Google Analytics and Your Privacy Policy: What Google Requires

Disclosure: Some links are sponsored. We may earn a commission if you sign up for or buy a product through them, at no extra cost to you. This is general information, not legal advice.

Last reviewed: October 15, 2026 by the Smart Savings Guides editorial team. How we research and update articles.

Not legal advice: this is a plain-English summary to help you ask the right questions. Which laws apply depends on where you and your visitors are, what data you collect and how big your business is. For anything high-stakes, talk to a lawyer licensed where you operate.

If you've added Google Analytics to your website, you've agreed to its terms of service, and those terms include specific privacy requirements. Many small sites miss them. This guide explains what Google requires, where consent comes in, and what to put in your privacy policy.

Quick answer

Google Analytics' terms require you to have a privacy policy that discloses your use of Google Analytics and how it collects and processes data, including its use of cookies or similar identifiers.
Google suggests linking to its page "How Google uses information from sites or apps that use our services."
You must get consent where the law requires it. For visitors in the EEA, UK and Switzerland, Google's EU user consent policy adds its own conditions.
Google's Consent Mode v2 passes your visitors' consent choices to Google tags, and Google requires its consent signals for some advertising features with EEA traffic.

Need a privacy policy and consent banner that work with Google tags?

Sponsored link: we may earn a commission if you sign up or buy through it, at no extra cost to you.

Try Termly's policy generator

Opens Termly's privacy policy generator. The free plan covers one basic policy; paid plans are listed on Termly's Pricing page (Starter from $10 and Pro+ from $15 per website a month, billed annually, checked October 15, 2026). A generator only reflects your answers and isn't legal advice.

Our Termly partner link is set up for readers in the US. If you're outside the US, you can go to Termly's website directly.

What the Google Analytics terms say

Section 7 of the Google Analytics Terms of Service covers privacy. In summary, you must:

not send Google any information that Google could use or recognize as personally identifiable, apart from narrow exceptions for certain features that use hashed data;
have and follow an appropriate privacy policy, and comply with all applicable laws, policies and regulations on collecting information from visitors;
post a privacy policy that gives notice of your use of cookies or other identifiers used to collect data, and discloses your use of Google Analytics and how it collects and processes data. Google says you can do this by linking prominently to How Google uses information from sites or apps that use our services;
use commercially reasonable efforts to make sure visitors are given clear information about, and give consent to, the storing and accessing of cookies or other information on their devices, where that consent is legally required;
not get around any privacy features of the service, such as an opt-out.

Breaking the terms can put your Analytics account at risk, apart from any legal issue.

Google's EU user consent policy

If your site has visitors in the European Economic Area, the UK or Switzerland, Google's EU user consent policy applies to your use of its products. It requires you to get consent for the use of cookies or other local storage where legally required, and for the collection, sharing and use of personal data to personalize ads. You must keep records of consent, give users clear instructions for revoking it, and clearly identify each party that may collect, receive or use their personal data.

Where Consent Mode v2 fits

Consent Mode is Google's way of passing a visitor's consent choices to its tags. Your consent banner sets signals such as analytics_storage and ad_storage, and tags adjust their behavior. Version 2 added two more signals, ad_user_data and ad_personalization, covering whether user data may be sent to Google for advertising and whether ads may be personalized. Google requires these signals for some advertising measurement and personalization features with EEA traffic.

Consent Mode doesn't collect consent itself. You still need a banner or consent platform that asks the visitor and then sends the signals. Many consent tools now support it; check that yours does, and whether it supports "basic" mode (tags wait until consent) or "advanced" mode (tags load but send limited, cookieless pings until consent).

US privacy laws

US law generally doesn't require cookie consent banners the way EU law does, but it does require notice. California's CalOPPA requires a privacy policy for commercial sites collecting personal information from California residents. If you're covered by the CCPA and you link Analytics to advertising features, check with your adviser whether any of that counts as "sharing" for cross-context behavioral advertising, which brings opt-out duties. See does my website need a privacy policy?

What to put in your privacy policy

Adapt this to your setup; it isn't legal advice and isn't a complete policy.

That you use Google Analytics and what for, such as understanding how visitors use the site.
What it collects: for example pages viewed, time on site, approximate location, device and browser information, and referring sites, using cookies or similar identifiers.
The link to Google's "How Google uses information from sites or apps that use our services" page.
Whether you use advertising features, such as Google Signals or links to Google Ads, and what that means.
How visitors can opt out, including your consent banner settings and Google's browser opt-out add-on.
Your lawful basis and retention if GDPR applies, including your Analytics data retention setting.

Is there a simpler option?

If you only need basic traffic numbers, a cookie-free, aggregate analytics tool can reduce your consent and disclosure burden. This site, for example, counts visits with Cloudflare Web Analytics, which doesn't use cookies or fingerprinting; we still describe it on our privacy page. If you need Google Analytics' features or run Google Ads, plan for a policy and consent setup that matches.

Checklist

Update your privacy policy to name Google Analytics and link to Google's partner-sites page.
Check that no personal data, such as email addresses in page URLs, is sent to Analytics.
Add a consent banner for EEA, UK and Swiss visitors, and anywhere else consent is required.
Set up Consent Mode v2 through your banner if you use Google advertising features.
Keep consent records and a way to change choices.
Review the policy whenever you add tags, pixels or advertising features.

Sources

Official sources this article relies on, checked October 15, 2026. Rules and prices change, so confirm details at the source.

Generating the policy: Termly

We may earn a commission if you sign up or buy through these links, at no extra cost to you. This is a sponsored link.

If you need both the policy and a consent banner that passes signals to Google tags, Termly asks questions about your site and generates a policy from your answers. Its free plan covers one basic policy. Its Pricing page (checked October 15, 2026) lists Starter from $10 and Pro+ from $15 per website a month, billed annually; Pro+ adds unlimited policies and edits, auto-updated policies, Google Consent Mode v2 and IAB TCF 2.3 support, multi-language support and regional consent rules. A generator only reflects your answers, so review the result. Read our Termly review.

Try Termly's policy generator

Sponsored link. Start on the free plan; upgrade only if you need more policies, edits or consent features. Our Termly partner link is set up for readers in the US. If you're outside the US, you can go to Termly's website directly.

Frequently asked questions

Does Google Analytics require a privacy policy?

Yes. Its terms require you to post a privacy policy that discloses your use of Google Analytics, how it collects and processes data, and your use of cookies or similar identifiers.

Do I need a cookie banner for Google Analytics?

For visitors in the EEA, UK and Switzerland, generally yes, because Analytics cookies typically need consent there, and Google's terms require consent where legally required. US law generally requires notice rather than a banner.

What is Google Consent Mode v2?

It's a way to pass visitors' consent choices to Google tags. Version 2 added ad_user_data and ad_personalization signals, which Google requires for some advertising features with EEA traffic.

What link does Google ask you to include?

Google suggests linking to its page "How Google uses information from sites or apps that use our services" at policies.google.com/technologies/partner-sites.

More guides

← Back to the main guide