Are you selling visitor data? How GA4 ad integration works

What "Advertising Features" actually are

GA4 ships with a group of features that are internally called "Advertising Features". When you create a new property these four are enabled automatically:

• Google Signals: cross-device tracking via logged-in Google accounts.
• Remarketing audiences: visitor segments that appear in your Google Ads account and can be used for advertising.
• Advertising Reporting Features: demographics and interests from Google's ad graph, delivered back into your GA4 report.
• Personalised Advertising: your audiences are shared across the entire Google Ads network for targeted advertising.

You have to actively turn them off, one by one, under Admin → Data Settings → Data Collection. They have been on by default since October 2023.

How the data flows through Google's ad graphs

Here is what happens between a visitor landing on your site and that same person's behavior showing up in the Google Ads audience system. This is the pipeline that runs on every GA4 property with default settings:

1. Google Signals: cross-device via logged-in accounts

Signals takes your pageview data and mixes it with the logged-in Google user's profile. When the same person then logs in on another device and visits another site that also uses GA4, their behavior can be linked across the devices. This is legal on the condition that the user has consented to "Ads Personalisation" in their Google account settings, which the vast majority have by default.

For you as a site owner this means that GA4 does not just measure visitors on your site. It participates in a cross-site graph where your site is one of thousands of data points about the logged-in user.

2. Remarketing audiences

When Advertising Features are on, you can create "audiences" in GA4 (segments such as "visitors who added to the cart without checking out"). These audiences are shared automatically to your Google Ads account, even if you have not actively sent them there. You, or a future Google Ads employee, can then target ads at them.

A visitor who looked at a specific product on your site can therefore become targetable for a competitor who advertises the same product category in the Display Network, because the segment is built on behavioral profile rather than on your site specifically.

3. Demographics and interests

The dropdown in GA4 that shows "Age" and "Gender" is not numbers your site has calculated. It is data from Google's ad graph, which they share with you in return. For you to get that data, your visitors also have to contribute to that data. It is an exchange: anonymous demographic numbers for you, behavior for Google's advertising system.

What Google's own terms say

The gist of the relevant sections of the Google Analytics Terms of Service is that Google normally acts as a data processor when you use GA4 for analytics. When Advertising Features are enabled, parts of the data processing shift so that Google also acts as a data controller for advertising purposes.

Translated into GDPR terms: when you yourself are the data controller and Google is the processor, you determine the purpose of the processing. When Google also becomes a data controller, Google determines it. It is a legal distinction with practical consequences for Swedish compliance, especially for the public sector and healthcare.

"We do not sell data": technically true, operationally nuanced

Google does not sell your customer list as a raw file to a third party. That is true, and it is the sense that most sites mean when they answer no to the question in the heading.

What actually happens is operationally equivalent but legally distinct: Google uses your visitor data to improve its own ad graph, which it then charges other advertisers to target ads against. The money goes to Google, not to you. The data stays within Google's ecosystem, but that ecosystem is an ad marketplace worth over 230 billion dollars per year.

Timeline: how GA became an ad pipeline

It is not an accidental assembly. The integration between the analytics and the advertising side has been built up deliberately over ten years:

1. 2014
   Universal Analytics introduced Audiences

   The first time visitor segments could be shared directly to AdWords (now Google Ads) from the analytics account.

2. 2017
   Cross-device tracking via logged-in Google accounts

   Later embodied in what is now called Google Signals.

3. 2020
   GA4 launches in preview

   An entirely new data model. The ad integration is built in from the ground up, not as a bolted-on feature.

4. 2023
   Advertising Features become on by default

   Since October 2023, Google Signals and related features are enabled automatically when a new property is created.

Three things you can do today

1. Check whether Advertising Features are on

Log in to GA4 → Admin → Data Settings → Data Collection. If you see "Google Signals data collection: ON", "Personalised advertising: ON" or similar, you are in the pipeline above. You can turn them off one at a time. It takes about five minutes.

The consequence: you lose the demographics data and the cross-device report. You keep visitors, pageviews, sources, pages and the usual breakdowns. For most sites that is a good trade.

2. Check that the cookie banner actually does what it promises

Most cookie banners ask for "consent for marketing cookies" as a separate choice. If the visitor says no to that but yes to "necessary", then technically you should not be sending data to Google Signals for that user. Check that your implementation actually does that.

It is a common finding in external audits: cookie banners that visually offer choices, but where the code behind them sends data regardless of the visitor's choice. If you are unsure, open DevTools and look at what ends up in the Network tab after you click "reject all but necessary".

3. Consider the alternative

Spårlös, Plausible, Fathom, Matomo and Umami are five privacy-focused analytics services where this kind of sharing does not exist. No ad networks are connected. No audiences are shared. No accounts are mixed. The data stays between you and the provider.

There is a cost: all of them are paid for their paid plans. Spårlös starts at 0 kr (Hobby, 50,000 pageviews/month, 3 sites) and 59 kr/month incl. VAT (Starter, 100,000 pageviews and an unlimited number of sites). That is the price for your visitors' data not being the product.

Bottom line

The question "are you selling visitor data?" has two answers.

The simple answer is no. You have not actively sold a list to a data broker.

The technical answer is that if you use GA4 with default settings, then your visitors' behavior contributes to Google's ad graph, which generates over 230 billion dollars per year in advertising revenue. The money goes to Google. The legal responsibility is partly yours.

For many sites that is an acceptable compromise to get free analytics. For others, especially Swedish B2B, the public sector and healthcare, it is a compromise that no longer matches the organization's stated privacy policy. For them there are alternatives that start from 0 kr per month and that do not share anyone's data with anyone's advertising system.

More on how we think about this in About Spårlös and Spårlös vs Google Analytics.