A web coordinator at a mid-sized Dutch municipality called me not long ago with a question I’ve heard more often since: “We know GA4 is a legal problem, but we don’t have the capacity to replace it ourselves. What are our options?”
It’s a fair question. Analytics is not a core competency for most public organisations; it’s infrastructure. You want to know how many visitors a page had, how people find the contact form, whether that campaign worked. You don’t want to assign half an FTE to it.
At the same time, this isn’t a decision you can keep deferring. The GDPR, the Schrems II rulings, and growing enforcement pressure on public bodies mean the legal bill arrives sooner or later. The only question is when.
Why this is particularly acute for the public sector
For a commercial company, GA4 is risky but manageable. You can weigh the legal exposure, put up a cookie banner, and carry on.
For public organisations, that logic doesn’t hold. Government websites aren’t optional; citizens can’t choose not to visit the municipal site when they need a permit. That makes the legal basis for data processing harder to justify. A consent wall in front of a tax filing or an objection form is legally and socially indefensible.
Every public organisation also has a Data Protection Officer who will ask for a DPIA during an audit. Writing a watertight DPIA for GA4 is close to impossible: the data flows are partly on Google’s side and therefore difficult to describe exhaustively.
What outsourcing to a web analytics agency actually means
Outsourcing to an analytics agency is not one thing. There are roughly three variants.
Implementation only. The agency sets up the tool (tags, events, dashboards) and you manage it yourself from there. This works if you have internal capacity to run reports and answer questions, but not to build the implementation.
Implementation plus reporting. The agency sets up and delivers periodic reports. Useful for organisations without an internal analyst who still need steering information for management or council.
Fully managed. From tool selection to DPIA to monthly analysis. This is what larger executive bodies and ministries often need: a single point of contact that handles both the technical and legal side, so communications can focus on content.
The choice between these three depends on your internal capacity, not your budget. Bringing in an agency for implementation only when no one internally can interpret reports means spending money without benefit.
What it costs
Outsourcing analytics to an agency ranges from a few hundred euros per month for basic reporting to six to eight thousand euros per year for a fully managed engagement at a mid-sized municipality.
The relevant question isn’t what it costs, but what it costs to do it yourself. A junior employee spending half a day a week on analytics plus a licence for a legally precarious tool is rarely the cheapest option. And the bill for an incident response after a GDPR complaint or a supervisory authority investigation is a multiple of any agency’s hourly rate.
Why cookieless analytics changes the underlying equation
Most discussions about outsourcing analytics focus on tool choice and cost. What rarely gets enough attention: the tool choice determines whether you need a DPIA, whether a cookie banner is required, and whether you need to ask for consent at all.
Cookieless analytics works without persistent identifiers in the visitor’s browser. No cookies are placed. No data is sent to servers outside the EU. The legal basis shifts from consent to legitimate interest or statutory task: a foundation that is much easier to defend for government websites.
For public organisations this isn’t a luxury but an architectural choice with direct legal implications. An agency that understands this, and deploys tools built on this basis, gives you a fundamentally different position in an audit than one that configures GA4 with an elaborate cookie banner.
How to recognise a good agency
Not every web analytics agency understands the public sector context. A few questions that quickly reveal where they stand.
Where does the data live? If the answer is “in the EU” without further specification, that’s not enough. You want to know: which legal entity manages the server, under what data processing agreement, and who has access.
Which tool do they use? An agency that defaults to GA4 for public sector clients either doesn’t understand the legal landscape or prioritises convenience over responsibility.
Do they have DPIA experience? Not just “we’ll help you fill in a template”, but the substance: do they know which data categories an analytics tool processes and how to document that in a DPIA?
What happens to your data when the contract ends? Any serious agency should be able to explain how you take your raw data to a successor. A vague answer is a signal.
When outsourcing delivers the most value
Outsourcing works well when at least one of the following conditions applies.
You have no internal analyst and the reports are rarely read because no one has time for them. An agency that sends a readable monthly summary is worth more than a licence gathering dust.
You have an upcoming audit, a DPO review, or an NIS2 deadline and you want the analytics position sorted quickly. An implementation timeline of six to twelve weeks is realistic; an internal rebuild over a year is not.
Your organisation is growing or merging and the measurement strategy needs to keep pace. An external agency can guide that transition without disrupting daily operations.
Honestly: we're one of those agencies.
even without you having to ask.
Govanalytics guides these kinds of engagements itself. Everything above about how to recognise a good agency applies to us as a benchmark. We work with cookieless technology, data hosted in the Netherlands, and an implementation process designed around public sector organisations. Ask us the same questions you would ask any other agency on your shortlist.
Get in touch, no obligations →Frequently asked questions
- Is Google Analytics 4 still legal for Dutch public sector organisations?
- The legal position of GA4 for Dutch public bodies is precarious. The Dutch Data Protection Authority and European supervisory authorities have repeatedly flagged the risk of data transfers to the US, even when using the EU region option. For public organisations subject to the GDPR where citizens have no choice but to use the website, the legal basis for processing is especially hard to justify. The sensible move is to migrate before enforcement forces the issue.
- What's the difference between outsourcing Google Analytics and buying a privacy-friendly tool?
- These are two separate decisions. You can outsource GA4 to an agency that manages it for you — but you're still running a legally exposed tool. You can also switch to a privacy-friendly alternative and manage it yourself. The strongest combination is a tool with a solid GDPR position, managed by an agency that understands the public sector. That removes both the technical and legal burden from your own team.
- How long does an analytics migration take on average?
- For a mid-sized municipal website we work with six to twelve weeks from first conversation to a fully operational new environment. The main variable is the complexity of the existing GTM implementation. With tools that support the GA4 tracking protocol — such as Govanalytics — the tagging on the website itself often doesn't need to change, which significantly shortens the timeline.
- Can I take my historical GA4 data with me when migrating?
- Raw event data from GA4 is not exportable in a standard format that other tools can directly ingest. What you can do: export aggregated reports as a reference, and — if you were exporting GA4 data via BigQuery — keep that raw data under your own management. For ongoing measurement you start fresh in the new environment. Most organisations run both systems in parallel for a period to validate the numbers before switching GA4 off.
- What must a DPIA for analytics tooling include at minimum?
- A DPIA for analytics tooling describes which personal data is processed (IP addresses, cookie IDs, behavioural data), on what legal basis, by which processors, where the data is stored, and for how long. For cookieless analytics this is considerably simpler: if no personal data is processed, the DPIA is short and defensible. For GA4 the DPIA is complex because the data flows are partly managed by Google and therefore difficult to describe exhaustively.