How the GA4 User ID Joins Signed-In Visits Across Devices

What is the GA4 user ID?

Google Analytics 4 counts a signed-in person once across sessions, devices and platforms when your site sends a GA4 user ID, an identifier your own system assigns at login and passes in the user_id configuration parameter. Google's help page says the feature lets you "associate your own identifiers with individual users so you can connect their behavior across different sessions and on various devices and platforms." Send it only for people who have signed in.

Without it, GA4 counts devices. Google's reporting identity page says "On websites, the device ID gets its value from the client ID," so the same person on a phone and a laptop shows as two users. That gap is one reason pageviews, sessions and users rarely line up across tools. Each tool defines a "user" in its own way.

Google ranks the user ID first among its identity sources. Its reporting identity page states "User-ID is the most accurate identity space, because it uses data you collect to identify your users." The accuracy depends on how many visitors sign in. A content site where 5% of readers have accounts gains little from it, while a SaaS app behind a login gains a lot.

How do you send a user ID to GA4?

You send a user ID to GA4 by adding user_id to the config command on each page, with one of three values depending on the visitor's sign-in state. Google's developer guide sets the rules:

Google's gtag.js example looks like this:

if (/* your logic for determining if the user is signed in */) {
  gtag('config', 'TAG_ID', {
    'user_id': 'USER_ID'
  });
} else if (/* your logic for determining if the user signed out */) {
  gtag('config', 'TAG_ID', {
    'user_id': null
  });
}

When the ID only becomes known after the page has loaded, such as right after a login form, Google recommends gtag('set') instead, which "sets the user_id for all subsequent events on the page." Then confirm the property reads the ID by checking the reporting identity, covered below.

What rules does a GA4 user ID have to follow?

A GA4 user ID must be 256 characters or fewer, unique to one person, stable across visits, and free of anything a third party could use to identify that person. Google's help page states "Your user ID must not contain information that a third party could use to determine a user's identity," and says your use of the ID must follow the Google Analytics Terms of Service, "This includes avoiding the use of impermissible personally identifiable information." Do not send a raw email address or a name.

Four more rules come from Google's help and developer pages:

1. Use a real, unique ID. Google warns that "Repeatedly setting a blank or dummy user ID can lead to inaccurate data (including permanent data loss)." Two people sharing an ID merge into one user in every report.
2. Send null on sign-out, never a string. Google says "Don't send an empty string (""), a blank string (" "), or the quoted words "null" or "NULL"." The strings "undefined" and "null" count as real IDs.
3. Keep it out of custom dimensions. The developer guide says "Don't set custom dimensions based on user IDs," and adds that user_id should not be set as a user property or sent as an event parameter.
4. Mention it in your privacy policy. Google lists "providing appropriate notice of your use of identifiers in your Privacy Policy" as part of compliance.

Your database's internal account ID is the safe choice, because it is stable and means nothing outside your own system. Before you ship it, check it against the list of identifiers that count as personal data, because a stable account ID still points to one person.

How does reporting identity use the user ID?

GA4 reporting identity decides whether reports use the user ID at all, and only the Blended and Observed options read it. You set it in Admin under Data display, Reporting identity, and Google describes the three options this way:

Google says you can "switch between the options at any time without making any permanent impact on data," because the choice changes reporting, not collection. There is a trade-off. Google states that with the first two options "your property must have enough activity from signed-in users to adequately obfuscate their identity. As a consequence your reports are subject to data thresholds." If rows start disappearing after you enable the user ID, read how GA4 data thresholding hides small rows before you assume the tag broke.

What happens to events before sign-in and after sign-out?

GA4 attaches a user ID to events from earlier in the same session once the ID is set, and stops attaching it to events sent after sign-out. Google's example runs as follows: a visitor triggers Events 1 and 2 without an ID, signs in and triggers Event 3, then signs out and triggers Event 4. "Events 1, 2, and 3 are now all associated with that user's ID," while Event 4 has none.

The backfill only reaches the current session. Google states "Any data in your Analytics account collected and recorded prior to implementation won't be reprocessed and associated with a user ID." Visits recorded before you shipped the user ID never gain it. And Google adds that "User-ID data collected in one property can't be shared or mixed with data in other properties," so a marketing site and an app in two properties do not merge.

What can you do with user ID data in GA4?

With user ID data in GA4, you can compare signed-in and signed-out users, open a single user's timeline in the user exploration, build remarketing audiences, and export user-level rows to BigQuery. Google's best practices page lists those uses.

Two consent details matter here. Google states that when you collect user IDs and link BigQuery, "that information is exported to BigQuery regardless of the consent status of your users." And for remarketing, "If you are using User-ID, then Analytics only includes the user identifier and the device identifier for the last device associated with each logged-in user."

Does Flowsery identify users across devices?

Flowsery identifies a signed-in user when your app calls flowsery.identify({ userId, email, name }) from its npm SDK, but in cookieless mode it does not link an anonymous visitor across days or devices. After that call, Flowsery's visitor API returns the userId, name and email in the visitor's profile field, and the field is null for anonymous visitors. Cookieless mode works differently. Flowsery's home page says "Visitor IDs are hashed and rotate daily," and its cookieless tracking page says "Visitors are grouped into sessions using anonymized, salted hashes that rotate daily. No persistent IDs ever leave the device." Because the hash changes every day, an anonymous person who visits on a phone today and a laptop tomorrow appears as two visitors. The guide to tracking without cookies explains how cookieless tools count visitors without a stored ID. Like GA4's user ID, Flowsery's identify call takes an ID your own system assigns at sign-in, so it covers signed-in people only.

Frequently asked questions

Can I use an email address as the GA4 user ID?

No. Google states the user ID "must not contain information that a third party could use to determine a user's identity," and asks you to avoid impermissible personally identifiable information. Use an internal account ID from your database instead.

What is the maximum length of a GA4 user ID?

A user ID must be 256 characters or fewer. Google lists the same limit in both its User-ID help page and its event collection limits table.

Should I register user_id as a custom dimension?

No. Google's developer guide says "Don't set custom dimensions based on user IDs," because the unique values cause high cardinality that hurts reporting accuracy. Use the reporting identity and the user exploration to work with user-level data.

What should I send when a user logs out?

Send null. Google says not to send an empty string, a blank string, or the words "null" or "NULL" in quotes. For visitors who never signed in, do not send the parameter at all.

Does GA4 apply the user ID to data from before I set it up?

No. Google states that data collected before implementation "won't be reprocessed and associated with a user ID." Within a session, events sent before sign-in do join the ID once it is set.

Why did my GA4 reports lose rows after enabling user ID?

Google states that the Blended and Observed reporting identities make reports "subject to data thresholds" when signed-in activity is too low "to adequately obfuscate their identity." Google also says switching reporting identity has no permanent effect on data, so you can compare the same report under Device based to see what the threshold removed.

How does GA4 count one person on a phone and a laptop?

Only when both visits send the same user ID. Without it, GA4 takes the device ID from the client ID on websites, so the phone and the laptop show as two users. With the ID sent after sign-in on both devices and a reporting identity of Blended or Observed, GA4 counts one person.

Should I send the user ID with gtag config or gtag set?

Use config with user_id on each page when the ID is known as the page loads. Use gtag('set') when the ID appears after load, such as right after a login form, because it "sets the user_id for all subsequent events on the page." Either way, send null after sign-out.

Which GA4 reporting identity uses the user ID?

Blended and Observed both do. Blended goes user ID, then device ID, then modelling, and Observed goes user ID, then device ID. Device based uses the device ID only and ignores the user ID. You can switch between the options at any time without a permanent impact on data.

Can I join GA4 user ID data with my CRM?

Yes, through the BigQuery export, which has both user_pseudo_id and user_id. Once you collect user IDs and link BigQuery, that information is exported regardless of the consent status of your users. Check that against your privacy policy before you build the join.