When using Google Analytics and receiving a GDPR subject access request does the party receiving the request also have to send all data collected by Google Analytics?

2 Answers 2


Yes, it would be too obvious a loophole otherwise. You'd just put a shell company in front of the actual business, and have that shell company claim it didn't hold onto any data.

Formally, you are the Data Controller, and Google is a Data Processor. You must have a contract in place with Google that guarantees you can abide by GDPR obligations.


Just to add to the (correct) answer already given by @MSalters.

You can escape this obligation by not letting Google Analytics process personal data on your behalf.

You can do this by enabling the GA IP-anonymization feature.

If you use Google Analytics and do not use this feature, you need to have a DPA (Data Processing Addendum) contract in place with Google in order to comply with the GDPR.

This is a real hassle, so unless you absolutely need fine-grained demographic data, it is strongly recommended that you use IP-anonymization. According to our data protection supervisory authority, this is sufficient to comply with the GDPR vis-a-vis Google Analytics.

  • 1
    OK that's a very CRITICAL piece of information! Thank you!
    – Ole
    Jun 5, 2018 at 16:49
  • Please note that enabling IP anonymization will not necessarily make your data anonymous, as Google usually stores user IDs associated with events (either auto-generated ones stored in cookies or an ID that you provide to Google), so the data is at best pseudonymous. Why? Given such a user ID you can extract data related to a specific person from GA, hence the data is not anomymous. Dec 18, 2019 at 13:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .