Using GA4 in a privacy-compliant way: IP, consent and cookieless

You want to know where your visitors come from and which pages perform well, entirely understandable. Google Analytics 4, GA4 for short, is the common tool for that, free and powerful. But as soon as it comes to visitor data, two questions quickly arise: am I even allowed to do this? And what do I have to do to keep it clean? That's exactly what this is about, without a jungle of legal clauses, but with clear answers instead.

Up front: I'm a web developer, not a lawyer. What you read here is the practical view from many SME projects, not a substitute for legal advice in an individual case. But it gets you to the point where you can make the right decisions.

Why GA4 privacy is a topic at all

As soon as you measure who visits your site, you process personal data, such as the IP address or a device identifier. In Switzerland the revised Data Protection Act (revDSG) applies, and as soon as you also have visitors from the EU, the GDPR comes on top. At their core, both demand the same thing: transparency, a good reason for the processing and, in many cases, the person's consent.

On top of that: GA4 data ends up with Google, that is, with a US provider. That's not automatically forbidden, but it needs to be documented cleanly. Anyone who's sloppy here risks warnings, loss of trust, and in the worst case a fine.

The IP address: that's regulated today

IP anonymisation used to be a big issue. The good news: in GA4 that's largely defused. GA4 does not store IP addresses in the reports and uses them only briefly for rough location determination before they're discarded. You no longer have to set up manual IP anonymisation as you did with Universal Analytics; it's built into the system.

That takes work off your hands, but it doesn't solve everything. Because GA4 still sets cookies and collects behavioural data. And that's exactly what you need a basis for.

Consent: no tracking without consent

The most important building block is consent. In practice this means: a cookie banner that appears on the first visit and asks whether analytical cookies may be set. What's decisive is that GA4 only loads once the visitor has consented, not before.

For this to work, you should pay attention to a few things:

• Opt-in instead of opt-out: by default nothing is ticked. Only an active yes allows tracking.
• A real choice: "Decline" must be just as easy as "Accept", no hidden fine print.
• No pre-loading: the GA4 code must not already run in the background while the banner is still visible.
• Withdrawal possible: visitors must be able to change their decision later.

Sounds like a lot, but technically it can be solved cleanly. On this site I work exactly this way: GA4 is only loaded into the page after active consent. Anyone who declines is not measured, full stop.

Cookieless: fewer banners, less friction

Many SMEs are bothered by the banner because it slows visitors down right at the start. This is where cookieless tracking comes in, an approach that manages without classic cookies and in some cases works entirely without consent.

The idea: instead of recognising every visitor via cookies, only anonymous, aggregated numbers are recorded, how many page views, which content is popular, roughly where the traffic comes from. No one is tracked individually. Privacy-friendly tools like Plausible or Matomo (in cookieless mode) start exactly here. The advantage:

• Often no cookie banner needed, the site feels tidier.
• Data stays in Europe or Switzerland, depending on the tool.
• Considerably less legal effort and documentation.

The price: you get less depth of detail than with GA4. For most SMEs that's not a loss, though, but a gain in clarity; these tools answer the important questions perfectly well.

Which path suits you?

There isn't one right answer, but one that fits your business:

• GA4 with a consent banner: sensible if you need deep analyses, advertising integration or conversion measurement. Then there's no way around a clean banner.
• Cookieless tool: ideal if you simply want to know what's happening on your site and want to spare yourself banners and effort.

Both can be run on legally solid ground. The mistake I see most often isn't the choice of tool, but GA4 that simply runs along without any consent. That's the stumbling block you should absolutely avoid.

How to tackle it in practice

Privacy with analytics is no wizardry, if you think about it from the start. My approach: first clarify which numbers you really need. Then choose the right tool. And finally build it in technically cleanly, a banner that loads only after consent, an honest privacy policy and the option to withdraw.

If you're unsure whether your current analytics is running cleanly, I'm happy to look over it, often it's just one or two adjustments. Just get in touch via the contact form, and we'll find the path that suits you. You'll find further posts on websites and visibility in our other posts.