Google Analytics is Google's free tool for recording what people do on a website: where they come from, which pages they open, how long they stay and which actions they complete. The version running today is Google Analytics 4. Standard Universal Analytics properties stopped processing data on 1 July 2023, 360 properties on 1 July 2024, and from that same week historical data can no longer be accessed through the interface or the API.
In August 2026 it was used by 47.6% of all websites tracked by W3Techs, and by 83.2% of the sites where any traffic analysis tool can be detected. It is the de facto standard, which is exactly why it pays to know where it stops working. This page explains how it reads data, what it doesn't show you, and what has changed on privacy in Europe and the UK since 2022.
How it works in practice
A snippet of JavaScript is installed on the site, either directly or through Google Tag Manager. Every time someone opens a page, scrolls, clicks an external link, starts a video or downloads a file, the tag sends Google an event with a set of parameters: the URL, the traffic source, the device, the language and the country derived from the IP address.
Google receives those events, aggregates them and returns them in reports. The second step is the one that matters: what you see in the interface is not the event log, it is a processed version of it. Between the raw data and the number on screen sit thresholds, sampling and cardinality limits, all documented by Google and rarely mentioned in beginner guides. How to account for them when a decision has to come out of those numbers is covered in the guide to SEO analytics.
What changed with Google Analytics 4
Universal Analytics thought in sessions: a visit containing pageviews. GA4 thinks in events: every interaction is an event, and a session is just one way of grouping them. The practical consequence changes too. In UA, bounce rate measured sessions with a single pageview; in GA4 the reference metric is the engaged session, meaning a session that lasts at least ten seconds, triggers a conversion event or includes at least two pageviews.
People coming from UA usually notice two things straight away: the numbers don't match the historical data, and some metrics no longer exist. Neither is a configuration error; they are two different measurement models. If you are rebuilding the picture from scratch, the sensible starting point is working out which SEO KPIs are worth tracking before you even open a report.
What Google Analytics doesn't show you
This is the part missing from almost every guide. The limits below are not opinions: they are in Google's official documentation, with precise numbers.
| Limit | Documented value | Effect on your reports |
|---|---|---|
| Sampling | above 10 million events per query on standard properties; 100 million on 360, up to 1 billion on request | the number you read becomes an estimate calculated on a subset |
| Cardinality | limit of 50,000 values per dimension; above 500 unique values a day, reports start to bloat | excess rows are grouped under the "(other)" row |
| Data thresholds | applied to demographic data and search queries when total users are low | whole rows disappear, and the threshold is set by Google and cannot be changed |
| Retention | 2 or 14 months on standard properties; 26, 38 and 50 months only on 360 | explorations cannot go further back than the chosen period, standard reports can |
| Consent modelling | requires at least 1,000 events a day with analytics_storage='denied' for 7 days and at least 1,000 users a day with consent on 7 of the previous 28 days | below those thresholds, non-consented traffic is not estimated: it is simply missing |
The modelling row is worth a pause, because it weighs most heavily on small and mid-sized sites. When a user declines analytics cookies, GA4 can estimate their behaviour from the users who did consent. But that estimate only kicks in if the site clears both thresholds: a thousand events a day without consent and a thousand users a day with consent. A company website doing two thousand sessions a month is nowhere near. The result is that declined traffic is not modelled and not compensated for; it just doesn't appear.
That has a direct consequence for how you read reports: on a small site, GA4's absolute values should be treated as a guaranteed minimum, not as your real traffic. Percentage changes remain reliable, totals don't. The distinction changes how you set up your ROI calculation and how you discuss results with whoever is funding the project.
Privacy: EU rulings, the UK data bridge and the 2026 cookie exception
In 2022, using Google Analytics became a genuine legal problem in several European countries for a few months, and the story still circulates with information that is four years out of date. In the UK the rules have moved on again since then. Here are the dates that matter, with the original documents.
| Date | What happened |
|---|---|
| 9 June 2022 | Italy's data protection authority (Garante) adopts decision no. 224 (doc. web 9782890) against Caffeina Media S.r.l.: transferring data collected with Google Analytics to Google LLC in the United States breaches Articles 44 and 46 of the GDPR, because the supplementary measures do not stand up to section 702 of FISA. Ninety days to comply, or the data flow is suspended. Similar decisions came from other EU regulators in the same year. |
| 1 July 2023 | Standard Universal Analytics properties stop processing data. 360 properties continue until 1 July 2024, after which the historical data also becomes inaccessible. |
| 10 July 2023 | The European Commission adopts the adequacy decision on the EU-US Data Privacy Framework: transfers to certified US companies become lawful again without additional safeguards. |
| 12 October 2023 | The UK-US data bridge comes into force: UK organisations can transfer personal data to US companies certified under the UK Extension to the Data Privacy Framework without extra safeguards. |
| early March 2024 | Google's requirement for updated consent mode takes effect for traffic from the European Economic Area: without the ad_user_data and ad_personalization signals, EEA users stop feeding advertising audiences. |
| 5 February 2026 | The cookie exceptions in the Data (Use and Access) Act 2025 take effect. Under the ICO guidance on the exceptions, cookies used solely for statistical purposes to improve a site no longer need consent, provided users get clear information and a simple, free way to object, and any third-party provider acts only as your processor. |
The practical point today is this: the legal basis for the transfer exists, so the question is no longer "Analytics, yes or no" but configuration. For a UK site that means checking whether your setup can rely on the statistical purposes exception at all: the ICO says consent is still needed if the third party uses the data for its own purposes, so a GA4 property linked to advertising features does not qualify. Otherwise you need a correct privacy notice, consent collected before the tag fires, and consent signals passed to Google. This is not legal advice: the regulatory side belongs with whoever handles privacy for the business. What matters here is the effect on your data, namely that a properly built setup is also the one that loses you the fewest numbers.
Why the numbers don't match Search Console
It's the question that comes up with every first report. Search Console measures what happens before the click, Google Analytics what happens after it. The two closest metrics are Search Console clicks and Analytics sessions, and Google Search Central lists the reasons they never add up: Search Console reports only the canonical URL while Analytics records every URL, Search Console includes PDFs and other non-HTML files by default, Analytics excludes bot traffic while Search Console does not, and Search Console works in Pacific time.
On top of that comes consent, which only affects Analytics. A gap of 10-20% between organic clicks and organic sessions is normal. If the gap goes above 40%, the problem is usually the cookie banner or a tag firing twice, not Google. For queries and positions the source remains Search Console, and it is also the only place to get the real CTR of your pages: GA4 doesn't have that figure.
The metrics we look at first
On an SEO project we always use the same order. First the acquisition channels, to see how much of the traffic is organic and how much is already branded. Then landing pages, which tell you which content Google actually sends people to. Then conversions by channel, the only way to notice that one channel brings volume while another brings customers.
Total active users is the last number to look at, not the first. It responds least to what you do, and it is the most exposed to the limits in the table above. When a site lives across several surfaces, from organic results to AI-generated answers, the picture has to be pieced together from different sources: we covered this in how to measure omnichannel SEO and, for local visibility, in managing your Google Business Profile, which has its own statistics and doesn't go through Analytics.
How we use it on a real project
On Macropix, a Milan-based manufacturer of custom LED screens we have worked with since 2020, Analytics is the third source, not the first. Semrush reads positions, Search Console reads organic clicks, and Analytics is there to show what happens after the landing. It's the same division of labour we recommend when building a stack from scratch, price lists in hand: you'll find it in the guide to the best digital marketing tools. The full case is in the article on SEO for manufacturing, but two numbers are useful here too.
The Italian keyword "monitor pubblicitario" (advertising display) went from position 88 in 2020 to position 2 in 2025, and in July 2026 macropix.it held a 25.55% share of voice on the LED wall cluster, ahead of Amazon. On the paid side, between July 2025 and June 2026 Google Ads produced 374 conversions from €16,805 of spend: €44.93 per conversion, average CTR 3.59%, average CPC €0.81. Comparing the two sides is possible because conversions are defined the same way on both platforms, and that is configuration work, not something Analytics hands you on its own. It's the same reasoning that leads us to treat SEO and Google Ads as two levers of the same plan rather than two separate budgets.
When you need something different
Three situations where GA4 on its own is not enough. First: constant sampling, meaning a site that goes beyond 10 million events per query. There, the route Google documents is the BigQuery export, which also gets around some of the thresholds on demographic data. Second: a need to keep data on your own infrastructure, where tools such as Matomo, which you can install on your own server, meet a requirement GA4 is not built to cover. Third: a very high cookie refusal rate, where server-side tracking is the only way to recover something.
For most businesses none of the three applies, and the problem sits further upstream. The UK Business Data Survey 2026, published by the government on 18 June 2026, found that only 25% of UK businesses handling digitised data analyse it to generate new insights: 35% of small businesses and 26% of micro businesses. Roughly one in four. The bottleneck is not which tool to use, it's that nobody looks at the data being collected. We have also written about this in SEO for SMEs and in how company size changes SEO strategy.
What to check when you open a new property
- The event data retention period: the default is the shortest and should be raised immediately, because it does not apply retroactively.
- The links to Search Console and Google Ads, which are what make the two sources comparable.
- Internal traffic excluded by IP address, otherwise during months of work on the site the numbers are yours.
- The list of referrals to exclude, particularly payment gateways, which would otherwise take credit for conversions.
- The consent settings section, to see how much EEA traffic arrives without signals.
- Conversions defined as real events and not as thank-you pageviews, which get counted twice the first time the site is updated.
If the site has only just launched and this list looks like a different job, it is: the technical side of analytics sits close to on-page optimisation. The beginner's guide to SEO and the page on ranking factors cover the rest of the picture, while how to tell if your SEO agency is working explains which of these numbers to ask for in a monthly report. If you'd rather someone else handled the setup, it's part of our SEO service, and the results are in projects.
Google Analytics FAQs
Yes. Google Analytics 4 is free and covers the needs of almost every website. The paid version, Google Analytics 360, raises the sampling limit from 10 million to 100 million events per query and allows data retention periods of up to 50 months.
The legal basis for transferring data to the United States exists: the UK-US data bridge has been in force since 12 October 2023 for US companies certified under the UK Extension to the Data Privacy Framework. Since 5 February 2026, cookies used solely for statistical purposes no longer need consent under the Data (Use and Access) Act 2025, but the ICO says consent is still required if the third-party provider uses the data for its own purposes. The usual obligations remain: a privacy notice, consent where it applies, and consent signals passed to Google. Check the details with whoever handles privacy for the business.
Universal Analytics measured sessions, GA4 measures events. The metrics change as a result: bounce rate gives way to engaged sessions, and comparisons with UA historical data are not like for like. Universal Analytics no longer exists anyway: standard properties stopped processing data on 1 July 2023 and historical data has been deleted from 1 July 2024.
Search Console counts clicks on search results, Analytics counts sessions on the site, and the two do not match by design: Search Console reports only the canonical URL, includes non-HTML files such as PDFs, does not filter bots and works in Pacific time. Analytics also misses traffic that declines cookies, which on small sites is not even estimated. A gap of 10-20% is normal; above 40% it is worth checking the cookie banner and duplicate tags.
On standard properties, user-level and event-level data is kept for either 2 or 14 months, your choice. Periods of 26, 38 and 50 months are only available on Google Analytics 360. The setting applies to explorations and funnel reports, not to standard aggregated reports, and it does not recover data that has already expired: raise it early, not later.
One last thing, which the industry rarely says. The first number to look at in a GA4 property is not in any report: it's the share of EEA traffic arriving without consent signals, visible in the consent settings section. That percentage sets how wrong every other number in the property is. Whoever reads it first stops arguing about whether traffic fell by 6% and starts asking whether that 6% exists.
