The short version: Google Analytics sets cookies that count as personal data under GDPR, so yes, you need consent before it fires, in the UK and the EU. The one exception (a stripped-down, first-party, non-identifying setup) is so narrow that almost nobody qualifies for it, which is the bit most cookie banner guides gloss over.
The blunt legal answer first
Google Analytics, whether you’re still clinging to Universal Analytics or you’ve moved to GA4, sets a cookie called _ga and another called _ga_<container-id>. Those cookies assign a unique client ID to a browser so Google can stitch together a visitor’s sessions. Under UK PECR (the Privacy and Electronic Communications Regulations) and the EU’s ePrivacy rules, any cookie that isn’t “strictly necessary” for the service the user asked for needs consent before it’s set. Analytics is a classic example of “nice to have for the business” rather than “necessary for the user,” so it fails the strictly necessary test.
The Information Commissioner’s Office has said this plainly since 2019: analytics cookies require consent. They’ve also said, separately, that enforcement against small sites using basic first-party analytics is low priority. Those two statements get mashed together constantly into “GA doesn’t really need consent then,” and that’s wrong. Low enforcement priority is not the same as legal, and I’ve watched businesses build their whole compliance approach on that misreading.
Why the “it’s anonymised” excuse doesn’t work
Here’s the part people skip past. In GA4, the client ID cookie is set and read before any anonymisation happens. IP anonymisation in Google Analytics strips the last octet of the IP address at collection, but the unique identifier in the cookie is already doing its job of tracking that specific browser across sessions and, if you’ve linked Google signals or Google Ads, potentially across devices. A cookie that lets you recognise the same person coming back three days later is personal data under GDPR’s definition, full stop, regardless of what happens to the IP address afterwards. I’ve had this exact argument with two different clients who were adamant their GA setup was “anonymous” because someone on a forum told them so. It isn’t, and treating it as if it is will not hold up if a regulator or a disgruntled ex-customer complains.
The international transfer problem nobody wants to talk about
This is the uncomfortable bit, and it’s separate from the consent question, but it matters just as much. In 2022, three EU data protection authorities, Austria’s DSB in January, France’s CNIL in February, and Italy’s Garante in June, all ruled that using standard Google Analytics violates GDPR because it sends data to Google servers in the US, where it can be accessed under US surveillance law, and no adequate safeguard was in place at the time. That’s not a UK ruling and UK GDPR runs slightly differently post-Brexit, but it tells you something important: consent alone doesn’t fix everything. You can have a flawless cookie banner and still be running Google Analytics on shaky legal ground if the underlying data transfer issue isn’t addressed too. The EU-US Data Privacy Framework from 2023 has patched a lot of this, and Google now offers EU data boundary settings in GA4 that keep processing within Europe for a chunk of the pipeline, but plenty of businesses still haven’t turned that setting on because nobody told them it existed.
A real audit, and what it found
Last year I ran a cookie and tag audit for a boutique jewellery brand in Brighton doing around 40,000 sessions a month. They had a cookie banner. It looked fine. Problem was, when I opened Google Tag Manager and checked the trigger on their GA4 configuration tag, it was set to fire on “All Pages” rather than being gated behind a consent trigger. That meant the analytics cookie was being set the moment the page loaded, before the visitor had clicked accept, reject, or anything else. The banner was pure theatre. It took about twenty minutes to fix once we knew where to look: swap the trigger to fire on Consent Initialization, add the analytics_storage consent check, and republish the container. Their session count in GA4 dropped by roughly 30 percent in the first week after the fix, because a chunk of their “visitors” had never consented to being counted at all. That’s not a data loss story, that’s a data honesty story. Their real number had been inflated the whole time.
How to set this up, step by step
If you’re running GA4 through Google Tag Manager, here’s the sequence I use with clients:
- Install a consent management platform (Cookiebot, Termly, and Osano are common choices) that can pass consent signals into Google Tag Manager, not just show a banner.
- Turn on Google Consent Mode v2 in your GTM container. This has been effectively mandatory for anyone showing ads or using Google Signals to EEA users since March 2024.
- Set the default consent state to “denied” for analytics_storage and ad_storage before any tags fire, then update it once the user makes a choice.
- Gate your GA4 configuration tag behind a Consent Initialization trigger, not “All Pages,” so it physically cannot fire before consent is recorded.
- Decide whether to keep Google Signals switched on. It enables cross-device reporting and remarketing audiences but adds another layer of consent obligation. If you don’t use remarketing, turn it off, it’s one less thing to defend.
- Set data retention to 2 months rather than the 14-month default unless you have a genuine business reason to hold it longer.
- Log consent records with a timestamp somewhere you can produce them if asked. Most CMPs do this automatically; check yours does.
- Review your GA4 property’s data residency setting and switch on the EU data boundary if most of your traffic is European.
If you’re not confident doing this yourself, this is exactly the kind of practical fix an outside pair of hands is useful for. I’ve written before about what Google Analytics costs to run , and consent setup is one of those hidden costs nobody budgets for until a regulator or a client asks the wrong question.
What happens if you skip it
Cookie consent enforcement in the UK has historically been light on individual fines and heavier on formal warnings and public naming, but that’s shifting. GDPR itself allows fines up to €20 million or 4 percent of global annual turnover, whichever is higher, and while most cookie-specific enforcement so far has hit large tech companies (CNIL fined Criteo €40 million in 2023 over consent failures, unrelated to Google Analytics but the same legal principle), the direction of travel is toward more scrutiny of smaller sites, not less. The bigger practical risk for most small businesses isn’t a fine, it’s a formal complaint from a competitor or an ex-customer that forces you into a slow, expensive compliance review at the exact moment you don’t have time for one.
The Consent Mode grey area worth knowing about
One thing almost nobody mentions when they write about this: when a visitor declines consent, Consent Mode doesn’t just switch GA off and go quiet. It switches to modelled conversions, using aggregated behavioural signals and machine learning to estimate what that visitor probably did, without setting a cookie on their browser. Google positions this as privacy-friendly because no personal identifier is stored. But it means data about a person who explicitly said no to tracking still feeds into your reports in modelled form. It’s legal under current guidance because no individual-level cookie is set, but it sits in a space regulators haven’t fully tested yet, and I think anyone selling cookie consent as a clean, solved problem is skipping that part on purpose. If you want a accurate picture of your traffic and not just a legally defensible one, it’s worth understanding that modelled data is an estimate dressed up as a metric.
A quick checklist before you move on
- Cookie banner blocks GA4 tags until a choice is made, verified in GTM, not assumed.
- Consent Mode v2 is switched on with default denied state.
- Google Signals is off unless you’re actively using remarketing.
- Data retention set to the shortest period your reporting needs.
- EU data boundary switched on if you have meaningful European traffic.
- Consent logs are stored somewhere you can retrieve them.
If you’re building or rebuilding your whole measurement setup rather than just patching one banner, it’s worth starting from the ground up rather than bolting consent onto a messy existing stack. I go through the full setup logic in my guide to effective web analytics, and if you’re also trying to work out whether you even need multiple GA4 properties for staging, testing, or separate brands while you rebuild, I’ve broken down how many Google Analytics accounts you’re allowed to run and when it makes sense to split them.
Frequently asked questions
Does Google Analytics 4 need cookie consent even though it’s supposed to be more privacy-friendly?
Yes. GA4 still sets a unique client ID cookie to track visitors across sessions, and that cookie counts as personal data under GDPR regardless of the added privacy features Google has built into the platform.
Can I use Google Analytics without a cookie banner at all?
Only if you strip it down to a anonymous, non-cookie based, aggregated setup, which most standard GA4 installs are not. If your GA4 config sets the standard _ga cookie, you need consent before it fires.
What’s the difference between GDPR and PECR when it comes to cookies?
PECR (in the UK) specifically governs cookies and similar tracking technologies and requires consent before non-essential cookies are set. GDPR then governs what happens to any personal data those cookies collect once it’s gathered. You generally need to comply with both at once.
Will turning off Google Signals solve my GDPR problem?
It removes one layer of obligation around cross-device tracking and remarketing audiences, but it does not remove the need for consent on the core GA4 tracking cookie itself. You still need a working consent setup underneath it.
