Google Analytics GDPR: Setting Up GA4

Yes, you can still use Google Analytics in Belgium, but not just any way you like. GA4 is only permitted if you ask for valid consent before tracking loads, the data-processing settings are configured correctly and you use Consent Mode v2 for visitors from the European Economic Area. In this article you will learn where the old Schrems II problem comes from, what has changed since 2023, and which concrete GA4 and Consent Mode settings you need in order to stay compliant without throwing away your measurement data.

Google Analytics is not banned in Belgium, but it is not automatically in order either: as the site owner, you are responsible for a correct configuration. There is no European ruling that declares GA4 unlawful as a product. Regulators do, however, expect you to set it up and manage it properly.

A correct measurement setup is, in fact, part of the broader choices you make when you have a B2B website built: privacy and technology partly determine whether your site is trustworthy and usable. That technical foundation also includes email authentication, so that your form and business emails actually arrive with SPF, DKIM and DMARC. Concretely, this means: GA4 places cookies (such as _ga) that count as non-essential under the ePrivacy Directive. So you have to collect valid opt-in consent before the script loads. Loading GA4 before your visitor clicks “Accept” is a violation, regardless of the whole debate about data transfers. That is also the most commonly made mistake: the analytics script is hardcoded in the <head> and fires on every page view, no matter what choice was made in the cookie banner.

Privacy and transparency are, moreover, not only a legal matter. An honest, clear approach to cookies is part of the bigger picture of building trust on your B2B website. Visitors you treat properly drop off less quickly.

What exactly is the Schrems II problem?

The Schrems II problem is about transferring European personal data to the United States, where US government agencies can in theory gain access to it. In 2020, the European Court of Justice invalidated the Privacy Shield agreement that was in force at the time. As a result, every data flow to the US suddenly became legally shaky, including that of Google Analytics.

Several European regulators ruled in 2022 that the use of (then still) Universal Analytics was, in specific cases, in breach of the GDPR, precisely because of that transatlantic data flow. That is the source of the persistent question of whether you are still allowed to use Google Analytics.

A lot has changed since then. In July 2023, the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework, a new framework that legitimises data transfers between the EU and certified American companies. Google is certified under that framework. In September 2025, the General Court of the European Union confirmed the validity of the framework and rejected a first action for annulment. In practice, the Schrems II problem has thereby been largely eased.

Important nuance: privacy organisations such as NOYB have announced that they will challenge the framework again. A future ruling that still brings the framework down (sometimes referred to as “Schrems III”) cannot be ruled out. So build your measurement setup in such a way that you are not entirely dependent on a single legal framework.

Which GA4 settings should you get right?

The starting point is that GA4 is already more privacy-friendly than Universal Analytics for European visitors, but you still have to check the settings deliberately. By default, GA4 does not log or store full IP addresses, and for EU traffic it uses European domains and servers first before data is forwarded. IP anonymisation is on and cannot be disabled.

Work through these points in your GA4 property:

Accept the Data Processing Terms and fill in your company details under the account settings. Without that, Google does not formally act as a processor.
Deliberately turn Google Signals on or off. This feature links data across devices via logged-in Google users and increases the privacy impact. Only enable it if you have a legal basis and consent for it.
Limit data retention. GA4 lets you set the retention period for user and event data. Choose the shortest term that still works for your reporting instead of the default.
Turn off granular location and device data in regions where you do not need it, in order to apply data minimisation.
Avoid accidentally sending personal data (email, name) into URLs or events to GA4. That is a common and avoidable leak.

Document these choices in your records of processing activities and your privacy statement as well. “Being compliant” is largely about being able to demonstrate what you chose and why.

Consent Mode v2 is the way you pass your visitor’s consent choice on to Google, so that tags adapt to it. Since March 2024, Google expects sites that measure EEA visitors or show them ads to implement it. If you do not, you can lose certain advertising and remarketing features.

There are two variants:

Basic Consent Mode v2: the Google tags are fully blocked until the visitor gives consent. No consent means no measurement at all. This is the simplest and most conservative setup.
Advanced Consent Mode v2: the tags load in a limited default state and, on refusal, send anonymised, cookieless “pings” without identifiers. If the visitor then gives consent, measurement switches on fully. This way you retain an estimated baseline of data, even from those who refuse.

Which one you choose depends on your risk appetite and your need for data. Advanced gives more insight but still sends signals to Google even on a refusal, which can be interpreted more strictly. Basic is safer but leaves more measurement gaps. Discuss this trade-off with whoever is responsible for privacy at your organisation.

In practice, the implementation usually runs via a cookie banner from a Google-certified Consent Management Platform partner, coupled to Google Tag Manager. The banner sets the consent signals (analytics_storage, ad_storage, ad_user_data, ad_personalization), and your tags respond to them. If you build your banner yourself, you have to drive those signals manually.

What if you would rather move away from Google Analytics?

If the ongoing legal uncertainty is too much risk for you, you can opt for a more privacy-friendly alternative that processes data in the EU and often works without cookies. Tools that can measure without personal data or without a cookie banner reduce your exposure to the transfer debate and often also give you a more complete picture, because you do not have consent gaps.

The choice is not a matter of faith. It depends on your reporting needs, your advertising integrations (Google Ads leans heavily on Consent Mode and GA4), your team and your budget. For a purely B2B lead site that mainly wants to know which channels and pages generate leads, a lighter alternative can be perfectly sufficient. For those deeply embedded in the Google ecosystem, the switch weighs more heavily. Measuring with the aim of having a website that generates leads is, incidentally, more important than whichever tool runs under the hood: first make sure you are measuring the right conversions, and only then choose the measurement instrument.

The short summary

Google Analytics remains allowed in Belgium, provided you set it up correctly. Ask for valid opt-in consent before GA4 loads, accept the Data Processing Terms and limit your data and retention settings. The Schrems II problem has been eased by the EU-US Data Privacy Framework, which survived a first lawsuit in 2025, but a new challenge remains possible, so stay flexible. Implement Consent Mode v2 to measure EEA visitors correctly, and deliberately choose between the basic and advanced variant. Those who want less risk should look at a more privacy-friendly alternative.

Do you want your website to measure correctly without legal risk, and your measurement setup to be genuinely focused on leads rather than vanity figures? We help you with an honest, conversion-focused approach. Book your free intake.

Is Google Analytics Still Allowed in Belgium? Setting Up GA4 GDPR-Compliant

Is Google Analytics still allowed in Belgium under the GDPR?

What exactly is the Schrems II problem?

Which GA4 settings should you get right?

How does Consent Mode v2 work?

What if you would rather move away from Google Analytics?

The short summary