purpose |
Common Mistakes
The most common mistake in practice is the GA4 tag sending data as soon as the page opens, before the banner is shown. The second frequent mistake is Consent Mode appearing to be installed yet not in sync with the banner decision; that is, signals going out as "granted" even though the user rejected. The third is leaving the data retention period at its default and keeping data longer than necessary. The fourth is failing to state GA4's purpose, retention period, and cross-border transfer in the cookie policy. These mistakes concern the setup, not the tool itself, and they can be fixed.
Example Scenario
A SaaS company uses GA4 on its marketing pages but wants to review its setup before an audit. The team first runs a cookie scan and maps the GA4 cookies to the "analytics" category. The consent management platform blocks the GA4 tag until the user consents and sends the analytics_storage=denied signal via Consent Mode. When a visitor consents to analytics, the signal becomes granted and GA4 starts running; when they reject, no analytics request goes out. The team also shortens the data retention period, confirms the Google data processing terms are accepted, and verifies a cross-border transfer safeguard is in place. Finally, the cookie policy is updated to include this information. The setup is tested by checking in the browser network tab that no GA4 request fires before consent.
Frequently Asked Questions
Can I use GA4 without IP anonymisation?
GA4 handles IP data differently from earlier versions and offers controls over data collection and retention in the admin settings. Still, the right approach is to limit the personal data you collect to your purpose, shorten the retention period, and configure your setup according to the data minimisation principle.
Is setting up Consent Mode enough on its own?
No. Consent Mode is a tool for transmitting consent signals; it does not achieve compliance on its own. The signals must genuinely work in sync with your banner decision, cookies must be blocked before consent, and the other settings must also be correct.
Can I not use GA4 because its data is transferred abroad?
It does not mean you cannot use it; however, since data is transferred abroad, you must provide an appropriate legal transfer safeguard and disclose this transfer transparently in your privacy notice.
If a user does not consent to analytics, is measurement lost entirely?
Non-essential cookies cannot run without consent, so cookie-based measurement cannot be performed for users who do not consent. Respecting the user's choice is the correct approach, and where possible you can consider aggregate measurement alternatives that contain no personal data.
This content is for general information purposes only and does not constitute legal advice.
With JUS. you can scan all cookies on your site, including GA4, for free, manage pre-consent blocking and Consent Mode synchronisation from a single panel, and request a demo to see your setup in action.