DPA audit priorities for Google Analytics 4
Data protection authorities (UK ICO, EDPB, German BfDI, etc.) typically audit GA4 implementations in this order:
1. Consent and legal basis. Regulators request audit logs proving consent was collected *before* GA4 tag fired. They cross-reference with server-side data collection timestamps. Non-consensual collection is the fastest violation to prove.
2. Data Processing Agreement. Auditors check for a signed GDPR Article 28 DPA with Google. Absence is flagged as a procedural violation with automatic remediation (sign it), but signals weak overall compliance maturity.
3. Transparency (privacy policy). Regulators verify that your policy names Google Analytics 4, discloses data types, cookie names, and retention. Generic "we use analytics" language fails. The EDPB Guidelines 05/2020 (consent) emphasize specificity by name and purpose.
4. Data transfers and DPF. Post-*Schrems II*, regulators scrutinize US-bound transfers. They confirm Google LLC is DPF-listed and that supplementary safeguards (encryption, anonymization, access controls) are documented.
The UK ICO's October 2022 guidance on cookie consent and the NOYB enforcement cases against Google Analytics (Austria, France) have normalized deep technical audits. Expect regulators to request your GA4 configuration screenshots, consent logic code, and server logs showing data flow timing.