In Google Analytics 4 (GA4), as of December 2025, a *user* represents a distinct, de-identified browser or device, while a *session* is a period of active engagement with your website or app. Essentially, a user can have multiple sessions, but each session always belongs to one user.

GA4 identifies users primarily through Google signals, if consent is granted, and device-specific identifiers. Currently, GA4 uses a 30-minute default session timeout; if a user is inactive for longer than 30 minutes, a new session begins. However, this timeout is configurable within GA4’s data settings. GA4’s user metrics now include both total users and active users, providing a clearer picture of engagement. Australian businesses should be aware of the ongoing privacy considerations surrounding data collection, and ensure compliance with the Australian Privacy Principles (APPs) when utilising Google signals. Data processing for GA4 occurs within Google’s global infrastructure, including data centres located in Australia and other regions. In 2026, GA4 will continue to refine its user identification methods, potentially incorporating more privacy-preserving technologies.

Therefore, GA4 tracks individual users and groups their interactions into sessions to measure website or app activity over time.