Measurement and observability
GDPR Google Analytics
In an indie stack, Google Analytics is used for Audience measurement. Entity cited: Google LLC, Google Ireland Limited, or any other affiliate of Google LLC. The sections repeat what the vendor publishes, without filling a gap. Last update of the facts: October 4, 2026. Verified on October 4, 2026.
Translation of the French sheet. The facts do not change. The date is the date the official pages were read.
DPA Google Analytics
Yes. Google Ads Data Processing Terms, of which Google Analytics is an eligible service.
Stated role
Google operates as processor of Google Analytics under the Google Ads Data Processing Terms. If the customer enables the “Google products and services” sharing and accepts the Measurement Controller-Controller Data Protection Terms, Google is controller of the data shared in that context. Outside that setting, Google Analytics remains processor.
Personal data
Online identifiers, including cookie identifiers, IP addresses, device identifiers, and client identifiers. Google help states that the IP address is not logged or stored at the time of collection.
Sub-processors of Google Analytics
Google Ads sub-processor list.
Transfers outside the EU
Hosting / location
Google may process Customer Personal Data in any country where Google or its sub-processors have facilities. Analytics data is spread across geographically distributed data centers and replicated.
EU–United States Data Privacy Framework
Google LLC is registered. EU-U.S. Data Privacy Framework status: Active. The certification covers Google LLC and its 100%-owned US subsidiaries.
Cookies
Google Analytics mainly uses first-party cookies to report interactions. The customer can choose not to store the client identifier in a cookie. Advertising features may also collect Google advertising cookies.
Typical use, written by StackLégal and not by the vendor: Audience measurement.
History
Last update: October 4, 2026.
First publication. The facts come from the official pages cited in the sources. Anything not stated there remains "not disclosed".
Clause to paste
Place it in the sub-processor section of your privacy policy. Review it: a “not disclosed” field must be completed before publication.
Sub-processor clause
Sources
Verified on October 4, 2026.
Frequently asked questions
Is Google Analytics a processor within the meaning of the GDPR?
Google operates as processor of Google Analytics under the Google Ads Data Processing Terms. If the customer enables the “Google products and services” sharing and accepts the Measurement Controller-Controller Data Protection Terms, Google is controller of the data shared in that context. Outside that setting, Google Analytics remains processor.
What DPA does Google Analytics publish?
Yes. Google Ads Data Processing Terms, of which Google Analytics is an eligible service. https://business.safety.google/adsprocessorterms/
Which further sub-processors does Google Analytics publish?
Google Ads sub-processor list. https://business.safety.google/adssubprocessors
Where does Google Analytics state that it processes data, including outside the EU?
Google may process Customer Personal Data in any country where Google or its sub-processors have facilities. Analytics data is spread across geographically distributed data centers and replicated.
Is Google Analytics registered under the EU–United States Data Privacy Framework?
Google LLC is registered. EU-U.S. Data Privacy Framework status: Active. The certification covers Google LLC and its 100%-owned US subsidiaries. https://www.dataprivacyframework.gov/participant/5780
Which personal data does Google Analytics mention?
Online identifiers, including cookie identifiers, IP addresses, device identifiers, and client identifiers. Google help states that the IP address is not logged or stored at the time of collection.
Often in the same stack
These sheets come up in searches for a Next.js SaaS. Next.js itself is not a processor: GDPR Next.js.
Related tools
Full pack, from 39 € incl. VAT
The clause above covers only one tool. StackLégal generates the legal notices, terms of use, terms of sale, privacy policy, Article 28 DPA, and the public list, naming only the boxes that are checked. One-time payment via Gumroad. This is not legal advice.