Google Analytics 4 (GA4)
Ubiquitous and free — because data flows to Google. Consent Mode can model conversions even when consent is denied; no GPC honoring; links into Google's ad ecosystem.
verified 2026-06-08 · grade set per the published methodology
How the grade breaks down
How little it collects, and whether collection is purpose-bound.
Whether it respects GPC, consent state, and tracking-prevention signals.
Cookieless vs. persistent IDs, cross-site linkage, fingerprinting risk.
Where data lives and whether it is shared with third parties.
How verifiable and documented its real behavior is.
At a glance
GA4 is free and dominant, but Google acts as a controller for some processing and the data feeds Google’s broader ecosystem (Google Signals, Ads linking) depending on settings. Its Consent Mode v2 ‘conversion modeling’ uses aggregated, machine-learned estimates to fill in conversions even when a user has denied consent — collection is reduced, but Google still derives modeled outcomes from denied-consent traffic. GA4 does not honor Global Privacy Control by default, relies on cookies/identifiers, and its EU-handling history (Schrems II / DPA scrutiny in several EU states) has been contentious. It can be configured more conservatively (disable Signals/Ads linking, restrict data retention), but the default posture is not privacy-minimizing. This is a technical, documented description of behavior, not a legal conclusion.
Sources & basis for grade
Grades reflect documented behavior, vendor documentation, and ad.rip scans as of the date above. Each assessment is reproducible and vendors may request correction.
- Google Consent Mode v2 / conversion-modeling documentation
- Google Signals documentation
- GA4 data-retention and data-sharing settings docs
- Public EU DPA decisions on Google Analytics (2022-2023)