Received a demand letter naming Google Analytics 4?
Many pre-litigation letters allege that GA4 transmitted page views, identifiers, or events to Google without proper consent. This guide focuses on GA4-specific allegations, what to preserve, and how to verify the claim at the network layer. Start with counsel. This is not legal advice.
Quick answer
A GA4 demand letter is a pre-litigation notice claiming Google Analytics 4 on your site illegally intercepted or disclosed visitor data, often under CIPA, VPPA, or similar theories. Letters typically cite page URLs, dates, and a HAR or screenshot of requests to Google domains. Cookie-banner compliance alone does not answer the claim. Preserve your GTM and GA4 configuration, notify defense counsel or your insurer, and verify whether GA4 actually fired before consent, after reject, and under Global Privacy Control before you respond or settle.
Letter basics
What a GA4 demand letter usually alleges
GA4 letters often copy a template: your domain, a visit date, and a claim that analytics hit Google endpoints with user or page data.
Expect references to google-analytics.com, googletagmanager.com, or Measurement Protocol style hits; claims about Client ID, session identifiers, page titles, or referrers; and a statute (CIPA wiretap, VPPA if video pages are involved, or HIPAA-adjacent theories on health sites). Some letters treat GTM and GA4 as interchangeable. Separate the container from the GA4 configuration tag. Plaintiffs may include a HAR file. Treat the deadline as real, but do not assume every request in the exhibit matches your production configuration for the alleged period.
Verification
How to verify Google Analytics 4 claims
- 1
Preserve GTM, GA4, and CMP state
Export the live GTM container, GA4 property settings, consent mode defaults, and CMP category mappings before anyone edits tags. Note publish dates and who had access.
- 2
Reproduce the visit path in a HAR
Capture network traffic for the cited pages with no consent interaction, accept, reject, and GPC-on states. Confirm whether gtag or GA4 hits fire and which parameters leave the browser.
- 3
Check consent mode and blocking
Verify whether Consent Mode defaults are denied, whether GA4 is gated on analytics consent, and whether reject or GPC actually stops the request on the wire, not only in the CMP UI.
- 4
Scope portfolio exposure
Scan other brands and domains for the same measurement ID or duplicate GA4 tags. One letter URL may understate estate-wide exposure.
Related guidance
Continue with these resources
Counsel support
How Lokker supports defense counsel on GA4 letters
Counsel needs facts about what fired, when, and under which consent state.
Lokker documents network-layer behavior for GA4 and related tags, including consent-state testing and historical scan retention. Outputs support discovery and settlement discussions. We work with defense counsel and insurers only, not plaintiff-side firms. For the pan-statute checklist, see the main demand letter guide.
Frequently asked questions
Common questions about Google Analytics 4 demand letters
I received a demand letter about Google Analytics 4. What should I do first?
Notify defense counsel or your cyber insurer immediately. Preserve GTM, GA4, and CMP configuration. Do not delete the tag until counsel approves a preservation plan. Then verify whether GA4 fired on the alleged pages and dates, including before any consent click.
Does a cookie banner stop a GA4 demand letter?
Not by itself. If GA4 still sends hits before consent or after reject, the banner may not answer a wiretap or disclosure theory. Network proof matters more than policy language.
Is GA4 the same as Google Tag Manager in these letters?
No. GTM is a container that can load GA4 and many other tags. Letters often name both. Verify which tags actually fired and whether GA4 was the measurement destination.
What should we look for in a HAR that names GA4?
Requests to Google analytics or gtag endpoints, timing relative to consent UI, and parameters that identify the page or visitor. Compare accept, reject, and GPC captures.
Can we remove GA4 and ignore the letter?
Removing the tag does not erase past periods named in the letter and can complicate preservation. Follow counsel on remediation timing and document before-and-after behavior.
Does Lokker work with plaintiff attorneys on GA4 cases?
No. Lokker supports organizations and their defense counsel only.
This page is general information for website operators and their advisors. It is not legal advice and does not create an attorney-client relationship with Lokker. Statutes, court rulings, and enforcement posture change quickly. Consult licensed privacy litigation counsel in your jurisdiction before responding to a demand letter, settling, or changing site configurations in a way that could affect evidence preservation.