How to Make Google Analytics GDPR-Compliant (No Consent Required)

Google Analytics is an incredibly powerful analytics tracking tool at the heart of being able to evaluate marketing data and making decisions based on what’s working to improve SEO performance over time.

However, the introduction of the GDPR in May of 2018 imposed a number of restrictions on the extent to which data can be collected and processed without consent – significantly affecting Google Analytics tracking data.

What is the GDPR & Why It Matters?

Simply put, the GDPR – General Data Protection Regulation – is a regulation in EU law concerning data protection and privacy in the EU and the EEA (European Economic Area). However, it also addresses the transfer of personally identifiable information & data outside of the EU and EEA areas which means it affects virtually every business with a website that’s accessible to a global audience.

Cookies and Personally Identifiable Information

BEFORE: How Google Analytics Adds Tracking Cookies By Default (This Is Not GDPR-Compliant)

The GDPR has led to unusable and inescapable cookie & consent notices that many would classify as a UX nightmare on almost every website – with them really failing to do anything to actually protect our privacy.

People deserve to know all of the personally identifiable information that companies are collecting about them and have access to it when they want.

A part of the data that is affected is Google Analytics tracking data. Out of the box, Google Analytics is not GDPR-compliant which means that using it on your site can only be done once consent is given. This means that in order to remain compliant with the privacy regulation, you would need to install additional plugins that let visitors give consent and only add the analytics tracking code if and when people agree.

Not only is this a hassle to set up, but it also leads to analytics data that is grossly misrepresentative of real-world data – meaning it becomes virtually impossible to rely on when making decisions as a business. And not doing anything, continuing to collect information from your visitors that’s protected by the GDPR without collecting consent can lead to penalties and significant fines.

So, in this guide, we’re going to walk you through how you can make Google Analytics GDPR-compliant (no consent required).

Note: While we have done our best to make this option GDPR friendly, you should still consult a lawyer about how to be 100% GDPR-compliant. Rank Math isn’t a law firm so the contents of this guide are not to be considered legal advice.

How to Make Google Analytics GDPR-Compliant (No Consent Required)

AFTER: Using Rank Math’s Cookieless Tracking Feature (GDPR Compliant, No Consent Required)

The first & easiest solution is one that’s available to you if you use WordPress as your content management system (which we highly recommend as it’s trusted by businesses including Bloomberg, the BBC, and TechCrunch just to name a few).

Here’s our detailed walkthrough of how to install Google Analytics with Rank Math SEO:

1 Install & Activate Rank Math PRO

Every WordPress website needs a WordPress SEO plugin – ideally one that lets you take complete control of your website’s technical & on-page SEO. Fortunately, that’s exactly what we do here at Rank Math.

So, as you might’ve guessed, the first step – if you haven’t already – is to go ahead and install the Rank Math WordPress SEO plugin:

1. Download Rank Math & Rank Math PRO
2. Follow Rank Math’s Setup Guide
3. And that’s it! Keep reading…

2 Enable Rank Math’s Analytics Module

In order to use Rank Math to automatically make Google Analytics GDPR-compliant, you need to enable the Analytics Module available by navigating to Rank Math SEO→ Dashboard → Analytics – as shown below:

Once enabled, you’ll be able to connect your Google Account by clicking the Settings button. Go ahead and make sure that you connect the account that has access to the Google Analytics property for the site that you’re currently working on.

3 Enable Cookieless Tracking and Anonymize ID Address

The final step is to navigate to Rank Math’s General Settings → Analytics.

This is where you’ll be able to enable the Install analytics code option.

And once that option is enabled, you’ll see an additional four options, including Enable Cookieless Tracking (No Consent Required) which is the option that allows the Google Analytics tracking code to be added without collecting consent from your website visitors before doing so.

Note: The Enable Cookieless Tracking option requires Google Analytics version 3. As of Rank Math PRO v3.0.11, Rank Math introduces support for Google Analytics 4 and this feature is removed as it does not work with Google Analytics 4.

You will also need to ensure that the “Anonymize IP addresses” option is enabled. This option is required for GDPR Compliance as well.

Rank Math also lets you further tweak your analytics tracking implementation, including:

• The ability to exclude logged-in users (to avoid users on your team from inflating and skewing your analytics tracking data)
• The ability to self-host the JavaScript tracking file (host Google Analytics locally, often helpful when accelerating site speed as an external request no longer needs to be made)

Note: Once you’ve enabled this option in Rank Math – please ensure that you disable and remove all other tracking plugins and or scripts added manually.

When the above options are enabled, Rank Math PRO installs the Google Analytics tracking code using a different method to generate a unique ID for each visitor that doesn’t require a cookie (meaning that no consent is required as no sensitive, personally identifiable information is collected or sent to Google Analytics).

Behind the scenes, the way that this implementation works is by generating a random ID (dynamically on page load) by hashing and combining the website domain and specific browser and device features, such as the user agent, the screen resolution, and the browser language.

Alternative Method WordPress: GDPR-Compliant Google Analytics

If you aren’t already using Rank Math, this simple & free Google Analytics plugin also makes use of the same implementation to install the Google Analytics tracking script in a way that ensures that consent is not required.

How to Make Google Analytics GDPR-Compliant on Non-WordPress Websites

Only websites that run on WordPress are able to use the Rank Math WordPress SEO plugin and benefit from the easy implementation of all of this & much more.

However, to keep things nice and simple for those of you that don’t use WordPress – here’s how you can make Google Analytics GDPR-compliant:

Add the following JavaScript code to your page’s HTML head section (just before the closing </head> tag).

<script>
	const cyrb53 = function(str, seed = 0) {
		let h1 = 0xdeadbeef ^ seed,
			h2 = 0x41c6ce57 ^ seed;
		for (let i = 0, ch; i < str.length; i++) {
			ch = str.charCodeAt(i);
			h1 = Math.imul(h1 ^ ch, 2654435761);
			h2 = Math.imul(h2 ^ ch, 1597334677);
		}
		h1 = Math.imul(h1 ^ h1 >>> 16, 2246822507) ^ Math.imul(h2 ^ h2 >>> 13, 3266489909);
		h2 = Math.imul(h2 ^ h2 >>> 16, 2246822507) ^ Math.imul(h1 ^ h1 >>> 13, 3266489909);
		return 4294967296 * (2097151 & h2) + (h1 >>> 0);
	};

	const getNavigatorId = function() {
		let notAvailable = "unknown";

		let ua = navigator.userAgent || notAvailable;
		let lang = window.navigator.language || window.navigator.userLanguage || window.navigator.browserLanguage || window.navigator.systemLanguage || not_available;
		let colors = window.screen.colorDepth || notAvailable;
		let memKey = window.navigator.deviceMemory || notAvailable;
		let pixels = window.devicePixelRatio || notAvailable;
		let res = [window.screen.width, window.screen.height].sort().reverse().join("x");

		return ua + ";" + lang + ";" + colors + ";" + memKey + ";" + pixels + ";" + res;
	};

	let validityInterval = Math.round (new Date() / 1000 / 3600 / 24 / 7);
	let clientIDSource = window.location.host + ";" + getNavigatorId() + ";" + validityInterval;

	window.clientIDHashed = cyrb53(clientIDSource).toString(16);
	(function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
	(i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
	m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
	})(window,document,'script','//www.google-analytics.com/analytics.js','ga');

	ga('create', 'YOUR-GA-TRACKING-CODE', {
		'storage': 'none',
		'clientId': clientIDHashed
	});
	ga('set', 'anonymizeIp', true);
	ga('send', 'pageview');
</script>

Well-deserved credit for this method as well as the inspiration for the implementation goes to Helge Klein.

Note: You will need to replace YOUR-GA-TRACKING-CODE with your actual Google Analytics tracking code.

Google Analytics Data Processing Settings

In order to be fully compliant with the GDPR, in addition to changing your tracking code using the methods described above – there are also a few relevant settings that need to be set/checked in your Google Analytics account:

Note: The following configurations are applicable for Universal Properties (GA3) and not for GA4 properties.

1 Review & Accept the Data Processing Amendment

First, you have to sign the processing agreement of Google. This can be found in the Google Analytics management environment under Account Settings. Under Data Processing Agreement you should click on Review Amendment.

After reading, click Done. Learn more here.

2 Disable Data Sharing

Turn off data sharing with Google. This is done by unchecking the Data Sharing Settings under Account Settings.

3 Disable the User-ID Feature for Your Analytics Property

The User-ID feature lets you associate the engagement data from different devices and multiple sessions so you can measure how users interact with your content over an extended period of time.

This is not something you can track without permission so in order to use Google Analytics without collecting consent, disable this in your Google Analytics Property Settings → Tracking Info → User ID, as shown below:

4 Disable Data Sharing for Ads

Turn off data sharing with Google. This is done by unchecking the Data Sharing Settings under Account Settings, as shown below:

Google Analytics – Frequently Asked Questions

Summary: Rank Math + Google Analytics = An Analytics Powerhouse

As Clive Humby famously said back in 2006, “data is the new oil” and this continues to become more true as time goes on. We all use, need, consume, and require data both personally but even more so in business. And to succeed in your SEO & marketing efforts, you need data.

At what cost though? With Rank Math and the method we’ve covered in this post protecting your visitor’s privacy doesn’t have to be an afterthought or something you neglect doing simply because of how complex the implementation is. Instead, it’s something you can set & forget in a matter of clicks.