The secret life of the user ID: what it is, why it matters, and when you can’t use it

Think of the User ID as a quiet name tag for each visitor on your site. It's a unique, pseudonymous code that lets you see what that person does while they’re on your site (and when they come back).

It’s not their name, email, or phone number. It’s just a string of characters like a9f67x12 that says, “Hey, this is the same browser as before.”

In Google Analytics 4 there are two kinds. The browser ID (the client ID) is set by GA4 itself when someone accepts cookies. A User ID is one you set: your own identifier for someone who has logged in or otherwise identified themselves. Only send it for people who have signed in. Either way, that little ID is the backbone of proper analytics. It helps you connect the dots between different actions that would otherwise look like a bunch of disconnected visits.

When a visitor accepts cookies, your analytics setup can create and store a User ID. From there, you can:

• Track their journey: See how they move through your site. Maybe they land on your blog, click on your “Sign Up” page, then visit again two days later to actually sign up.
• Attribute actions properly: Know that the Meta ad they clicked last week did lead to a sign up today.
• Understand behaviour: How many pages do people visit before converting? Which journeys lead to drop-offs? Our clients love this.

In other words, it connects the story. Without it, you just get isolated blips of traffic with no context.

Here’s what that looks like in real life:

Day 1: Someone clicks your Google Ad. They scroll, watch a video, but don’t sign up.
Day 3: Same person comes back via a Meta retargeting ad. Reads your About page. Still doesn’t convert.
Day 5: They return directly, fill in your contact form, and book an appointment.

On one browser with cookies accepted, GA4’s browser ID already ties these visits together. Where a User ID earns its keep is when that person switches device: phone on Day 1, laptop on Day 5. Without a User ID, that’s two “different” people. With one (they logged in), you see one person, three visits, one conversion.

That’s pretty powerful in my opinion.

Here’s the tricky part: GDPR doesn’t care that it’s “anonymous” to you. GDPR treats a User ID as personal data because it’s an “online identifier” that could potentially identify someone if combined with other data.

That means you can’t just use it however you like.

If a user rejects cookies, you can’t use that User ID for analytics or marketing. You may still be able to use one where it is strictly necessary, for example for site security, but the purpose must be strictly functional. Things like:

• preventing fraud or spam submissions,
• deduplicating form entries,
• maintaining site security.

You cannot later say, “Oh, we’ll just link that same ID to their form submission data now that they’ve consented.”
Nah. GDPR’s purpose limitation rule means you can’t use data collected for one reason (security) for a completely different one (analytics).

If you want to track behaviour for marketing or analytics, you need clear consent at the point of tracking.

1. Set up your consent management: Use a consent tool such as Termly or CookieYes to make sure the User ID only fires when a visitor says “yes” to cookies.
2. Generate the ID: Only when consent is given (or for strictly functional use, such as security).
3. Store data separately: Keep User ID tracking data (for analytics) separate from personal data like names or emails.
4. Don’t mix purposes: If a User ID was created for security, don’t use it for marketing later.

That’s the safe zone. If you’re unsure about your own setup, check with your legal adviser.

Even with a perfect setup, there are blind spots.

• Different devices: If someone visits on their phone and then later on their laptop, those are two different IDs unless they log in or identify themselves somehow.
• Cookie deletion: If they clear cookies or use incognito mode, poof - new ID.
• Rejected cookies: No analytics tracking. You can’t follow that journey beyond the functional basics.

And that’s fine. It’s about doing it right, not doing it creepily.

When it works, a User ID gives you a much clearer view of how people interact with your site.

It bridges the gap between “ad clicks” and “real-world actions.”
It helps you understand intent, not just numbers.
And, set up with consent, it does it in a way that respects privacy.

The truth is, you don’t need to track everyone.
You just need to track honestly.

Because accurate, ethical data beats more data.

• The User ID connects user journeys across sessions.
• It’s personal data under GDPR, so you need consent for analytics use.
• You may still be able to use one for strictly functional jobs like security or form deduplication, but never for marketing without consent.
• It breaks on new devices, cookie deletion, or cookie rejection.
• Done right, it helps you understand your users without crossing the line.

If you don't have User IDs and want them, give us a shout. We can help.