Is IP anonymisation enough for GDPR? (GA4)
A common belief is that because GA4 does not log full IP addresses, it is automatically GDPR-safe and you can skip consent. That is a misunderstanding. IP handling is only one piece of the privacy picture.
What GA4 actually does with IPs
Unlike the old Universal Analytics, GA4 does not store or log IP addresses; it uses them transiently for coarse geolocation and then discards them. That genuinely reduces one privacy risk, and it is a point in GA4's favour.
Why it is not the whole story
GDPR and PECR are about more than IPs. GA4 still sets cookies and processes other identifiers (a client ID, device and behavioural data) that can single a person out. Those are personal data too, so you still need consent to set the analytics cookies in the first place. Anonymising the IP does not exempt you from the cookie-consent rule.
What this means for you
- IP anonymisation is a helpful default, not a compliance get-out.
- You still need a cookie banner and consent before GA4 sets its cookies.
- Pair consent with Consent Mode so you keep most of your data within the rules.
This is closely related to the question of whether Google Analytics is legal under GDPR at all.
Want us to check your tracking in 10 seconds?
Pop in your domain and we will show you what is firing, what is not, and where data is leaking. Free, no signup.
Check my tracking freeGet a plain-English audit
We check your live GA4, Google Tag Manager and consent setup by hand and tell you exactly what is wrong. The audit comes off any build.
See how it works & pricingDatahound are analytics and ad-tracking specialists. We fix broken GA4, Google Tag Manager and server-side tracking so every sale, form and call gets counted. Back to datahound.agency · All tracking guides · Is Google Analytics legal under GDPR?