Analytics configured with IP masking; no user IDs sent without explicit consent

GDPR Art. 25 (data protection by design) requires that analytics configurations minimize data collection by default — and the default GA4 configuration does not do this. Without Consent Mode v2 and analytics_storage: 'denied' as the default state, GA4 collects full IP addresses and sets cookies before any user consent is obtained. ePrivacy Art. 5(3) makes this unlawful for EU users without prior consent. ISO-27001:2022 A.5.34 requires that privacy controls be applied at the point of processing, not as an afterthought. Passing raw user email to analytics.identify() also creates a direct PII leak to a third-party processor — this is an Art. 28 issue on top of the consent failure.

Initialize GA4 with Consent Mode v2 so analytics is denied by default and only activates after the user accepts in the consent banner.

// In your <head>, before the GA4 script tag loads:
window.dataLayer = window.dataLayer || []
function gtag(...args: unknown[]) { window.dataLayer.push(args) }

// Deny all by default
gtag('consent', 'default', {
  analytics_storage: 'denied',
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
})

// Call after user accepts analytics in the consent banner:
gtag('consent', 'update', { analytics_storage: 'granted' })

For identity calls, pass a pseudonymous ID (see pii-separation pattern) never the raw email. If migrating is complex, consider switching to Plausible or Fathom — both are GDPR-compliant by design with no cookies, no IP storage, and no consent banner requirement for basic analytics.