Key Takeaways
- Rule No. 1: In France, GA4 can only be loaded after the user has given explicit consent (CNIL, Article 82 of the Data Protection Act).
- Consent Mode v2: Required as of March 2024 to use Google's advertising features in the European Economic Area.
- Consequence: 20 to 40 percent of visits are not tracked directly; Consent Mode models a portion of them.
- Alternative: Matomo or Piwik PRO, when configured in accordance with CNIL guidelines, are exempt from the consent requirement for audience measurement.
Use Google Analytics 4 In France, this is legal, provided that you comply with a specific framework established by the GDPR, the French Data Protection Act, and the recommendations of the CNIL. This framework has direct consequences for your data: a portion of your audience is not measured. This article summarizes the seven requirements and explains how to limit their impact on the reliability of your metrics.
Background: From the CNIL’s 2022 Decision to the 2023 Agreement
In February 2022, the CNIL ruled that Google Analytics, as it was being used, transferred personal data to the United States without sufficient safeguards. Google responded with GA4 (IP anonymization, no IP address storage), and in July 2023, the European Union adopted the Data Privacy Framework, which governs transfers to certified U.S. companies, including Google. Since then, the use of GA4 has been permitted, but it remains subject to prior consent.
The 7 Requirements
| # | Obligation | How to Respect It |
|---|---|---|
| 1 | Prior Consent | Compliant banner (CMP): Opting out is just as easy as opting in; no GA4 cookies are set before the user makes a choice |
| 2 | Consent Mode v2 | Send signals to Google analytics_storage, ad_storage, ad_user_data, ad_personalization via CMP or Tag Manager |
| 3 | Information | Privacy Policy mentioning GA4, its purpose, retention period, and transfer to Google |
| 4 | Minimization | Never include personal information (email, name, phone number) in an event or URL |
| 5 | Shelf Life | A maximum of 14 months in GA4; the CNIL recommends a 6-month lifespan for the consent cookie |
| 6 | Transfers Outside the EU | Google is Data Privacy Framework-certified; mention this framework in the privacy policy |
| 7 | Registration and Outsourcing | Register GA4 in the data processing registry; accept Google's data processing terms (Administration > Account Settings) |
Consent Mode v2: What It Is and Why It's Important
Consent Mode is a mechanism through which your consent banner informs Google tags of the user’s choice. Version 2, required for European advertisers since March 2024, adds two advertising-related signals. There are two modes:
- Basic Mode : No Google tags load until consent is given. Simple and secure, but no data is collected on refusals.
- Advanced Mode : The tags load without cookies and send anonymous "pings" if cookies are disabled. GA4 uses these pings to to model conversions and the behavior of visitors who have not given consent. The reports then show a portion of the missing traffic, marked as modeled.
The advanced mode is a point of contention at the CNIL, which considers that pings may constitute data collection. Many companies opt for the basic mode for audience measurement and accept the loss of data, or switch to an exempt tool.
The Impact on Your Data
With a compliant banner, the consent rate observed in France ranges from 60 to 80 percent, depending on the sector and the banner’s design. In practical terms, out of 1,000 actual visits, GA4 measures 600 to 800. This has three consequences:
- Your sessions are underestimated, but at a fairly constant rate: the trends remain clear.
- Your conversions are being underestimated in the same proportion. Always compare with the actual source (CRM, back office).
- Comparisons between channels remain valid, unless a channel attracts an audience that is more likely to decline (visitors to technical content are more likely to decline).
Alternatives Exempt from Consent
The CNIL authorizes certain audience measurement tools without consent, provided they are configured strictly (purpose limited to audience measurement, no cross-referencing, anonymized data, no cross-site tracking). This applies to Matomo, Piwik PRO, AT Internet (Piano), and Plausible in their “exempt” configurations. In these configurations, they track 100% of visits, but with fewer features: no remarketing, no native integration with Google Ads, and no demographic data.
| Criterion | GA4 (with consent) | Matomo / Piwik PRO (exempt) |
|---|---|---|
| Share of measured visits | 60 to 80 percent | ~100 % |
| Google Ads Integration, Remarketing | Yes | No (or with consent) |
| Cost | Free | Free if self-hosted; otherwise, starting at 20 to 30 € per month |
| Data Hosting | Google (United States, DPF) | Optional, including in France |
Many companies combine the two: an exempt tool for actual audience tracking, and GA4 for advertising and conversions.
Setting Up GA4 for Compliance: The Checklist
- CMP installed, Consent Mode v2 enabled, tested with cookies disabled (no cookies
_ga(should not appear). - Data is retained for up to 14 months; Google Signals is disabled if you do not run ads.
- Disable the collection of granular location and device data for France if you do not use it (Administration > Data Collection).
- No personal data in the URLs (email parameters, credentials) or in the events.
- An up-to-date privacy policy and a link to it in the banner.
These settings are part of our checklist Set up GA4 correctly from the start and control 14 of our GA4 audit.
How GreenRed Can Help You
Instead of juggling multiple tools, the GreenRed Traffic module brings these metrics together in a single dashboard, compares them over time, and shows you which actions to prioritize. You can try it for free—no credit card required—on the page Rates.
Frequently Asked Questions
Is Google Analytics 4 allowed in France?
Yes, since the EU-U.S. agreement (Data Privacy Framework) in July 2023, and provided that prior consent is obtained, users are informed, and data is minimized. The CNIL has not banned GA4; it requires consent before any cookies are placed.
Is a cookie banner required for GA4?
Yes. GA4 sets cookies (_ga, _ga_XXXX) that are not covered by the CNIL exemption. The banner must make it just as easy to opt out as it is to opt in, and no GA4 tags should be triggered before the user makes a choice, except in Advanced Consent Mode without cookies, the compliance of which is under debate.
What is Consent Mode v2, and is it mandatory?
This is the protocol through which your banner transmits the user’s consent to Google via four signals. It has been mandatory since March 2024 to continue using audiences and conversion tracking in Google Ads for European users. For GA4 alone, it is strongly recommended because it enables the modeling of missing data.
What percentage of visitors reject cookies?
In France, the rate ranges from 20% to 40%, depending on the industry, the type of website, and the banner design. B2B and technical websites have higher opt-out rates than consumer e-commerce sites. You should track this figure in your CMP and include it in your reports.