Web Analytics
Google Analytics 4
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Google Ireland Limited · marketingplatform.google.com
Compare with Plausible Analytics → Compare with etracker Analytics → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Google Analytics 4 at a glance
- Vendor
- Google Ireland Limited
- Headquarters
- Not stated on the vendor’s pages as of 29 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 29 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 29 Oct 2026
- Panel verdict
- The AI panel rates Google Analytics 4 2.5/5, the mean of 6 judges. Google Analytics 4, from Google Ireland Limited, is strongest on data ownership, the only criterion at a flat 6: a daily BigQuery export covered by an SLA and unsampled total-data reports in the paid tier, and deletion of all remaining customer personal data within a maximum of 180 days after the term. how scores are made
- As of
- Vendor pages captured 29 Oct 2026; evaluated by the panel 30 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Google Analytics 4, from Google Ireland Limited, is strongest on data ownership, the only criterion at a flat 6: a daily BigQuery export covered by an SLA and unsampled total-data reports in the paid tier, and deletion of all remaining customer personal data within a maximum of 180 days after the term. Implementation is the weakest area apart from pricing, flat 4 — setup runs through gtag.js, Tag Manager templates and a Firebase SDK, but we found no public information on script size, CMS plugins, team roles or single sign-on. Judges split on conversions and events, 4 to 6: top scores credit Google Ads conversion tracking, attribution models and machine-learning predictions, low ones cite no public information on funnels with drop-off, e-commerce revenue or cohorts. Consent and privacy splits too, 4 to 6, between deep consent-mode documentation and a default state that grants all consent and writes advertising cookies. Sovereignty sits at 4 to 5, EU collection alongside terms that allow processing in any country where Google or its subprocessors maintain facilities; pricing transparency is a flat 3.
Speaks for it
- Daily BigQuery export covered by an SLA and unsampled total-data reports documented for Analytics 360
- Deletion of all remaining customer personal data within a maximum of 180 days after the term, committed in the data processing terms
- Consent mode documented to individual ping fields and per-storage-type behaviour, with EU, Swiss and UK IP addresses deleted before recording and never logged
- Google Ireland Limited in Dublin named as contracting entity, with a published data processing agreement, ISO 27001 certification and a subprocessor list
- Google Ads conversion tracking and remarketing, attribution models and machine-learning predictions of audience behaviour documented
Held against it
- Processing terms allow processing of customer data in any country where Google or its subprocessors maintain facilities, with the parent in California and US Cloud Act exposure flagged
- The default consent state assumes all consent granted, writes advertising cookies and collects advertising identifiers, so a consent banner remains part of the setup
- We found no public information on referrers, campaign reports, a real-time view, segments or scheduled email reports
- We found no public information on funnels with drop-off, e-commerce revenue and product tracking, or cohorts
- We found no public information on script size, plugins for named CMS or shop systems, team roles, single sign-on or a public status page
Best for
- You advertise through Google Ads and want conversion tracking, remarketing and attribution models tied directly to your analytics
- You depend on a nightly warehouse sync through the paid Analytics 360 tier's SLA-covered daily BigQuery export
- You must be able to audit consent behaviour in detail, from per-storage-type settings to cookieless pings when consent is denied
- Your measurement spans web and apps, where cross-device analysis and a Firebase SDK are documented
Avoid if
- You need EU-bound processing — the terms allow processing in any country where Google or its subprocessors maintain facilities, the parent is Google LLC in California, and US Cloud Act exposure is flagged for the subprocessor chain
- You want to run without a consent banner — the documented default grants all consent, writes advertising cookies and collects advertising identifiers, and more than thirty consent-management partners are listed
- Your conversion reporting depends on checkout funnels with drop-off per step or order and revenue tracking — the documented conversion path runs into Google platforms only, and we found no public information on e-commerce tracking or plugins for shop systems like Shopware
The scores
| Criterion | Panel median |
|---|---|
| Traffic, sources & campaign reports | 2 of 5 |
| Goals, events, funnels & e-commerce | 2.5 of 5 |
| Consent-free operation & data minimisation | 2.5 of 5 |
| Data access, export & self-hosting | 3 of 5 |
| Installation, integrations & performance | 2 of 5 |
| European sovereignty | 2 of 5 |
Traffic, sources & campaign reports
Show reasoningHide reasoning
How this is scored
What the standard reports show: page views, visits and visitors, entry and exit pages, referrers, search engines and social networks as sources, campaigns tagged with UTM parameters, countries, devices and browsers, a real-time view, date comparisons, segments and filters, custom dashboards, scheduled email reports, shared or public dashboards, and whether reports are sampled or complete.
0 — Not a web analytics product; website traffic cannot be measured with it.
3 — Page views and visitors over time with top pages and referrers; campaign parameters, segments and report sharing are basic or not described.
5 — A dashboard with pages, referrers, UTM campaigns, countries and devices, a real-time view, date comparison, filters across all reports, email reports, and dashboards shared with clients or colleagues.
8 — Custom segments and saved views, custom dashboards and report builders, channel grouping that can be configured, Search Console or ad platform data shown beside the traffic, unsampled reports stated, several sites and roll-up reporting in one account, and annotations.
10 — Reporting that a whole organisation runs on: custom dimensions and calculated metrics, anomaly alerts, multi-site and multi-brand roll-ups with roles per site, report accuracy and how visitors are counted explained in a published methodology, and every report reproducible from the raw data.
The E-Commerce Marketing Lead
The advertising workspace with cross-channel ROI and attribution reports, shareable reports, and device and location data covers the campaign view I live in, and the premium tier even states unsampled total-data reports and intra-day freshness within an hour. We found no public information on entry and exit pages, referrer lists, a real-time view, or scheduled email reports, so I cannot confirm the full reporting stack. 2 3 4
The Data Protection Officer
The captured pages describe cross-device and cross-platform analysis across web and apps, shareable reports, an advertising workspace with cross-channel ROI and attribution reports, and — in the paid edition — unsampled total-data reports with intra-day freshness; country, region and device data are derived from IP metadata and browser or device fields. We found no public information on referrers, campaign reports, a real-time view, segments, filters or scheduled email reports. 1 2 3 4
The Agency Developer
The captured pages document cross-web-and-app user analysis, an advertising workspace with cross-channel ROI and attribution reports, shareable reports, and IP-derived country and device fields, with Analytics 360 adding intra-day freshness within one hour and unsampled total-data reports. I found no public information on referrers, UTM campaign reports, a real-time view, date comparisons, segments or email reports, so this sits between basic traffic counts and the full dashboard bundle my clients ask for. 1 2 3 4
The Growth Analyst
The captured pages document an advertising workspace with cross-channel ROI and attribution reports, shareable reports, machine-learning insights and cross-device analysis across web and apps, with Search Console and Google Ads data named alongside and unsampled total-data reports stated for the premium tier. The standard traffic catalogue — pages, referrers, countries, devices, a real-time view, segments and date comparisons — is not described on these pages, so I cannot place the reporting level higher than midway. 1 2 3
The Public-Sector Site Owner
The captured pages document cross-device and cross-platform audience analysis, country and city data derived from IP addresses, shareable reports, and in the paid tier unsampled total-data reports with intra-day data within an hour, plus an advertising workspace with cross-channel ROI and attribution reports. We found no public information on the standard reports themselves — top pages, referrers, campaign parameters, a real-time view, date comparisons or scheduled email reports — on the pages captured. 1 2 3 4
The Skeptic
The captured pages advertise an advertising workspace with cross-channel ROI and attribution reports, shareable reports, unsampled total-data reports in the premium tier, and Search Console and ad platforms among the named integrations. Beyond that we found no public information on the captured pages about the standard report contents — page views, top pages, referrers, countries, devices, segments, filters or a real-time view. 1 2 3
Goals, events, funnels & e-commerce
Show reasoningHide reasoning
How this is scored
How the product measures what visitors do: goals for pages and events, custom events with properties, outbound links, downloads, form submissions and scroll depth tracked without code, funnels with drop-off, e-commerce tracking of orders, revenue and products, attribution of conversions to channels and campaigns, cohorts and retention, and conversion data passed back to ad platforms.
0 — Counts page views only; no goals, events or conversions can be defined.
3 — Goals for a page or a custom event; funnels, revenue and attribution are basic or not described.
5 — Goals and custom events with properties, outbound links and file downloads tracked, funnels with drop-off per step, revenue attached to goals or orders, and conversions broken down by source and campaign.
8 — Full e-commerce tracking (products, cart, checkout, orders, revenue) with plugins for named shop systems, several attribution models compared, cohorts and retention, user journeys or paths, forms and scroll depth tracked without code, and conversions sent back to Google Ads, Meta or other ad platforms server to server.
10 — Conversion analysis to the level of a product analytics suite: multi-touch attribution explained, funnels and cohorts on any event or property, revenue reconciled with the shop system, predictive or anomaly metrics with their method stated, and every conversion traceable to the raw event.
The E-Commerce Marketing Lead
Google Ads conversion tracking and remarketing with key events, plus conversion and behavioral modeling that fills gaps when consent is denied, is exactly the loop back into Ads that my budget needs — but only into Google platforms, not Meta or the price comparison sites. We found no public information on checkout funnels with drop-off per step, e-commerce tracking of orders and revenue, or plugins for named shop systems like Shopware. 2 3 5
The Data Protection Officer
Key events with their pings, Google Ads conversion tracking and remarketing, and an advertising workspace in which attribution models are evaluated across channels are documented, together with conversion and behavioural modelling that fills gaps when consent is denied. We found no public information on funnels with drop-off, e-commerce or revenue tracking, or cohorts. 2 3 5
The Agency Developer
Key events with Google Ads conversion tracking and remarketing, conversion and behavioural modelling to fill consent gaps, evaluation of attribution models, and machine-learning prediction of future audience actions in the paid tier are all documented. I found no public information on funnels with drop-off, e-commerce tracking of orders and revenue, or outbound-link and download tracking, so the conversion story stops short of the full package. 2 3 5
The Growth Analyst
Key events, Google Ads conversion tracking and remarketing, attribution models to evaluate, cross-channel ROI reporting and machine-learning predictions of future audience actions are all documented, with audience analysis across the full customer lifecycle spanning web and apps. For my campaign-click-to-paid-invoice question, though, the captured pages give no description of funnels with drop-off, e-commerce revenue and products, custom event properties or cohorts. 2 3 5
The Public-Sector Site Owner
Conversions are documented as key events with Google Ads conversion tracking and remarketing, conversion and behavioural modelling to fill gaps where consent is denied, attribution models to evaluate in the advertising workspace, customer-lifecycle analysis and machine-learning predictions in the paid tier. We found no public information on funnels with drop-off, form submissions, scroll depth or e-commerce tracking, which is the very reporting our forms office would need. 2 3 5
The Skeptic
Google Ads conversion tracking and remarketing, an advertising workspace with attribution models to evaluate, cross-channel ROI reports and machine-learning predictions of audience behaviour are documented. We found no public information on the captured pages about goals, funnels with drop-off per step, e-commerce revenue and product tracking, or cohorts and retention. 2 3 5
Consent-free operation & data minimisation
Show reasoningHide reasoning
How this is scored
What is collected and whether a consent banner is needed: a cookieless mode with how visitors are counted (daily hash, server-side fingerprint, no identifier), IP addresses truncated or not stored, no cross-site or cross-device profile and no use of data for the vendor's own purposes, data retention settings, opt-out and Do Not Track, a consent mode for features that do need consent, the vendor's stated reading of §25 TDDDG, the CNIL consent exemption and the authorities' rulings on Google Analytics, and guidance for the site's privacy policy. Where the data is processed is scored under sovereignty.
0 — Requires consent for every visit and sets tracking cookies with no privacy settings at all, or shares visitor data for advertising by default.
3 — IP anonymisation or a cookie setting exists and the product is described as GDPR-compliant; how visitors are identified, retention and the consent position are basic or not described.
5 — A documented cookieless or consent-free mode that states how visitors are counted, IP addresses truncated before storage, no cross-site tracking, retention configurable, an opt-out, a consent mode for the features that need one, and a data protection page explaining when a banner is required.
8 — The consent position stated against named law (§25 TDDDG, the ePrivacy Directive, the CNIL exemption or a DPA ruling), identifiers rotated or never created and the method published, personal data never stored by default, pseudonymisation and retention settings per data type, a legal opinion or external audit of the consent-free mode cited, and wording for the privacy policy supplied.
10 — Data minimisation that can be verified: the collection script and processing open to inspection, exactly which fields are stored documented, a consent-free mode recognised by a named authority or certified, accuracy with and without consent stated, and every privacy setting the customer controls listed with its effect.
The E-Commerce Marketing Lead
Consent mode is documented in real depth — cookieless pings when consent is denied, region-specific defaults, best practices for the banner, and 33 named CMP partners — and GA4 states IP addresses are never stored or logged. But the default state assumes everything granted, with advertising cookies read and written and advertising IDs collected, the modeling cannot estimate anything for TCF-based denials, and we found no public statement of the consent position against German or French law or a privacy-policy wording. 4 5 9
The Data Protection Officer
Consent mode is documented in unusual depth: with analytics storage denied no Analytics cookies are read or written and only cookieless pings leave the browser, whose contents are published; Google Analytics 4 stores and logs no IP addresses at all, and for EU, Swiss and UK visitors the address is used only to derive location and then deleted, with Google Signals and detailed location or device collection switchable off per region. What holds it at the middle level is that the default state assumes all consent granted and collects advertising identifiers, IP addresses and full URLs with click identifiers, activity data flows into the Google account for Google's own advertising purposes, and we found no stated reading of §25 TDDDG or any authority decision, no retention settings per data type, and no supplied wording for the site's privacy policy. 4 5 6 9
The Agency Developer
Consent mode is unusually well documented: when analytics storage consent is denied no Analytics cookies are read or written, cookieless pings go to Google, regional defaults, ads data redaction and 34 named CMP partners are listed, and EU IP addresses are deleted before recording and never logged, with detailed location and device collection switchable per region. The default, though, assumes all consent granted with ad cookies written and advertising IDs collected, and Google uses data for personalised advertising and AI training, so a banner stays part of every client install. I found no public information on configurable retention periods. 4 5 9
The Growth Analyst
Consent mode is documented in real depth: behaviour per consent type, cookieless pings with conversion and behavioural modelling when consent is denied, 34 named CMP partners, IP addresses of EU, Swiss and UK visitors never logged, EU collection domains, and per-region toggles for detailed location and device data and Google Signals. The default, though, assumes all consent granted, uses cookies and collects detailed data by default, with an opt-out browser plugin named — a consent-managed product rather than a consent-free one — and no position against named German law, external audit or privacy-policy wording is stated. 4 5 6 9
The Public-Sector Site Owner
The consent workflow is documented in detail: with consent denied, Analytics cookies are not written and cookieless pings are sent, EU visitors' IP addresses are deleted before recording and never logged, and Google Signals and detailed location and device data can be switched off per region. But the default state grants consent and writes advertising cookies, the recommended set-up loads tags before a consent dialog, and more than thirty consent management platforms are listed as partners; we found no public information on a mode that runs without a consent banner, on a stated position on §25 TDDDG, or on data protection authority rulings. For a council that will not show a cookie banner, the captured pages leave that central question open. 4 5 6 9
The Skeptic
Consent mode is documented down to the individual ping fields and per-storage-type behaviour, GA4 states IP addresses are never stored or logged, EU IP addresses are deleted before recording, and the exact detailed location and device fields that stop being collected when the per-region toggle is off are listed. Against that: detailed data is collected by default, the default consent state assumes everything granted with advertising cookies and advertising identifiers, unique identifiers and IP addresses appear among the collected data types, and we found no public information tying the position to named law or supplying privacy-policy wording — the CMP partner list suggests a banner is expected, not avoided. 4 5 9
Data access, export & self-hosting
Show reasoningHide reasoning
How this is scored
Whether the data stays the customer's and can leave with them: a reporting API and a raw event export, CSV export of every report, a scheduled export or sync to a data warehouse or BI tool (BigQuery, Snowflake, Looker Studio), no data sampling or limits on history, import of historical data from Google Analytics or another tool, open-source code, and a self-hosted or on-premise edition the customer runs on its own servers.
0 — No export of any kind; the data can only be viewed in the vendor's dashboard.
3 — A CSV export of reports; an API, raw data and history limits are basic or not described.
5 — A documented reporting API, CSV export of all reports, the retention period for raw data stated, and an import of historical data from Google Analytics or a stated migration path.
8 — Raw event data exportable or streamed to a named warehouse or BI tool, an API covering both reporting and data collection, no sampling stated, a self-hosted or on-premise edition with its own documentation, and the data returned or deleted on termination under stated terms.
10 — The customer owns the data end to end: open-source code under a named licence that runs fully self-hosted with feature parity stated, a complete raw export in an open format that another tool can import, and the deletion of every copy on termination documented.
The E-Commerce Marketing Lead
A daily BigQuery export covered by an SLA and deletion of all customer data within a stated maximum of 180 days after the term are the two things that let me take the data with me. We found no public information on a reporting API, CSV export of reports, or a self-hosted edition, and the captured pages state a fee is possible for data deletion. 3 6
The Data Protection Officer
A daily BigQuery export is covered by a service level agreement, the premium edition promises unsampled total-data reports, and on termination Google deletes all customer personal data within a maximum of 180 days — for which a fee based on Google's reasonable costs may be charged. We found no public information on a reporting API, CSV export of reports, import of historical data, or any self-hosted edition. 3 6
The Agency Developer
Analytics 360 documents a daily BigQuery export with an SLA plus unsampled total-data reports, and the data processing terms commit Google to deleting all remaining customer data within a maximum of 180 days after the term. I found no public information on a reporting API, CSV export of reports, an import of historical data, or a self-hosted edition — for my clients that leaves the paid export as the only documented way out. 3 6
The Growth Analyst
A daily BigQuery export is covered by a service level agreement on the premium tier — exactly the nightly warehouse sync my funnel stack depends on — and total-data reports are stated as unsampled, with deletion of all remaining customer personal data within 180 days after the term documented in the data processing terms. We found no public information on a reporting API, CSV export of reports, the retention period for raw data, an import of historical analytics data or a self-hosted edition. 3 6
The Public-Sector Site Owner
The paid tier documents a daily BigQuery export covered by an SLA and unsampled total-data reports, and the data processing terms commit to deleting all customer personal data within a maximum of 180 days after the contract ends. We found no public information on a reporting API, CSV export of reports or a self-hosted edition, which is what our requirement to keep residents' data on the municipal data centre's own servers would rest on. 3 6 9
The Skeptic
The premium tier promises a daily BigQuery export covered by an SLA together with unsampled total-data reports, and the processing terms commit to deleting all remaining customer personal data within a maximum of 180 days after the term — though deletion may carry a fee based on Google's reasonable costs. We found no public information on the captured pages about a reporting API, CSV export of reports, a historical-data import, or any self-hosted or open-source edition. 3 6
Installation, integrations & performance
Show reasoningHide reasoning
How this is scored
What it takes to install and run: the size and loading of the tracking script, plugins and documented set-ups for named CMS and shop systems (WordPress, TYPO3, Shopify, Shopware, WooCommerce), single-page apps and mobile SDKs, a tag manager or Google Tag Manager template, server-side tracking and first-party proxying to avoid ad blockers, team roles and permissions, client and agency accounts, single sign-on, and an uptime or status page.
0 — No documented way to install the product on a website or app.
3 — A tracking snippet to paste into the site; plugins, SDKs, server-side options and roles are basic or not described.
5 — A documented snippet with its size stated, plugins or guides for several named CMS and shop systems, support for single-page apps, team members with roles, and an agency or multi-site account.
8 — A lightweight script or server-side collection documented, a first-party proxy or own tracking domain, SDKs for iOS, Android and named frameworks, a tag manager integration, granular roles per site, single sign-on (SAML), and a public status page with uptime history.
10 — Installation that scales across an organisation: server-side and client-side tracking with an equal feature set, an infrastructure-as-code or API-driven site set-up, white-label for agencies, SLA and support terms published, and the performance impact of the script measured and stated.
The E-Commerce Marketing Lead
Consent mode can be enabled with minimal coding via Google Tag Manager community templates or gtag.js commands, apps use the Firebase SDK, and the documented script domains tell me what to allow in a content security policy — a workable install path. We found no public information on plugins or guides for Shopware and other shop systems, the script size, team roles and permissions, or a public status page. 3 4 5
The Data Protection Officer
Installation runs through gtag.js commands or Tag Manager templates, consent mode is activated with minimal coding alongside a long list of named consent management partners, apps are covered by the Google Analytics for Firebase SDK, and the required content security policy domains are documented, with enterprise support and service level agreements in the paid edition. We found no public information on the script's size, plugins or guides for named CMS and shop systems, single-page app support, team roles, single sign-on or a public status page. 3 4 5
The Agency Developer
Implementation evidence centres on Tag Manager (consent mode with minimal coding via community templates, custom tags with consent settings), the Firebase SDK for apps, and the CSP domains required for collection, with named integrations to Google Ads, Search Ads 360, Display & Video 360, Google Cloud, Search Console and Salesforce. For my WordPress, TYPO3 and Shopify clients I found no public information on CMS plugins, script size, an own tracking domain against ad blockers, client logins or a public status page — that gap is what decides this for an agency install. 3 4 5
The Growth Analyst
Set-up runs through the Google tag with Tag Manager templates and community CMP templates or gtag.js commands, a Google Analytics for Firebase SDK covers apps, and the content-security-policy domains to allow are published. Script size, plugins or guides for named CMS and shop systems, team roles, single sign-on and a public status page with uptime are not described on the captured pages. 4 5
The Public-Sector Site Owner
Installation runs through gtag.js, Google Tag Manager with community templates for the listed consent platforms, and a Firebase SDK for apps, with the required tracking domains published for content security policy configuration. We found no public information on script size, plugins or guides for named CMS systems, single sign-on, team roles or a public status page. 3 4 5
The Skeptic
Implementation is documented around gtag.js commands, Google Tag Manager templates, a Firebase SDK for apps, the analytics domains a content security policy must allow, and a long list of named consent-management partners. We found no public information on the captured pages about the script's size, plugins for named CMS or shop systems, single-page-app support, team roles and permissions, single sign-on, or a public status page. 3 4 5
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where visitor data is collected, stored and processed, and who the subprocessors are (script CDN, collection endpoint, hosting, email reports, support and payment tools). Independently sourced by the sovereignty pipeline; visitor data is personal data under European rulings, so the whole chain counts, not only the database. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (CDN, collection endpoint, email, support, payment) run through non-EU providers without a stated safeguard, or EU processing relies on a proxy in front of a non-EU service.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated — or a self-hosted edition documented that keeps every visitor record on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The E-Commerce Marketing Lead
The contracting entity is Google Ireland Limited in Dublin and EU traffic is collected through EU domains and servers with EU IP addresses deleted before recording, plus a published data processing agreement and ISO 27001. But the processing terms allow processing in any country where Google or its subprocessors maintain facilities, servers run worldwide, the parent company sits in California, and the subprocessor locations are not shown on the captured pages — no EU-bound storage is promised. 4 6 8 9
The Data Protection Officer
The contracting and service entity is Google Ireland Limited in Dublin with an Irish register number and VAT ID, a data processing agreement and a subprocessor list are published, and ISO 27001 certification is maintained with third-party audit. But the processing terms reserve the right to process customer data in any country where Google or its subprocessors maintain facilities, with replication between geographically dispersed data centres, and only the collection endpoints and IP lookups for EU, Swiss and UK visitors sit in the EU before traffic is forwarded on. No hosting location for the analytics processing itself is stated, the parent is Google LLC of Mountain View, California, and the captured facts record exposure to the US Cloud Act. 4 6 7 8 9
The Agency Developer
Google Ireland Limited in Dublin is the contracting entity with a published data processing agreement, a subprocessor list and ISO 27001, and EU visitors' data is collected through EU domains and servers with IP lookups on EU servers before forwarding. The same terms permit processing in any country where Google or its subprocessors maintain facilities, servers run worldwide, the parent company sits in California and US Cloud Act exposure is flagged — EU collection in front of worldwide processing is exactly what my clients would have to accept. 4 6 8 9
The Growth Analyst
Google Ireland Limited in Dublin, registered under Irish law, is the contracting entity, EU visitor traffic is collected over EU domains with IP lookups on EU servers, and a published data processing agreement with a subprocessor list and ISO 27001 certification exists. The processing terms, however, allow processing in any country where Google or its subprocessors maintain facilities, servers run worldwide, the parent is US-based Google LLC and US Cloud Act exposure is flagged — no EU data residency for the processing itself is committed. 4 6 8 9
The Public-Sector Site Owner
Google Ireland Limited in Dublin is the named provider with a published register number, a data processing agreement, ISO 27001 certification and a subprocessor list, and EU visitors' measurement data is collected through EU domains and servers with IP addresses deleted there. However, the terms allow processing of customer data in any country where Google or its subprocessors maintain facilities, the privacy policy describes servers worldwide, and the parent company sits in the USA with US Cloud Act exposure; we found no public information on a self-hosted edition or on any commitment to store our residents' data in Germany or the EU. 4 6 8 9
The Skeptic
The contracting entity is Google Ireland Limited in Dublin with a published data processing agreement, an ISO 27001 certification and a subprocessor list — but the same terms allow processing in any country where Google or its subprocessors maintain facilities, and the EU arrangement is collection over EU domains and servers with EU IP addresses deleted before traffic is forwarded onward to Analytics servers. With the parent in California and US Cloud Act exposure flagged for the subprocessor chain, this is a European front door in front of an unrestricted back end, not a European chain. 4 6 8
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per tier by monthly page views or events, what happens when traffic exceeds the tier, the number of sites and users included, which features (e-commerce, funnels, raw export, API, SSO, longer retention) cost extra, the free tier and its limits, the self-hosted edition and its support, minimum term and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with traffic, sites or features is unclear.
5 — Tiers are public with their price per traffic band and main inclusions, but at least one commonly needed piece (overage, extra sites, raw export, SSO, longer retention) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (page views, events, sites, users), overage handling stated, add-ons priced, the self-hosted edition's cost or licence stated, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given traffic volume, site count and feature set, with every add-on, setup, support and overage fee and the cancellation and data-return terms published.
The E-Commerce Marketing Lead
The pages distinguish a free product from the premium Analytics 360 aimed at large enterprises with SLAs and the BigQuery export, so a free tier exists. We found no public information on what Analytics 360 costs, how price scales with traffic, sites or features, or minimum term and VAT treatment — I could not compute an annual cost from these pages. 1 3
The Data Protection Officer
The captured pages show a free Google Analytics alongside a paid Analytics 360 positioned for large enterprises with enterprise-level support and service level agreements. We found no public prices, no scaling by traffic, sites or users, and no overage, add-on, minimum-term or VAT terms on any captured page. 1 3
The Agency Developer
A free GA4 and a paid Analytics 360 are the stated editions, with 360 positioned for large enterprises with enterprise-level support and SLAs, but the captured marketing and documentation pages give no price figure, traffic-based scaling rule, site or user counts, or add-on costs. I cannot compute a client's annual cost from these pages, so a viral client's bill stays unpredictable. 3
The Growth Analyst
A free GA4 and a paid Analytics 360 positioned at large enterprises with enterprise-level support are the only pricing structure the captured pages show. No price for any tier, traffic band, site or user limit, add-on or minimum term appears on the pages we read, so an annual cost cannot be computed from public information. 3
The Public-Sector Site Owner
The product family comprises a free Google Analytics 4 and a paid Analytics 360 positioned for large enterprises with enterprise-level support and SLAs. We found no public information on any price for the paid tier, on traffic bands, included sites and users, or on minimum term and setup conditions, so the procurement office cannot compute an annual cost from the captured pages. 1 3
The Skeptic
A free standard product and a paid Analytics 360 positioned for large enterprises are described, so a buyer knows two editions exist. We found no public information on the captured pages about any price, tier structure, traffic bands, feature add-ons, minimum term or what happens when traffic exceeds a tier, so no annual cost can be computed from these pages. 1 3
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Google Analytics 4
Is Google Analytics 4 European?
No. whats-best.ai classifies Google Analytics 4 as Rest of world.
Where does Google Analytics 4 store data?
Not stated on the vendor’s pages as of 29 Oct 2026.
Does Google Analytics 4 have a free plan?
Not stated on the vendor’s pages as of 29 Oct 2026.
What are the best alternatives to Google Analytics 4?
As of 4 Nov 2026, the panel rates Matomo (4/5), Piwik PRO Analytics Suite (3.5/5) and Pirsch Analytics (3.5/5) highest among the other 17 Web Analytics products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Piwik PRO Analytics Suite (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Google Analytics 4 alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 29 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Legal entity, Hosting location. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- We found no public information on pricing on the pages we read (marketingplatform.google.com/intl/de/about/analytics, marketingplatform.google.com/intl/de/about/analytics/features, marketingplatform.google.com/intl/de/about/analytics-360, support.google.com/analytics/answer/12017362?hl=de, support.google.com/analytics/answer/9976101?hl=de, business.safety.google/adsprocessorterms and 3 more). If the vendor publishes it somewhere else, send us the page. Know more? Tell us
- 26 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 14 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (9)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage marketingplatform.google.com Checked 29 Oct 2026 Details →
- 2 Features page marketingplatform.google.com Checked 29 Oct 2026 Details →
- 3 Features page (Analytics 360) marketingplatform.google.com Checked 29 Oct 2026 Details →
- 4 Documentation (EU data and privacy) support.google.com Checked 29 Oct 2026 Details →
- 5 Documentation (consent mode) support.google.com Checked 29 Oct 2026 Details →
- 6 Data processing agreement (dpa) business.safety.google Checked 29 Oct 2026 Details →
- 7 Subprocessor list business.safety.google Checked 29 Oct 2026 Details →
- 8 Legal notice www.google.de Checked 29 Oct 2026 Details →
- 9 Privacy policy policies.google.com Checked 29 Oct 2026 Details →