What Does Google Analytics 4 Not Log or Store IP Addresses?

One of the biggest changes Google made with Google Analytics 4 is that it no longer logs or stores individual IP addresses. This is a fundamental shift from the old Universal Analytics and a direct response to the growing global focus on user privacy. This article will explain exactly how GA4 handles IP addresses, why this change was made, and what it means for your reporting and analytics workflow.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

What Exactly Is an IP Address and Why Is It a Big Deal?

Think of an IP (Internet Protocol) address as a unique mailing address for your device (computer, phone, tablet) on the internet. It’s a string of numbers that allows servers to know where to send the data you request - like the contents of a webpage. Without it, you wouldn't be able to browse the web.

From an analytics and privacy perspective, IP addresses are significant for two main reasons:

• Geolocation: An IP address can be used to approximate a user's physical location, often down to the city, state, and country. This is extremely useful for marketers who want to understand where their website visitors are coming from.
• Personally Identifiable Information (PII): A single IP address can sometimes be traced back to a specific individual or household. Because of this, major privacy regulations like Europe's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) classify IP addresses as personal data, placing strict rules on how they can be collected, stored, and processed.

In the past, Universal Analytics used IP addresses for reporting and allowed users to optionally enable an IP anonymization feature. In GA4, this process isn't optional - it's automatic and mandatory for everyone.

How GA4 Handles IP Addresses: The Collect-Then-Discard Method

It's a common misconception that GA4 doesn’t use IP addresses at all. It does, but only for a fleeting moment before permanently discarding them. The process happens in two quick steps.

Step 1: Data Collection & Geolocation Lookup

When a user visits your website and triggers an event (like a page_view), the data packet sent to Google's servers naturally includes the user's IP address. GA4's collection servers immediately use this IP address to perform a geolocation lookup. Based on this lookup, it derives several geographic dimensions:

• Country
• Region (e.g., state or province)
• City
• Continent ID
• Sub-continent ID

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

Step 2: Discarding the IP Address

As soon as this geographic information is determined, GA4 discards the IP address. It is never logged to disk, stored, or made visible in any report. The granular location data GA4 does log is always less precise than the original IP Address, protecting the user's privacy while still giving you the regional data you need for analysis.

This "collect-then-discard" model is the core of GA4's privacy-centric approach and a key difference from its predecessor. Universal Analytics stored IP addresses unless you specifically configured it not to - in GA4, you have no choice, and that's a good thing for privacy compliance.

Why Did Google Make This Change?

Google's decision wasn't random, it was a strategic move driven by legal pressure, a changing public attitude toward privacy, and a desire to future-proof its analytics platform.

1. The Rise of Global Privacy Regulations

The global privacy landscape has changed dramatically. Laws like GDPR in the EU put huge fines on companies that misuse personal data. Several European data protection authorities, including those in Austria, France, and Italy, ruled that Universal Analytics' use of IP addresses and data transfers to U.S.-based servers violated GDPR. By completely removing IP address storage, Google made GA4 a much more compliant tool out of the box, helping businesses meet their legal obligations more easily.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

2. Building Trust with Users and Businesses

Today’s consumers are more aware than ever of how their data is being used. A privacy-first approach helps build trust. For businesses using Google Analytics, this change provides peace of mind, knowing that a key piece of PII is no longer being stored on their behalf by the platform. It signals that both Google and the businesses using its tools are taking user privacy seriously.

3. A Walled-Garden and Cookie-less Future

The internet is moving away from third-party cookies and individual user tracking. GA4 was designed for this new reality. By focusing on aggregated, event-based data and using modeling for measurement instead of relying on granular identifiers like IP addresses and cookies, Google is preparing its platform for a future where user-level tracking is much more restricted.

What This Change Means for Your Analytics and Reporting

For most marketers and business owners, the impact of not having IP addresses is minimal and mostly positive. Your core reports won't change much, but you will need to adjust your workflow for one specific task: filtering internal traffic.

Geolocation Reporting Remains Intact

You can still see where your users are coming from. The geolocation reports in GA4 (found under Reports > User > User attributes > Details and selecting "Country" or "City") work just as they did before. The data is simply derived from the IP address before it's discarded. For strategic decisions like tailoring marketing campaigns to specific cities or countries, this level of detail is almost always sufficient.

What you can't do anymore is see hyper-granular location data or attempt to link website activity back to a specific IP address, which aligns with modern privacy expectations.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

A New Way to Filter Internal Traffic

The most significant workflow change involves filtering out traffic from your own company, agencies, or contractors. In Universal Analytics, the common method was to create a filter that excluded a list of specific office IP addresses. Since GA4 doesn't store IPs, this method is no longer possible.

Instead, GA4 uses a more reliable, built-in system based on an event parameter.

Here’s the step-by-step process:

1. Define Your IP Addresses for GA4's Tag: In your GA4 Admin panel, navigate to Data Streams, and select your web data stream. Go to Configure tag settings > Show more > Define internal traffic. Here, you can create rules to name and list your internal IP addresses. For example, you can create a rule called "Main Office" and enter its IP address.
2. How it Works: When someone visits your website from one of the IP addresses you defined, the Google tag on your site will automatically add a parameter to all events: traffic_type = 'internal'. This happens in the user’s browser before the data is sent to Google.
3. Create a Data Filter: Next, go to Admin > Data Settings > Data Filters. Here, you can create an "Internal Traffic" filter. This filter tells GA4 to exclude all data where the traffic_type event parameter has a value of 'internal'.
4. Activate the Filter: Data filters can be set to "Testing" mode (where you can see the effect without permanently removing data) or "Active" mode (which permanently excludes the data from your reports). After verifying in Testing mode, switch it to Active.

While this process has a few more steps than the old IP filter, it provides a structured and transparent way to manage internal traffic that doesn't rely on storing personal data.

The Benefits for Your Business

Ultimately, this change is a net positive for businesses.

• Helps With Compliance: Removing a key piece of PII simplifies your path toward complying with regulations like GDPR. It’s one less thing for your legal team to worry about.
• Reduces Risk: Less personal data stored means less liability for your company in the event of a breach.
• Focus on What Matters: It encourages marketers and analysts to focus on aggregate trends and user behavior patterns rather than trying to track individuals, which is a healthier and more sustainable approach to analytics.

Final Thoughts

Google's decision to stop logging and storing IP addresses in GA4 is a powerful reflection of the internet's shift toward a more privacy-conscious future. By automatically processing and then discarding IPs, GA4 provides the geographic data marketers need without creating a compliance headache. This change ensures the platform is built for the long term, adapting to a world where user privacy is no longer an option but a requirement.

Understanding these finer details while also trying to connect insights from Google Analytics with your ad platforms, CRM, and storefront can feel like a full-time job. We created Graphed to remove that complexity. By securely connecting all your data sources, we let you use simple, natural language to ask questions, create real-time dashboards, and get instant answers about your marketing and sales performance. This frees you up to work on your strategy, not on figuring out the technicalities of reporting tools.