What Personal Data Does Google Analytics Collect?

Worried about the personal data Google Analytics is collecting from your website visitors? You're not alone. In a world of GDPR, CCPA, and growing privacy awareness, understanding exactly what data you're gathering is no longer optional. This article will break down what Google Analytics actually collects, what its policies forbid, and the steps you need to take to keep your analytics both useful and privacy compliant.

Graphed

Build AI Agents for Marketing

Build virtual employees that run your go to market. Connect your data sources, deploy autonomous agents, and grow your company.

Build Your First Agent

Does Google Analytics Collect Personally Identifiable Information (PII)?

Let's get the biggest question out of the way first. According to Google Analytics' terms of service, you are strictly prohibited from sending any Personally Identifiable Information (PII) to their servers. This is the cornerstone of their privacy policy.

So, what counts as PII? Generally, it's any data that can directly identify a specific individual. Think of things like:

• Names
• Email addresses
• Phone numbers
• Mailing or physical addresses
• Social Security numbers or other government-issued IDs

If Google discovers PII in your account, they can terminate it. This policy provides a baseline of protection, but it's not the full story. The devil, as always, is in the details of the data that is collected.

What Google Analytics Collects by Default

While Google Analytics doesn't want PII, it does collect "pseudonymous" data. This is information that doesn't identify a person by name, but can identify a unique web browser or device. Under modern privacy laws like GDPR, this pseudonymous data is often still considered personal data because, when combined, it could potentially be used to single out an individual.

Here’s a breakdown of the standard information that gets sent to Google Analytics with every pageview.

AI Agents for Marketing

Crash Course

Graphed

Free PDF · the crash course

AI Agents for Marketing Crash Course

Learn how to deploy AI marketing agents across your go-to-market — the best tools, prompts, and workflows to turn your data into autonomous execution without writing code.

Download the PDF

1. Unique Identifiers (Client ID & User ID)

The core of Google Analytics revolves around tracking users - more specifically, their browsers. It achieves this with unique IDs stored in cookies.

• Client ID: This is the big one. When a new user visits your site, Google Analytics places a small cookie in their browser containing a randomly generated string of numbers, like 123456789.987654321. This unique "Client ID" allows GA to recognize that browser when it returns. It's how it stitches together multiple sessions from the same person to calculate metrics like user counts and retention rates.
• User ID: This is an optional feature you can implement if you have a website with a login system. You can assign your own non-personally identifiable ID (like a database ID, e.g., "user-456") to logged-in users. This allows you to track a single user's journey across multiple devices (e.g., from their work desktop to their mobile phone), something the Client ID can't do on its own.

2. User Interaction Data

This is the behavioral data that marketers analyze every day. Google Analytics logs nearly every action a user takes on your website, including:

• Pageviews: Which specific pages a user visited, when they visited them, and the URLs of those pages.
• Events: These are custom actions you define, like clicks on a "Download Now" button, video plays, or form submissions (just a record of the submission, not a record of submitted data).
• E-commerce Data: For online stores, this can include products viewed, items added to a cart, purchases made, transaction IDs, product SKUs, and transaction revenue.

3. Device & Browser Information (Technical Data)

To help you understand how people access your site, Google Analytics automatically gathers technical details about their setup:

• Browser type (e.g., Chrome, Safari, Firefox) and its version number.
• Operating System: (e.g., Windows 10, macOS, iOS 17, Android).
• Device Category: (Desktop, Mobile, or Tablet).
• Screen resolution: of the user's device.

4. Geolocation Data

Google Analytics determines a visitor's geographic location by looking at their IP address. This data is not hyper-specific. You won’t see someone’s street address, but you will see aggregated reports based on:

• Country
• Region/State
• City

This is helpful for regional marketing but is one of the biggest sensitivities when it comes to privacy. We’ll get into IP addresses in more detail below as it is one of the more talked-about elements of GA collection.

5. Demographics (If Advertising Features are Enabled)

If you've turned on Google's Advertising Features, GA can pull in additional aggregated and anonymized data from Google’s ad network. This doesn’t tell you that John Doe is a 35-year-old male, but it will tell you that a certain percentage of your site visitors fall into the "Male, 35-44" demographic group. This can also include affinity categories (e.g., “Tech Enthusiasts,” “Movie Lovers”).

Graphed

Build AI Agents for Marketing

Build virtual employees that run your go to market. Connect your data sources, deploy autonomous agents, and grow your company.

Build Your First Agent

The Deal with IP Addresses: A Gray Area for PII

An Internet Protocol (IP) address is a unique number assigned to your device when you connect to the internet. While it doesn't contain your name or email, privacy regulations like GDPR consider it personal data because it can be used to identify a household's connection and, with other data, potentially pinpoint an individual.

By default, Google Analytics uses IP addresses to figure out a user's geographical location. Recognizing the privacy implications, Google provided a critical feature: IP Anonymization (also called IP masking).

How IP Anonymization Works

When you enable IP Anonymization, you instruct Google to change the IP address before it's ever stored on their servers. As soon as the data is received, Google sets the last part of the IP address to zeros in memory.

• For an IPv4 address like 192.168.1.123, it becomes 192.168.1.0.
• For an IPv6 address, it anonymizes the last 80 of the 128 bits.

By removing that final section, the IP address becomes imprecise and can no longer be traced to a specific user or device, while still being accurate enough for city-level geolocation reports.

The good news? In Google Analytics 4, IP anonymization is enabled by default and cannot be disabled. This is a massive step forward for privacy. If you’re still using the older Universal Analytics, you need to enable it manually by adding a line of code to your tracking snippet:

gtag('config', 'UA-XXXXXXXX-X', { 'anonymize_ip': true }),

How PII Can Accidentally Leak into Your Google Analytics

Even though Google has strict rules, it's surprisingly easy to accidentally send PII to an account. This usually happens when identifying information is included in the URL of pages you're linking to.

Here are the most common ways this happens:

• PII in URL Query Parameters: The number one culprit. For example, after someone fills out a contact form, they might be redirected to a thank you page with a URL that looks like this: https://www.example.com/thank-you?email=jane.doe@email.com&name=Jane+Doe Because Google Analytics records the full URL of every pageview, that email and name will be sent directly to and stored in your account, which is a major violation.
• User-generated content: Watch out for PII slipping through when page titles or URLs contain identifying info (for example, a user's name is their profile URL and they generate a page based on an entry using that user URL).
• Custom Dimensions: When creating Custom Dimensions to get extra data into Google Analytics, you are responsible for using data that doesn't contain PII. It might seem handy to store something specific about the user or customer within GA for data analysis, but don't give in to the temptation - it will get your account banned by Google.

Periodically audit your Page reports in Google Analytics, looking for any URLs containing an "@" symbol or suspicious query parameters like "email," "user_name," or "phone." If you find any, work with your developer to strip those parameters from URLs before a pageview is sent to GA.

AI Agents for Marketing

Crash Course

Graphed

Free PDF · the crash course

AI Agents for Marketing Crash Course

Learn how to deploy AI marketing agents across your go-to-market — the best tools, prompts, and workflows to turn your data into autonomous execution without writing code.

Download the PDF

Your Privacy-First Google Analytics Checklist

Feeling a bit overwhelmed? Don’t be. Taking control of your analytics privacy is completely manageable. Here's a simple checklist to get you on the right track.

1. Run A Data Audit: As stated in the example above, the best first action is to comb through a large list of URL data you've been collecting and search for common keywords that identify PII so that you can quickly pinpoint sources of trouble (and use those findings in the following steps).
2. Confirm you’ve upgraded to Google Analytics 4: If you are still running Universal Analytics after the July 2023 deprecation, you’re missing out on key privacy features (automatic IP anonymization), more control over data, and a flexible data model to track your website to meet today’s privacy and business demands.
3. Set your own data retention periods: Within the GA settings, you have more flexible options for controlling its disposal. Visit Admin > Data Settings > Data Retention and change if your user-level customer data should remove user IDs from its servers after 2 months or more.
4. Regularly audit your URLs: It can never hurt to make auditing a monthly task to periodically check for PII leaks. Create a reminder or task and assign it to a team member to protect yourself and your customers.
5. Add Your Privacy Policy link to GA4: As a commitment to your own due diligence (especially in an era with so many rules like GDPR, CCPA, and so much more) is adding Your Privacy Policy link to GA4 - this is an effective means of ensuring the policy is easy to find by team members looking to protect against collecting PII. Go to Admin > Data streams > Choose your web stream > Configure tag settings > Click show more to scroll to add Privacy Policy text/hyperlinks.

Final Thoughts

Ultimately, Google Analytics is a powerful tool, but its policies make it clear that platform users share responsibility for protecting user data. By understanding precisely what data is collected by default, auditing to see how you aren't adhering (or could better adhere) to all of the rules to keep yourself safe, and proactively using the privacy controls, you can provide a website to your users that's much safer than the majority on the web today.

Tracking this data correctly in Google Analytics is crucial to run a safe and protected website online, but it's often just one piece of a much larger data analysis a company needs to know about. Pulling all of our performance data - from ads, to landing pages, our sales tracking to CRM performance, and more - can so often be one of the greatest sources and biggest pain points for marketers and business leaders. That’s why we built Graphed to make this entire process as simple, effective, and secure as possible. Our platform lets you connect all your data sources and tools - from Google Analytics to Ads, to Shopify, HubSpot, your CRM, etc. Using Graphed, with simple drag-and-drop functionality and ready-to-go recipes, company leaders can build beautiful visual dashboards for their company's analytics. You'll start making faster and better decisions about your company and stop wasting hours in Excel.