Iubenda logo
Start generating


Table of Contents

Google Analytics 4 – all you need to know

In this guide, we’ll answer the main questions about the upcoming Google Analytics 4, the main new features, how to switch to GA4, what data are being collected, the concerns about compliance with privacy regulations like the GDPR, and so on.

Let’s dig into it.


What’s Google Analytics 4?

Google Analytics (GA) 4 is the new property replacing the old GA3 version. Google officially released it early this year, and it will replace GA3 entirely by July 1, 2023

As stated by Google, this new version provides these main characteristics:

  • Collects both website and app data to understand the customer journey better
  • Uses events instead of session-based data
  • Includes privacy controls such as cookieless measurement and behavioral and conversion modeling
  • Predictive capabilities offer guidance without complex models
  • Direct integrations to media platforms help drive actions

Universal analytics vs. Google Analytics 4 – what are the main differences?

Universal Analytics is currently the standard Google Analytics Snippet and uses a measurement model based on sessions and pageviews.
A session is a group of user interactions (hits) with a website that takes place over a given timeframe. A session can contain multiple page views, events, and eCommerce transactions.
The most significant difference with the new version is that Google Analytics 4 uses a measurement model based on events and parameters.

An event allows measuring user interaction on a website or app. Any “hit” can be captured as an event.
Events are divided by:

Automatically collected events
The following parameters are collected by default with every event, including custom events:
– language;
– page_location
– page_referrer
– page_title
– screen_resolution

Enhanced Measurement events – These events allow measuring interactions with the website’s content by enabling options (events) in the Google Analytics interface. These events include scrolls, outbound clicks, site search, and video engagement.

Recommended Events – These are events recommended by Google to help measure additional features and behavior and generate more detailed reports.

Custom Events – Events and parameters that can be created and implemented based on website requirements.

How do I switch to Google Analytics 4?

To switch to GA4, Google provides a GA4 Setup Assistant on the Admin page of a Google Analytics installation. 
You can follow these instructions from Google documentation.

If your site uses the gtag.js tag, you have the option to Enable data collection using your existing tags. GA4 has the same script, and no code changes are required.
Example of a gtag.js version:

<!-- Global site tag (gtag.js) - Google Analytics -->
<script type="text/javascript" async src="https://www.googletagmanager.com/gtag/js?id=UA-XXXXX-1"></script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('js', new Date());
  gtag('config', 'UA-XXXXXXXXXXX-1');
<!-- End Google Analytics -->

If Analytics has been set up before August 2017, the site is probably tagged with analytics.js. In this case, the wizard can’t reuse your existing tagging, and you’ll need to add the tag yourself following these instructions.


The tracking ID is a string like UA-000000-2. It is included in your tracking code to tell Analytics which account and property to send data to. It’s the identifier used by Google Analytics 3.

When you set up a Google Analytics 4 property, you have a Measurement ID instead of a Tracking ID. A Measurement ID uses the format G-XXXXXXX and identifies the data stream sending data to your Google Analytics 4 property.

GDPR Requirements and setting up additional security measures in GA4

So far, European Data Protection Authorities (DPAs) have said that if organizations want to continue using Google Analytics, they need to implement additional technical security measures. However, keep in mind that the DPAs have not identified these additional technical measures.

Guido Scorza, a member of the Italian DPA (Garante), said in an interview that they hope these technical security measures will be identified directly by data controllers or implemented by Google Analytics.

Please note that these additional security measures will have to bring protection standards up to par with the GDPR.

As it is still difficult to gauge the impact of the decision on Google Analytics, it is up to each business to decide whether to  continue using Google Analytics or to go with non-US analytics alternatives

If you choose to continue using Google Analytics, here are a few things you can do to bring you closer to compliance:

  1. You can limit data gathering by using Google’s extensive privacy controls, ranging from restricting advertising features to fully deactivating data collection. 
  2. An internal assessment of Google Analytics can be used to determine whether some or all metrics are appropriate for your company. Google Analytics 4 now provides the option to: turn off the collection of Google Signals data based on geographic area and turn off the collection of granular data on location.
  3. In light of CNIL’s FAQs on this topic, it’s worthwhile mentioning proxy servers. Using a proxy server to avoid direct contact between the user’s computer and Google Analytics might be possible.
  4. Don’t forget to properly disclose your use of Google Analytics 4 in your privacy policy. You can find the Google Analytics 4 clause within the Privacy and Cookie Policy Generator in your iubenda dashboard.

Which identifiers does Google Analytics use?

Each activity a user can perform on a website could use different devices and platforms in separate sessions. 
Google Analytics 4 can use different methods to unify these interactions into a single cross-device user journey:

  • User ID – used to measure user journeys across devices. User-ID is the most accurate identifier because it uses data you collect to identify your users.
  • Google signals – data from users who are signed in to Google
  • Device ID – On websites, the device ID gets its value from the client ID. On apps, the device ID is the app-instance ID.
  • Modeling – it’s used when users decline Analytics identifiers like cookies. Analytics uses the data of similar users who do accept cookies from the same property to fill this gap.

What data does Google Analytics collect?

Through the default implementation, these data are collected by GA4: number of users, session statistics, approximate geolocation, and browser and device information.
Along with the parameters that are collected by default with every event (see above)

Furthermore, Analytics collects a set of “granular location and device data” that are:

  • Latitude (of city)
  • Longitude (of city)
  • Browser minor version
  • Browser User-Agent string
  • Device brand
  • Device model
  • Device name
  • Operating system minor version
  • Platform minor version
  • Screen resolution

The collection of granular location-and-device data can be disabled. Click here to see how.

How long can user-level data be retained with Google Analytics 4?

While for Universal Analytics user-level and event-level data properties could have an indefinite duration, user-level data can be retained for a maximum of 14 months for Google Analytics 4 properties.

Will I lose data when updating to Google Analytics 4?

As we mentioned earlier, GA4 uses a new type of event-based measurement, in contrast to the previous measurement of page views/session. Universal Analytics properties will stop collecting data from July 1st, 2023, and historic data will be deleted six months later. 
Since Google Analytics 4 uses a different tracking code, it is impossible to simply “migrate” or “upgrade” a property from Universal Analytics to GA4 and data will not be directly comparable to UA data.
So to ensure that the data is continuous, you should start using GA4 now. This guarantees a set of performance data for the maximum retention period for user-level data in GA4 when it becomes the only usable version in July 2023.

What data collection settings can not be migrated on Google Analytics 4?

These data collection settings have no equivalent in GA 4:

  • control over IP anonymization – IP anonymization is now enabled by default
  • timing

Furthermore, if you’re using analytics.js, custom task is not available in Google Analytics 4

Do I need to anonymize the IP for Google Analytics 4? And is prior-blocking required?

Google Analytics 4 uses IP addresses at collection time to determine location information (country, city, latitude, and longitude of the city) and then discards it before data is logged into any server.

This is something new and a big difference from Universal Analytics which needed a particular tag to anonymize IP.
IP anonymization is always enabled for GA4 properties & no manual action is required.

The answer to the need to prior-block GA scripts is not straightforward, though.
Currently, the main issue is not about considering consent as a valid legal basis for processing, but about the possible personal data transfer to the US.
The rulings issued by European Data Protection Authorities (most recently the Garante) about the compliant use of Google Analytics refer to the unlawful transfer of European users’ personal data.
IP anonymization is undoubtedly a step forward for excluding personal data from processing and transferring, but it could not be enough.

If you decide to update to GA4, at the moment, prior-blocking could still be considered an option.

Is Google Analytics 4 GDPR-compliant?

The most important implementation of the new version concerns the fact that Google Analytics 4 uses IP only to determine where to record other personal data of users, and then it is deleted.

Regarding this new feature, it will be interesting to see whether the European Data Protection Authorities will rule on Google Analytics 4 implementations soon. As soon as relevant case law developments arise, we will systematically analyze them and inform our users promptly.

Something that can help mitigate the risks is to minimize the amount of data collected by turning off the collection of Google Signals data based on geographic area and turning off the collection of granular data on location.

Meanwhile, you can already select Google Analytics 4 via our generator.

How do I delete users’ data from Google Analytics?

You may be asked by a given user to delete all data about them, including data collected with Google Analytics.
Google Analytics provides two methods to delete users’ data: User exploration or User Deletion API.

To delete a given user data via the first method, you have to create a User exploration, find the relevant data you want to delete and then delete them. You can follow this guide from Google documentation.

NOTE: if you’re still using Universal Analytics properties (GA3) the procedure is described here.

User Deletion API is used to request the data deletion for a given user. To do so you can use the upsert method specifying one of the identifiers inside id.userId field. Supported user id types are:

  • CLIENT_ID: usable when webPropertyId or propertyId field is set.
  • USER_ID: usable when webPropertyId or propertyId field is set.
  • APP_INSTANCE_ID: Firebase application instance id – supported when firebaseProjectId orpropertyId& field is set).

NOTE: This method works either with a GA4 Property (specified by propertyId field) or a Google Analytics web property (specified by webPropertyId field).