Google Analytics can be operated in a way that supports GDPR compliance, and a default installation does not achieve that on its own. Consent has to gate the measurement tags, Consent Mode v2 has to be wired to the banner categories, retention has to be set deliberately, and the processing agreement and transfer mechanism have to be in place. Whether a given configuration satisfies GDPR is a legal determination for your data protection officer or counsel, confirmed against your own data flows.
For an industrial manufacturer the exposure is usually narrower than the question suggests, and more traceable. Datasheet download gates, RFQ forms, distributor portal logins and CRM sync are where identifiable data enters, and each one was a decision somebody made. Establishing what is collected, where it travels and who agreed to it is the work; the analytics platform is one destination among several.
Google Analytics is a tool. Whether a particular implementation is lawful depends on what it collects, which identifiers it sets, where processing takes place, which agreements are in force, and whether consent is captured and respected before collection begins.
Two manufacturers running the same property can end up in different positions, because one gates measurement behind consent and sets retention deliberately while the other inherited a tag container from an agency five years ago.
Consent Mode v2 with a denied default state, so no measurement tag fires before a choice is recorded. Retention set to the period your data protection officer specifies rather than the platform default. Advertising features enabled only where a lawful basis has been established. Redaction so query strings and form values do not carry email addresses or account references into reporting.
Our GA4 and consent mode page describes how each of those is implemented and verified.
The catalogue itself rarely collects personal data. The gates around it do: datasheet and CAD download forms capturing a name, company and works email; RFQ and specification enquiries; distributor and installer portal logins; newsletter and trade fair sign-ups; and chat widgets.
Most of those push into a CRM or marketing automation platform as well as into analytics. Map the destinations before assessing the analytics configuration, because the transfers carrying the most risk are frequently the ones that were never documented.
A processing agreement with the platform, a documented transfer mechanism where processing occurs outside the EEA, a record of processing activities covering the site, and a privacy notice describing what the tags do in terms a reader can follow are the standard artefacts.
Which of them you need, and what each must contain, is a question for counsel. See what is a DPA and do I need one and does industrial B2B website data have to stay in the EU.
Configuration set once and left is the recurring failure. Decline consent and confirm no measurement or advertising request leaves the browser; grant it and confirm the expected requests appear and no others; check that country subsidiary sites inherit the same container behaviour rather than a local variant added during a campaign.
Repeat after any tag manager change. A container is edited by more people than a codebase, and usually with less review.
We implement and evidence the technical configuration your data protection officer specifies, and we can produce the tag inventory, the data flow map and the test evidence a review needs.
The determination of whether the resulting setup meets GDPR for your organisation, your markets and your data is theirs to make. Our GDPR and consent page describes how we work alongside that review.
It can be operated in a way that supports compliance, and it does not arrive that way by default. Consent has to gate the tags, Consent Mode v2 has to be wired to the banner categories, retention set deliberately, and the processing agreement and transfer mechanism put in place. Whether your specific configuration satisfies GDPR is a legal determination for your data protection officer.
In most EU markets, storing or reading information on a visitor’s device requires consent, and the measurement tags do exactly that. The detail is set by national implementations of the ePrivacy rules and varies between markets, including for the analytics category specifically. Your data protection officer should confirm the position for each market the site serves.
A denied default consent state so no tag fires before a choice is recorded; Consent Mode v2 signals wired to the banner categories; retention set to the period your DPO specifies rather than the platform default; advertising features enabled only where a lawful basis exists; and redaction so query strings do not carry email addresses or account references into reports.
The catalogue pages themselves usually do not. The gates around them do: datasheet and CAD download forms, RFQ and specification enquiries, distributor portal logins, newsletter sign-ups and chat widgets. Those generally push into CRM and marketing automation as well as analytics, so map the destinations before assessing the analytics configuration on its own.
We can confirm the technical implementation matches what your data protection officer specified, and produce the tag inventory, data flow map and test evidence a review needs. The compliance determination itself sits with your DPO or counsel. Technical correctness and legal compliance are related and separate, and we do not make the second call.
Take that decision on evidence rather than on reputation. Some organisations move to reduce transfer exposure or simplify a review; others keep the platform and correct the configuration, which is often the shorter path. Weigh the cost of migrating historical measurement and rebuilding reporting against what the change resolves for your counsel.
Tell us what your data protection officer requires and we will test the configuration against it and evidence the result.