Google Analytics GDPR: test the setup

The browser can show requests, storage, parameters, consent signals, and some destinations. Admin screenshots can show property settings, product links, retention, access, and exports. Contracts and privacy records show a different layer. None alone proves that the whole implementation meets the GDPR or German law.

Section 25 TDDDG addresses storing information on or accessing information from terminal equipment. The DSK digital-services guidance separates that question from later personal-data processing under the GDPR. Record both; let the controller’s DPO or counsel decide exceptions, legal bases, roles, transfer treatment, and notice wording.

Google’s Consent Mode overview says advanced mode sends cookieless pings while consent is denied. These can include timestamp, user agent, referrer, consent state, ad-click presence, and a random number per page load. Capture the exact request. The label “cookieless” cannot determine personal-data status or legal basis.

The implementation guide requires defaults before measurement commands and updates after user action. It also describes `analytics_storage`, `ad_storage`, `ad_user_data`, and `ad_personalization`. Check ordering, region scoping, `wait_for_update`, URL passthrough, data redaction, and what the CMP actually persists.

Google states in its EU-focused Analytics privacy documentation that individual IP addresses from EU, Swiss, and UK users are used to derive coarse geolocation and discarded before logging. GA4 does not require the old Universal Analytics `anonymizeIp` setting.

Google’s data-collection documentation says Analytics normally stores a Client ID in the first-party `_ga` cookie and does not store it when Analytics storage is deactivated through Consent Mode. Review the full event payload and destinations; the IP statement does not make Client ID, User-ID, URLs, events, or other values disappear.

Google’s retention documentation describes automatic deletion periods for user-level and event-level data. It also says the setting does not affect standard aggregated reports. The reset-on-new-activity option can extend the expiry of a user identifier when activity continues.

Record the selected value and its scope. Then follow every export and linked destination separately. BigQuery, a warehouse, a downloaded report, or an Ads audience has its own control and owner.

Google’s Analytics data-processing terms page says the Google Ads Data Processing Terms replaced the earlier Analytics amendment and explains when terms are incorporated or accepted in account settings. Record the actual account, customer entity, terms path, contacts, and date instead of copying “AVV done” into a checklist.

Features can create additional data uses and destinations. Google’s 2026 data-control update says that from 15 June 2026 Consent Mode controls Ads data collection while the Google Signals setting controls association with signed-in data for behavioral reporting; further Ads-personalisation changes are scheduled later in 2026. Save the current state and review it again when Google completes the change.

For transfers, record the recipient entity, country, data, feature, and instrument relied on. The European Commission maintains the EU-US data-transfer and Data Privacy Framework material. Certification or an adequacy decision informs the controller’s current transfer assessment and cannot permanently guarantee every flow.

Use the cookie-banner guide for the wider five-state interface and enforcement test. Use the GDPR website checklist for forms, providers, notices, rights, security, and deletion.

For independent browser evidence, configuration review, finding ownership, and post-fix retesting, use the technical GDPR audit. The GDPR audit cost guide helps compare scope and published pricing.