Google Analytics, consent and privacy laws (GDPR & LGPD)

If your site has visitors in Europe or Brazil and runs Google Analytics, you have probably heard both extremes: "GA is illegal" and "just add a cookie banner and you're fine". Both oversimplify.

In this article I separate what the laws and regulators actually say — the GDPR and the ePrivacy Directive in the EU, the LGPD and the ANPD (Brazil's data protection authority) — why GA4 usually ends up needing consent, and what changes, and what doesn't, when you switch to a cookieless analytics tool. Every claim links to a primary source at the end.

Does analytics process personal data?

In most setups, yes — under both laws.

• GDPR. Personal data is "any information relating to an identified or identifiable natural person", and the definition explicitly lists "an online identifier" as a way to identify someone (Art. 4(1)). Recital 30 names cookie identifiers and IP addresses as examples of online identifiers.
• LGPD. Brazil's Law 13,709/2018 uses almost the same wording: "information related to an identified or identifiable natural person" (Art. 5, I).

The key word in both is identifiable. You don't need a name or an email. A random ID stored in the browser that recognizes the same visitor across visits is enough to single someone out.

Two more points matter for analytics:

• Processing covers practically any operation on the data — collecting, storing, analyzing, transferring (GDPR Art. 4(2); LGPD Art. 5, X). Measuring visits is processing.
• Anonymized data is out of scope, pseudonymized data is not. The LGPD says anonymized data isn't personal data as long as the anonymization can't be reversed with reasonable effort (Art. 12), but data used to build a behavioral profile of an identified person may still count as personal (Art. 12, §2). The GDPR draws the same line: pseudonymized data — replacing the name with an ID — is still personal data.

So a persistent per-visitor ID is, as a rule, personal data.

Cookies have their own rule in the EU

This is the part most people miss: in Europe there are two layers.

1. The ePrivacy Directive, Art. 5(3), governs the act of storing or reading information on the user's device. It requires consent for that, with only two exceptions: storage needed purely to transmit a communication, or storage strictly necessary to provide a service the user explicitly asked for.
2. The GDPR governs what you do with any personal data afterwards.

Three things follow from Art. 5(3):

• It isn't only about cookies. The EDPB's guidelines on the technical scope of Art. 5(3) (2/2023, final version adopted in October 2024) apply it to tracking pixels, tracking links, device fingerprinting and other techniques — and the provision covers any information stored on the device, so localStorage is in scope too.
• It applies whether or not the data is personal. In Planet49 (C-673/17, October 2019) the EU Court of Justice held that the rule protects the user's device itself, so it applies regardless of whether the stored information is personal data.
• Legitimate interests can't replace it. The EDPB's Opinion 5/2019 says the general GDPR legal bases can't be used to lower the protection of Art. 5(3): when it requires consent for the cookie, that's what you need.

Analytics is generally not "strictly necessary" — your site works without it. That's why, in most EU countries, analytics cookies sit behind the consent banner. Some regulators carve out a narrow exception: France's CNIL, for example, exempts audience measurement from consent under strict conditions (anonymous statistics used only by the site itself, no cross-site tracking, no sharing with third parties, trackers that last at most 13 months and data kept at most 25 months). Rules and enforcement vary by country, so check the ones where your visitors are.

What valid consent looks like (EU and Brazil)

When consent is the basis, both systems ask for roughly the same thing.

Under the GDPR, consent must be freely given, specific, informed and unambiguous, by a clear affirmative action (Art. 4(11)), and withdrawing it must be as easy as giving it (Art. 7(3)). In practice:

• No pre-ticked boxes. Planet49 settled that a pre-checked box isn't valid consent. The same judgment says you must tell users how long cookies last and whether third parties can access them.
• Scrolling isn't consent. The EDPB's consent guidelines (05/2020) say scrolling or swiping can never count as a clear affirmative action.
• No cookie walls. The same guidelines say access to the site can't be conditional on accepting non-essential cookies.

Under the LGPD, consent is one of ten legal bases (Art. 7, I). Article 8 adds two details that sink a lot of banners: consent must refer to specific purposes — "generic authorizations" are void (§4), so "we use cookies to improve your experience" doesn't cut it — and it can be revoked at any time through a free and easy procedure (§5).

Legitimate interests in Brazil

The LGPD also allows processing based on legitimate interest (Art. 7, IX, and Art. 10), and Brazil has no equivalent of the ePrivacy Directive, so this basis plays a bigger role in the Brazilian analytics debate. It's not a blank check:

• processing must be strictly necessary for the purpose (Art. 10, §1);
• the controller must ensure transparency (Art. 10, §2);
• the ANPD may request a data protection impact report (Art. 10, §3).

In February 2024 the ANPD published a guide on legitimate interest that asks you to demonstrate a legitimate purpose, a concrete situation, necessity, a balancing against the data subject's rights and safeguards — the balancing test, in writing.

What Brazil's ANPD cookie guide says

In October 2022 the ANPD published its Guidance on cookies and personal data protection. It isn't law, but it shows how the regulator reads the LGPD on this topic:

• Categories. It separates necessary cookies (the site doesn't work without them) from non-necessary ones, first-party from third-party, and session from persistent cookies.
• Legal basis by purpose. Consent is the main basis for non-necessary cookies. Legitimate interest is accepted in specific situations — strictly necessary cookies are the classic case, and the guide leaves room for audience measurement in some contexts — always with a documented assessment and transparency. Advertising, profiling and sharing with third parties point toward consent.
• Layered banner. The first layer must offer a way to reject non-necessary cookies, not only "accept". The second layer details the categories and lets the user choose by purpose.
• Nothing pre-selected. Cookies that depend on consent stay off by default. Pre-ticked boxes and "consent by continuing to browse" don't count.
• A clear cookie policy saying which cookies exist, what for, for how long and on which legal basis.

Why GA4 usually needs consent

None of this means "Google is illegal". GA4's default design simply pushes the analysis toward consent:

1. A persistent identifying cookie. The GA4 tag sets the _ga and _ga_<id> cookies, with a default lifetime of 2 years, to tell users and sessions apart. That's a per-person identifier stored on the device — exactly what ePrivacy Art. 5(3) is about — lasting far beyond the visit.
2. The data goes to a third party. Google processes it, and the property can be linked to advertising features (Google Ads, Google Signals, remarketing). The more of that you turn on, the further you are from "minimal, expected measurement".
3. International transfers. GA data may be processed outside the visitor's country on Google's infrastructure.
   • EU: in 2022 the Austrian and French regulators found specific uses of GA unlawful because of transfers to the US. The EU–US Data Privacy Framework, in force since the Commission's adequacy decision of 10 July 2023, now covers transfers to certified US companies. The EU General Court upheld it in September 2025, and that ruling is under appeal — so keep an eye on it.
   • Brazil: the LGPD only allows international transfers under Art. 33, and ANPD Resolution 19/2024 regulated the topic with standard contractual clauses, giving those who use contractual clauses 12 months (from 23 August 2024) to adopt the ANPD's model.

What about IP addresses? Google says GA4 doesn't log or store IP addresses: it uses the IP to derive approximate location and then discards it. That helps, but it doesn't solve the three points above — the cookie identifier is still there.

In practice, the most defensible GA4 setup is usually: a banner with "reject" on the first layer, the GA tag blocked until the visitor accepts, and a cookie policy that explains the purpose. The cost is familiar to anyone who has done it: you stop measuring everyone who declines or ignores the banner.

What changes with cookieless analytics

An analytics tool that doesn't use identifying cookies and doesn't feed advertising changes the size of the problem. Using Analisa as a concrete example (it's the one I know from the inside):

• No cookies. No _ga, no cross-site identifier, no third-party tracker.
• IP anonymized on ingest. The last octet of IPv4 (or the last 80 bits of IPv6) is zeroed before anything is stored; the country is derived and the IP discarded.
• No advertising use. The data powers the site's own reports — sources, campaigns, goals, funnels, Web Vitals — not profiling or ads.
• Export and deletion. There's an API to handle data subject access and erasure requests.

That makes the data protection side easier to defend: a clear purpose (understanding how your own site is used), minimal data, no surprises for the visitor. Under the LGPD, it makes a legitimate-interest argument much more credible. Whether you can drop the banner, though, is your call (and your lawyer's), not the tool's — especially in the EU, as the next section explains.

What doesn't change (the part few people mention)

"Cookieless" doesn't mean "outside the GDPR or the LGPD". To be honest about my own product:

• There's still storage in the browser. Analisa's SDK keeps a random anonymous ID in localStorage (so a returning visitor is counted once) and a session ID in sessionStorage (deleted when the tab closes). The LGPD doesn't talk about "cookies", it talks about processing personal data — switching storage technology doesn't change the analysis. And in the EU, ePrivacy Art. 5(3) covers localStorage just like a cookie, so unless an exemption applies where your visitors are, you may still need consent for it.
• Pseudonymized isn't anonymized. A random per-device ID still lets you single someone out. Treat it as personal data and document the legal basis.
• Transparency is still mandatory. Your privacy policy must say what is measured, why and by whom. Legitimate interest without transparency doesn't hold up (LGPD Art. 10, §2), and the GDPR's information duties apply whatever the basis.
• International transfers may still exist. Analisa runs on a cloud provider and data may be processed outside your country, as the privacy policy says. That belongs in your data map.
• You control what you send. If you fire a custom event with an email, phone number or national ID in its properties, that becomes identified personal data, cookie or no cookie. Don't.
• If you ask for consent, it has to work. The SDK accepts analytics.setConsent('denied'), which stops sending events and clears the stored identity. If you have a banner, wire the "reject" button to it.

// After the visitor chooses in your banner:
if (choice === 'rejected') {
  window.analytics.setConsent('denied')  // stops sending and clears the stored identity
} else {
  window.analytics.setConsent('granted')
}

A checklist to review your site today

1. List everything your site loads: analytics, pixels, chat, maps, embedded videos. There are often third parties nobody remembers adding.
2. For each one, write down the purpose and the legal basis (consent, or legitimate interest with a documented balancing test where the law allows it).
3. If you use consent: a reject button on the first layer, nothing pre-selected, tags blocked until acceptance, easy withdrawal.
4. Update your privacy/cookie policy with what actually runs — including local storage that isn't a cookie, how long each item lasts and who can access it.
5. Map international transfers (where each tool's data goes).
6. Review custom events: no property containing data that identifies the person.

The first item is the most tedious to do by hand. I built a free tool for it: paste a URL and it shows the cookies, third-party scripts and trackers the page loads.

Should you replace GA?

It depends on what you use it for. If your team lives on Google Ads integrations, remarketing audiences and Google's attribution models, GA4 still makes sense — with consent done properly. If what you need is to know where visits come from, which campaigns bring signups and whether the site is fast, cookieless analytics gets you there with much less legal friction.

I wrote an honest comparison, including when not to switch, in Google Analytics alternative. And if you want to see exactly how Analisa handles data, it's all in the GDPR/LGPD documentation.