What Data Does Google Analytics Really Collect About Your Visitors?

The short version: Google Analytics collects device, location, behaviour, and traffic-source data through a first-party cookie, but it does not collect names, emails, or phone numbers unless you accidentally send that information to it yourself, which happens far more often than anyone likes to admit. It also does not collect the raw IP address of your visitors any more, and the "unique visitor" numbers you obsess over are estimates, not facts.

The data points Google Analytics pulls in

Every time someone lands on a page with the GA4 tag installed, a small first-party cookie called _ga drops into their browser with a randomly generated client ID. That ID is the backbone of everything else. From there, GA4 quietly logs:

• Device category, brand, and model (iPhone 14, Samsung Galaxy S23, Windows desktop)
• Operating system and version, browser and browser version
• Screen resolution and language setting
• Approximate location down to city level, worked out from the IP address at the moment of the visit, not stored as a raw IP
• Traffic source and medium (organic search, paid ads, direct, referral, and any UTM tags you built into a campaign link)
• Landing page, exit page, and every page or screen viewed in the session
• Engagement time, scroll depth, and session duration
• Events such as clicks, video plays, file downloads, form starts, and any custom event you set up
• Ecommerce data if you have it wired in: products viewed, added to cart, purchased, and revenue

If you're logged in to any Google product on that device and the site owner has Google Signals switched on, GA also merges in aggregated data from Google's ad ecosystem, things like age bracket, gender, and interest categories, plus cross-device reporting that shows the same person browsing on their phone at lunch and finishing the purchase on their laptop that evening. Most businesses I sit down with have no idea this setting exists, let alone that it's switched on by default in a lot of GA4 properties migrated over the last couple of years.

What it does not collect (and where people get this wrong)

Here's the bit that surprises almost every business owner I've worked with: out of the box, Google Analytics does not know your visitor's name, email address, or phone number. It has no idea who Sarah from Manchester is. It knows "client ID 847293651.1706..." visited five pages, spent four minutes on the pricing page, and left. That's it.

The confusion usually comes from mixing up Google Analytics with a CRM or an email platform. GA is not built to identify individual humans by name, and Google's own terms of service explicitly forbid sending personally identifiable information into it. Which brings me to the part most articles on this topic quietly skip over.

The mistake I found on a client's site (and why it matters more than the theory)

A few years back I was auditing analytics for a mid-sized ecommerce client who was convinced GA was somehow storing customer emails because their marketing manager swore she'd seen an email address in a report. She had. Their checkout form was passing the customer's email straight through as a URL parameter on the confirmation page, something like /[email protected], and because GA logs the full page path by default, that email had been sitting in their Analytics account for over a year, visible to anyone with report access, including two freelancers who'd long since stopped working for them.

This is not a rare fluke. It's one of the most common ways businesses accidentally break GDPR themselves, through their own tech stack, not through Google. Booking forms, password reset links, quiz results, even some chat widgets pass personal data through the URL, and if your Analytics tag is firing on that page, it's capturing it. The fix took under an hour: we set up a data redaction rule in GA's settings and rebuilt the confirmation URL to drop the parameter. But it sat there unnoticed for months because nobody checked. If your site collects anything sensitive, health-related bookings, financial details, anything a patient or customer would consider private, it's worth reading how website design decisions affect what visitors are willing to share, because the same URL-leak problem shows up constantly on appointment booking and enquiry forms.

Why the numbers in your reports aren't as precise as they look

Here's the uncomfortable part nobody selling analytics training wants to say out loud: your GA4 numbers are an estimate, not a ledger. Several things chip away at accuracy before a single report gets generated:

• Consent mode. If a visitor declines cookies through your consent banner, GA4 uses modelled data to fill the gap, essentially a statistical guess based on similar visitors who did consent.
• Ad blockers and privacy browsers. Safari's Intelligent Tracking Prevention and browser extensions like uBlock Origin stop the GA script from firing for a meaningful slice of visitors, often somewhere between 15 and 30 percent depending on your audience.
• Sampling on high-volume properties, where GA calculates results from a subset of data rather than every single hit, and extrapolates the rest.
• Bots and crawlers. Google filters known bots, but plenty of unlisted scrapers, uptime monitors, and SEO tools still slip through as "sessions."

None of this makes GA useless. It makes it a directional tool, brilliant for spotting trends, terrible for boasting an exact visitor count to your board. I've seen server log data and GA session counts on the same site differ by more than 20 percent in a single month, and both were technically correct, they were just measuring different things in different ways. If you want the fuller picture of how to read these reports without over-trusting a single number, my piece on what Google Analytics really tells you about your business goes into which metrics are worth your attention and which are vanity.

How long Google keeps hold of it

Data retention in GA4 is set by you, in Admin, under Data Settings, and it's easy to overlook because it's buried a few clicks deep. The default when you create a new property is 2 months for event-level and user-level data. You can extend that to 14 months, which most businesses should do immediately after setup, because 2 months makes year-on-year comparisons impossible. Standard aggregated reports, the totals you see in the dashboard, aren't wiped on this schedule, but the raw event data used for custom exploration reports is. If you've ever tried to pull a detailed audience breakdown from 18 months ago and come up empty, this setting is almost always why.

Checking your own retention setting, step by step

• Log in to Google Analytics and open the property in question
• Click Admin (the gear icon, bottom left)
• Under the Property column, select Data Settings, then Data Retention
• Check whether it says 2 months or 14 months
• Change it to 14 months if it isn't already, then save

How to see exactly what your own site is sending

You don't have to take my word, or Google's documentation, for what's being collected. You can watch it happen live:

• Open your site in one browser tab and your GA4 property in another
• Go to Reports, then Realtime, and click through a few pages on your own site
• Watch the event count and user snapshot populate within seconds, showing device, location, and the specific events firing
• For a deeper look, install the GA4 DebugView extension or use Google Tag Assistant, which shows every parameter being sent with each hit, including any custom parameters your developer has added
• Check your own URLs for anything that looks like an email, name, or ID number tacked on as a parameter, the same issue I found with that ecommerce client

This is also a good moment to look at what's coming in from search, since traffic source data in GA pairs directly with the queries and click data sitting in Search Console. My step-by-step on running a basic SEO analysis with Google Search Console walks through matching the two up so you can see not just that someone arrived from Google, but which search term brought them.

The privacy angle businesses underestimate

Because GA4 doesn't store raw IPs and doesn't collect names by default, plenty of business owners assume they're automatically GDPR compliant just by using it. They're not. A consent banner that blocks the GA tag until someone agrees, a clear privacy policy naming Google as a processor, and a data processing agreement in place (Google provides one, but you have to accept it in your account settings) are all still your responsibility. The tool being privacy-conscious by design doesn't transfer that compliance to your site automatically. That gap between "the tool is fine" and "my implementation is fine" is where most of the actual risk sits, and it's rarely mentioned in the same breath as the feature list.

Why this matters for decisions, not just compliance

Understanding what's really in your Analytics account changes how you use it. If you know Google Signals is on, you can build useful audience segments by age and interest instead of guessing at your customer profile. If you know 20 percent of your traffic is invisible because of ad blockers, you stop panicking over a dip that might just be a browser update. If you know URL parameters can leak into your reports, you check your forms before a data protection complaint lands in your inbox instead of after. It's a free tool, which is exactly why it sits alongside the other free platforms in my list of free business tools with no trial catch and no upsell, but free doesn't mean it runs itself responsibly. Somebody still has to check the settings.

Related reading: analytics api google.

Related: the data analytics page.

Frequently asked questions

Does Google Analytics collect email addresses?

Not by default, and Google's terms explicitly forbid sending personal data like email addresses into it. The exception is when a site accidentally passes an email through a URL parameter, a form confirmation page, or a poorly built custom event, which does happen and is worth checking on your own booking or checkout pages.

Can Google Analytics identify a specific visitor by name?

No. GA tracks an anonymous client ID stored in a cookie, along with device, location, and behaviour data. It has no built-in mechanism to attach a real name to that ID unless your own developer sets up a User-ID feature tied to your login system, and even then it's an internal ID, not a name.

Does Google Analytics store IP addresses?

In GA4, no. The IP address is used momentarily to work out an approximate city-level location, then discarded rather than stored. This is different from old Universal Analytics, where you had to manually turn on IP anonymization to get similar behaviour.

How accurate are Google Analytics visitor numbers?

They're a strong directional estimate, not an exact count. Ad blockers, browser privacy settings, cookie consent choices, and sampling on high-traffic properties can all cause a noticeable gap between GA's reported numbers and your actual server logs, sometimes 15 to 30 percent depending on your audience.

Official documentation

• the ICO's guidance on cookies and similar technologies