# Google Analytics 4 — Web Analytics

Google Analytics 4 by Google Ireland Limited holds a panel rating of 2.5/5 from 6 AI judges (category median 2.5/5), as of 2026-10-30. Provenance: Rest of world; sovereignty: not determined.

- Vendor: Google Ireland Limited (https://marketingplatform.google.com/intl/de/about/analytics/)
- Category: [Web Analytics](https://whats-best.ai/software/web-analytics.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/web-analytics/google-analytics
- Alternatives: https://whats-best.ai/software/web-analytics/google-analytics/alternatives ([markdown](https://whats-best.ai/software/web-analytics/google-analytics/alternatives.md))
- Data as of: 2026-11-04 · evaluated 2026-10-30 · oldest source captured 2026-10-29

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Google Ireland Limited
- Headquarters: Not stated on the vendor’s pages as of 29 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 29 Oct 2026
- Free plan: Not stated on the vendor’s pages as of 29 Oct 2026

## The panel's verdict

Google Analytics 4, from Google Ireland Limited, is strongest on data ownership, the only criterion at a flat 6: a daily BigQuery export covered by an SLA and unsampled total-data reports in the paid tier, and deletion of all remaining customer personal data within a maximum of 180 days after the term. Implementation is the weakest area apart from pricing, flat 4 — setup runs through gtag.js, Tag Manager templates and a Firebase SDK, but we found no public information on script size, CMS plugins, team roles or single sign-on. Judges split on conversions and events, 4 to 6: top scores credit Google Ads conversion tracking, attribution models and machine-learning predictions, low ones cite no public information on funnels with drop-off, e-commerce revenue or cohorts. Consent and privacy splits too, 4 to 6, between deep consent-mode documentation and a default state that grants all consent and writes advertising cookies. Sovereignty sits at 4 to 5, EU collection alongside terms that allow processing in any country where Google or its subprocessors maintain facilities; pricing transparency is a flat 3.

**Speaks for it:**
- Daily BigQuery export covered by an SLA and unsampled total-data reports documented for Analytics 360
- Deletion of all remaining customer personal data within a maximum of 180 days after the term, committed in the data processing terms
- Consent mode documented to individual ping fields and per-storage-type behaviour, with EU, Swiss and UK IP addresses deleted before recording and never logged
- Google Ireland Limited in Dublin named as contracting entity, with a published data processing agreement, ISO 27001 certification and a subprocessor list
- Google Ads conversion tracking and remarketing, attribution models and machine-learning predictions of audience behaviour documented

**Held against it:**
- Processing terms allow processing of customer data in any country where Google or its subprocessors maintain facilities, with the parent in California and US Cloud Act exposure flagged
- The default consent state assumes all consent granted, writes advertising cookies and collects advertising identifiers, so a consent banner remains part of the setup
- We found no public information on referrers, campaign reports, a real-time view, segments or scheduled email reports
- We found no public information on funnels with drop-off, e-commerce revenue and product tracking, or cohorts
- We found no public information on script size, plugins for named CMS or shop systems, team roles, single sign-on or a public status page

**Best for:**
- You advertise through Google Ads and want conversion tracking, remarketing and attribution models tied directly to your analytics
- You depend on a nightly warehouse sync through the paid Analytics 360 tier's SLA-covered daily BigQuery export
- You must be able to audit consent behaviour in detail, from per-storage-type settings to cookieless pings when consent is denied
- Your measurement spans web and apps, where cross-device analysis and a Firebase SDK are documented

**Avoid if:**
- You need EU-bound processing — the terms allow processing in any country where Google or its subprocessors maintain facilities, the parent is Google LLC in California, and US Cloud Act exposure is flagged for the subprocessor chain
- You want to run without a consent banner — the documented default grants all consent, writes advertising cookies and collects advertising identifiers, and more than thirty consent-management partners are listed
- Your conversion reporting depends on checkout funnels with drop-off per step or order and revenue tracking — the documented conversion path runs into Google platforms only, and we found no public information on e-commerce tracking or plugins for shop systems like Shopware

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The E-Commerce Marketing Lead | The Data Protection Officer | The Agency Developer | The Growth Analyst | The Public-Sector Site Owner | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Traffic, sources & campaign reports | 2.5/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Goals, events, funnels & e-commerce | 2/5 | 2/5 | 2.5/5 | 3/5 | 3/5 | 2/5 |
| Consent-free operation & data minimisation | 2.5/5 | 2.5/5 | 2.5/5 | 3/5 | 2/5 | 3/5 |
| Data access, export & self-hosting | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Installation, integrations & performance | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| European sovereignty | 2.5/5 | 2/5 | 2.5/5 | 2/5 | 2/5 | 2/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **2.5/5** | **2.5/5** | **2.5/5** | **2.5/5** | **2/5** | **2.5/5** |

### The judges

- **The E-Commerce Marketing Lead** (v1.0): Runs marketing for a Shopware shop selling outdoor gear in Germany and Austria, with a monthly ad budget split between Google, Meta and two price comparison sites. Since the consent banner went live, a third of the orders no longer show a source. Wants revenue per campaign that matches the shop backend, a checkout funnel that shows where carts are left, conversions sent back to the ad platforms, and numbers that hold without a click on "accept".
- **The Data Protection Officer** (v1.0): External data protection officer for eleven mid-sized companies, three of which still ran Universal Analytics when the Austrian authority ruled on it. Reads the data policy before the feature page: which fields are stored, how a visitor is counted without a cookie, whether the IP address is cut before it is written, who the subprocessors are and where. Signs off a site without a banner only when the vendor states its reading of §25 TDDDG in writing.
- **The Agency Developer** (v1.0): Lead developer at a twelve-person web agency that runs forty client sites on WordPress and TYPO3 and a few Shopify shops. Installs the analytics once per site and answers for it for years. Wants a small script or server-side collection, a plugin per CMS, an own tracking domain so ad blockers do not cut the numbers in half, client accounts with their own logins, and a price that does not jump when one client goes viral.
- **The Growth Analyst** (v1.0): Product and growth analyst at a B2B SaaS in Munich with a marketing site, a web app and a mobile app. Needs signups traced from the first campaign click to the first paid invoice, funnels and cohorts on custom events, and the raw events in the company's warehouse every night. Has moved tracking twice and knows that a tool without a raw export means starting the history again from zero.
- **The Public-Sector Site Owner** (v1.0): Web editor for a district administration whose site serves 400,000 residents, from vehicle registration to daycare places. The state data protection authority publishes guidance on analytics, and the council will not show a cookie banner on a public service. Needs to know which pages people search for and where forms are abandoned, with data that stays in Germany or on the municipal data centre's own servers, and a contract the procurement office can sign.
- **The Skeptic** (v1.0): Has seen "no cookie banner needed" on a tool that fingerprints every visitor, "EU-hosted" on a proxy in front of a US data store, and "unlimited" data history that ends with the subscription. Reads that a product is "GDPR-compliant" and asks which ruling the vendor means, what is stored per visit, whether the history can be exported in a format another tool imports — and what leaving would cost.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Access logging: yes [S6]
- Aes256 storage encryption: storage level · AES256 [S6]
- Authentication: yes [S6]
- Background checks: yes [S6]
- Backup power: 10 · yes [S6]
- Cctv retention: 7 [S6]
- Complaints: yes [S9]
- Confidentiality commitments: yes [S6]
- Customer role: controller or processor [S6]
- Data isolation: yes [S6]
- Disk destruction: 2 [S6]
- Dpi assistance: yes [S6]
- Employee access restriction: yes [S9]
- Encryption: yes [S9]
- Encryption at rest: yes [S6]
- EU ip deleted before recording: yes [S4]
- EU ip deleted immediately after use: yes [S4]
- EU ip not logged: EU · Schweiz · Vereinigtes Königreich · no [S4]
- EU rights: Widerspruch · Datenübertragbarkeit · Auskunft · Aktualisierung · Löschung · Einschränkung [S9]
- Fips 140 2: yes [S6]
- Fsm membership: Mitglied der Freiwilligen Selbstkontrolle Multimedia-Diensteanbieter (FSM) [S8]
- Google is processor: processor [S6]
- Incident notification: promptly and without undue delay [S6]
- ISO 27001: yes [S6]
- Legislation scope: European Data Protection Legislation · LGPD · US State Privacy Laws [S6]
- Notification delivery: designated notification email address or other direct communication [S6]
- Privacy launch reviews: yes [S6]
- Processing records: yes [S6]
- Pseudonymous data controls: yes [S6]
- Security features: Safe Browsing · Sicherheitscheck · Bestätigung in zwei Schritten [S9]
- Subprocessor contract required: yes [S6]
- Third party audit: yes [S6]
- Tls pfs: yes · yes [S6]
- Youth protection officer: yes [S8]

**Data**
- Collected types: eindeutige Kennungen · Browser-Typ und -Einstellungen · Gerätetyp und -Einstellungen · Betriebssystem · Mobilfunknetz · App-Version · IP-Adresse · Absturzberichte · Systemaktivitäten [S9]
- Deletion: Inhalte aus bestimmten Google-Diensten löschen · Elemente über Meine Aktivitäten löschen · Google-Produkte samt verknüpfter Daten löschen · Gesamtes Google-Konto löschen [S9]
- Deletion fee possible: Google's reasonable costs · yes [S6]
- Deletion max days: 180 [S6]
- Deletion on expiry: 180 [S6]
- Domain admin access: yes [S9]
- Export: yes [S9]
- Retention: Einige Daten werden bis zur Kontolöschung gespeichert; Aktivitätsdaten können automatisch gelöscht werden [S9]
- Retention practices URL: policies.google.com/technologies/ads [S6]
- Technologies: Cookies · Pixel-Tags · lokale Speicherung · Datenbanken · Serverprotokolle [S9]
- Third party sources: Verzeichnisdienste · Marketingpartner · Sicherheitspartner · öffnen zugängliche Quellen [S9]

**Hosting**
- Any country processing: none beyond additional terms [S6]
- Datacentre locations URL: www.google.com/about/datacenters/locations/ [S6]
- EU collection domains: EU (Domains und Server in der EU) [S4]
- Multi tenant servers: Google-owned · yes [S6]
- Regions: yes [S9]
- Replication: yes [S6]

**Integrations**
- Cmp partners: Axeptio · Acceptrics · Clickio Consent · Commanders Act · Complianz · CookieFirst · Cookie Information · Cookiebot · CookieHub · CookieScript · CookieYes · Concord · consentmanager · Consent Studio · CYTRIO · Didomi · illow · iubenda · Ket… [S5]
- Csp required domains: *.google-analytics.com · *.analytics.google.com [S4]
- Google ad platforms: integration with Google advertising and publisher platforms [S3]
- Named integrations: Google Ads · Search Ads 360 · Display & Video 360 · Google Cloud · Google Search Console · Salesforce [S3]

**Legal**
- AI training controller: AI-Modell-Training im EWR/der Schweiz unterliegt Google Ireland Limited [S9]
- Duration: Google deletes all Customer Personal Data [S6]
- Effective date: 2026-10-16 [S9]
- English version governs: English [S6]
- EU controller: Datenverantwortlicher · Google Ireland Limited · EWR und Schweiz [S9]
- Liability US: Agreement's liability cap [S6]
- Order of precedence: Additional Terms · Data Processing Terms · Agreement [S6]
- Register number: irisches Recht · 368047 [S8]
- Service provider: Google Ireland Limited · Gordon House, Barrow Street, Dublin 4, Irland [S8]
- Term change notice days: 30 [S6]
- Term change objection days: terminate for convenience · 90 [S6]
- UK controller: Datenverantwortlicher · Google LLC · Vereinigtes Königreich [S9]
- VAT id: IE6388047V [S8]

**Product**
- Activity controls: Web- & App-Aktivitäten · YouTube-Verlauf [S9]
- Ad storage denied: With ad_storage='denied': no new advertising cookies written, existing first-party ad cookies not read, requests sent via another domain, no Google Ads cookies read/written by Analytics, no Google Signals data, IP addresses used only for I… [S5]
- Additional features: Additional consent mode features include region-specific behavior, removing stored information, and passing information in URLs when consent is denied [S5]
- Additional products excluded: no [S6]
- Ads call conversions pending: Google Ads conversion tracking and remarketing supported; call conversions support still pending · no [S5]
- Ads data redaction: With ads_data_redaction='true' in addition to denied ad_storage, click identifiers like GCLID/DCLID are removed from consent and key event pings in Google Ads [S5]
- Advertising workspace: Advertising workspace with cross-channel ROI and attribution reports [S2]
- Analytics storage denied: With analytics_storage='denied': no first-party Analytics cookies read or written, cookieless pings sent for future measurement and modeling in GA4, IDFA not collected, events without device or user IDs sent for modeling [S5]
- App activation: App developers can enable consent mode with the Google Analytics for Firebase SDK [S5]
- Automated content analysis: yes [S9]
- Best practices: Best practices: set default consent state per region, load tags before consent dialog, show consent options quickly, allow per-storage-type consent, use region-specific default states [S5]
- Blocked tags general model: If tags are blocked due to consent settings, no data is collected and Google Ads conversion modeling uses a general model based on non-identifying variables like browser type, time of day [S5]
- Compatible tags: Google Analytics · Google Ads · Floodlight · Conversion Linker [S5]
- Consent mode deny behavior: If consent is denied, tags send cookieless pings to Google instead of storing cookies; in GA4 Google fills data gaps via conversion modeling and behavioral modeling [S5]
- Consent mode purpose: Consent mode lets site/app owners communicate users' cookie or app ID consent status to Google, and tags adjust their behavior accordingly [S5]
- Consent state persistence: When consent mode is active, the consent mode state is maintained across all pages the visitor visits [S5]
- Cross platform analysis: Geräte- und plattformübergreifende Nutzeranalyse (Web und Apps) [S1]
- Custom tags consent config: Custom tags without built-in consent checks can be configured in Tag Manager under Advanced > Consent settings [S5]
- Customer lifecycle analysis: cross-web-and-app audience analysis across the full customer lifecycle [S3]
- Data subject request routing: yes · yes [S6]
- Data subject tools: yes [S6]
- Default behavior granted: Default behavior assumes all consent granted: ad_storage='granted' and analytics_storage='granted'; ad cookies may be read/written, IP addresses collected, full page URL including click info collected, advertising identifiers like Ad ID/ID… [S5]
- Detailed data collected by default: yes · yes [S4]
- Detailed data fields not collected when off: Stadt · Breitengrad · Längengrad · Nebenversion des Browsers · User-Agent-String · Gerätemarke · Gerätemodell · Gerätename · Nebenversion des OS · Nebenversion der Plattform · Bildschirmauflösung [S4]
- Detailed data off conversion impact: sinkt erheblich [S4]
- EU lookup on EU servers: EU · Schweiz · Vereinigtes Königreich [S4]
- Ga4 no ip storage: Cookieless pings may include user agent, screen resolution and IP address via regular HTTP; Google Analytics 4 does not store or log IP addresses [S5]
- Google signals region setting: yes [S4]
- Implementation types: Advanced implementation: tags loaded before consent dialog, cookieless pings sent without consent, behavioral modeling and conversion modeling in GA4 available. Simple implementation: tags blocked until consent, no data collected, Google A… [S5]
- Inactive account manager: Kontoinaktivität-Manager [S9]
- Ip derived location metadata: Stadt (mit Breiten-/Längengrad), Kontinent, Land, Region, Subkontinent [S4]
- Machine learning predictions: machine learning to gain insights and predict future audience actions [S3]
- No ads from content: yes [S9]
- No sensitive ads: yes [S9]
- Ping contents: timestamp · user agent (web only) · referrer URL · ad click indicator in URL (GCLID/DCLID) · boolean consent status · random number per page load · CMP developer ID [S5]
- Ping types: consent state pings · key event pings · Google Analytics pings [S5]
- Premium data freshness: improved data freshness; intra-day data within one hour of collection; unsampled/raw total data reports [S3]
- Privacy check tool: Privatsphärecheck [S9]
- Region deactivatable features: Google-Signale-Erhebung · Erhebung detaillierter Standort- und Gerätedaten [S4]
- Shareable reports: shareable reports and a user-friendly interface [S3]
- Target segment: positioned for large enterprises with advanced customization, scalable tools, enterprise-level support [S3]
- Tcf limitation: If users deny consent via a TCF-based solution, no data can be estimated for GA4 properties to fill gaps [S5]
- Transfer frameworks: yes [S9]
- User id custom dimensions still sent: Fields such as user_id and custom dimensions, if set, are still sent normally [S5]
- Website activation: Consent mode for websites can be enabled with minimal coding via Tag Manager and a CMP with a community template, via gtag.js commands, or a Tag Manager template tag [S5]

**Subprocessors**
- Google liability: yes [S6]
- List URL: business.safety.google/adssubprocessors [S6]
- New subprocessor notice days: 30 [S6]
- Objection termination days: terminate for convenience · 90 [S6]
- Providers: Auftragsverarbeiter einschließlich Rechenzentrumsbetreiber und Dienstanbieter [S9]
- Security audit: yes [S6]

**Support**
- Enterprise SLA: SLAs for many product features from data collection to attribution and daily BigQuery export [S3]

## Questions

### Is Google Analytics 4 European?

No. whats-best.ai classifies Google Analytics 4 as Rest of world.

### Where does Google Analytics 4 store data?

Not stated on the vendor’s pages as of 29 Oct 2026.

### Does Google Analytics 4 have a free plan?

Not stated on the vendor’s pages as of 29 Oct 2026.

### What are the best alternatives to Google Analytics 4?

As of 4 Nov 2026, the panel rates [Matomo (4/5)](https://whats-best.ai/software/web-analytics/matomo), [Piwik PRO Analytics Suite (3.5/5)](https://whats-best.ai/software/web-analytics/piwik-pro) and [Pirsch Analytics (3.5/5)](https://whats-best.ai/software/web-analytics/pirsch) highest among the other 17 Web Analytics products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Piwik PRO Analytics Suite](https://whats-best.ai/software/web-analytics/piwik-pro) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Google Analytics 4 alternatives](https://whats-best.ai/software/web-analytics/google-analytics/alternatives).

## Head-to-head

- [Google Analytics 4 vs Plausible Analytics](https://whats-best.ai/compare/google-analytics-vs-plausible.md)
- [Google Analytics 4 vs etracker Analytics](https://whats-best.ai/compare/etracker-vs-google-analytics.md)

## What this page leaves out

- We found no public information on pricing on the pages we read (marketingplatform.google.com/intl/de/about/analytics, marketingplatform.google.com/intl/de/about/analytics/features, marketingplatform.google.com/intl/de/about/analytics-360, support.google.com/analytics/answer/12017362?hl=de, support.google.com/analytics/answer/9976101?hl=de, business.safety.google/adsprocessorterms and 3 more). If the vendor publishes it somewhere else, send us the page.
- 26 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 14 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://marketingplatform.google.com/intl/de/about/analytics/ (checked 2026-10-29)
- [S2] Features page: https://marketingplatform.google.com/intl/de/about/analytics/features/ (checked 2026-10-29)
- [S3] Features page (Analytics 360): https://marketingplatform.google.com/intl/de/about/analytics-360/ (checked 2026-10-29)
- [S4] Documentation (EU data and privacy): https://support.google.com/analytics/answer/12017362?hl=de (checked 2026-10-29)
- [S5] Documentation (consent mode): https://support.google.com/analytics/answer/9976101?hl=de (checked 2026-10-29)
- [S6] Data processing agreement (dpa): https://business.safety.google/adsprocessorterms/ (checked 2026-10-29)
- [S7] Subprocessor list: https://business.safety.google/subprocessors/ (checked 2026-10-29)
- [S8] Legal notice: https://www.google.de/contact/impressum.html (checked 2026-10-29)
- [S9] Privacy policy: https://policies.google.com/privacy?hl=de (checked 2026-10-29)

---

Cite as: whats-best.ai, "Google Analytics 4 — Web Analytics", AI panel analysis, as of 2026-11-04. https://whats-best.ai/software/web-analytics/google-analytics

Corrections: https://whats-best.ai/correct/1147?target=page