What Google requires you to disclose
The Google Analytics Terms of Service Section 7 requires you to (a) post a privacy policy that covers the use of cookies and the collection of data by GA, (b) make best efforts to inform users about the use of GA and the data collection it implies, and (c) not pass personally identifiable information to GA. Most policies meet (a) and miss (b) — Google interprets "best efforts" as a sentence-level disclosure naming Google by name.
The text we ship
This service uses Google Analytics 4, a web analytics service provided by Google LLC ("Google"). Google Analytics uses cookies and similar technologies to analyse how users interact with this service. The information generated about your use (including a truncated IP address) is transmitted to and stored by Google on servers in the United States. Google will use this information for the purpose of evaluating your use of the service, compiling reports on activity for operators, and providing other services relating to activity and internet usage. We have configured Google Analytics to anonymise IP addresses (anonymizeIp) and have disabled advertising features. You may opt out by installing the Google Analytics Opt-out Browser Add-on.
IP anonymisation and Consent Mode v2
Since GA4, IP anonymisation is on by default — you no longer need to set anonymizeIp manually. However, you do need to set up Consent Mode v2 if you want EU traffic to be measurable when consent is denied. Consent Mode v2 is mandatory for advertisers since March 2024 — without it, Google Ads remarketing audiences will not populate from EU traffic.