Do I need to disclose Google Universal Analytics (legacy) in my privacy policy?

Yes. Even though Universal Analytics was sunset in July 2023, if tracking code remains on your website, it still attempts to set cookies and collect data, creating legal disclosure obligations under GDPR, CCPA, and other privacy laws. Failure to disclose constitutes non-compliance. You must either remove the code entirely or update your privacy policy to reflect its presence.

What specific data does Google Universal Analytics (legacy) collect?

Google Universal Analytics collects full IP addresses (unless you manually enabled IP anonymization), pages visited, session duration, device and browser type, geographic location derived from IP, and referral source. This data is tied to unique user identifiers via cookies and transmitted to Google's servers in the United States.

Does Google Universal Analytics (legacy) require a cookie consent banner?

Yes. The three cookies it sets (_ga, _gid, _gat) are tracking cookies that require explicit prior consent under GDPR and implied consent under CCPA. You must obtain consent before the tracking code fires. If code is still active post-July 2023 without consent management, you are out of compliance.

Who processes the data collected by Google Universal Analytics (legacy) and where?

Google LLC, based in the United States, is the data processor. Data is transferred to Google's servers in the U.S., which has implications for GDPR compliance (Standard Contractual Clauses required) and CCPA disclosures regarding international data transfers.

Analytics

Privacy policy clauses for Google Universal Analytics (legacy)

Google Universal Analytics (legacy) was a web analytics service that tracked visitor behavior, including pages visited, session duration, and device information. Websites used it to understand traffic patterns and user engagement. Google sunset this service in July 2023, replacing it with Google Analytics 4.

Scan my site free →Copy sample clause ↓

Free scan · No signup · Results in 60 seconds

What data Google Universal Analytics (legacy) collects

Your privacy policy must disclose each of the following data types when you use Google Universal Analytics (legacy).

Full IP address (unless manually anonymized)

Pages visited

Session duration

Device/browser info

Geographic location

Referral source

When does Google Universal Analytics (legacy) trigger privacy obligations?

Installation triggers immediate data collection

The moment Google Universal Analytics (legacy) tracking code is deployed, full IP addresses, pages visited, device/browser fingerprints, session duration, and geographic location flow to Google LLC servers in the United States—*before* any user consent is obtained. The _ga, _gid, and _gat cookies are set immediately on first pageview.

Cookie	Duration	Category	Purpose
_ga	2 years	analytics	Distinguishes unique users
_gid	24 hours	analytics	Distinguishes unique users
_gat	1 minute	analytics	Throttles request rate

Privacy policy clauses for Google Universal Analytics (legacy)

What data Google Universal Analytics (legacy) collects

When does Google Universal Analytics (legacy) trigger privacy obligations?

Installation triggers immediate data collection

Regulatory thresholds

Where data goes

Cookies set by Google Universal Analytics (legacy)

Common compliance pitfalls

Pitfall 1: Leaving sunset code live without disabling tracking

Pitfall 2: Omitting Google LLC from DPA or treating it as non-essential

Pitfall 3: Miscategorizing consent—treating analytics cookies as "functional"

Legal note

Sample privacy policy clause

What regulators look for

Enforcement priorities

Frequently asked questions

Do I need to disclose Google Universal Analytics (legacy) in my privacy policy?

What specific data does Google Universal Analytics (legacy) collect?

Does Google Universal Analytics (legacy) require a cookie consent banner?

Who processes the data collected by Google Universal Analytics (legacy) and where?

Don't ship without Bandit.