- The one-line answer, then the messy bit
- What needs consent (it's narrower than people think)
- The story that changed how I set this up for clients
- How to set this up (step by step)
- The part most articles on this topic quietly skip
- What happens if you skip consent
- If you'd rather just avoid the whole question
- Frequently asked questions
- Sources worth reading
The short version: yes, in the UK and EU you need consent before Google Analytics cookies load, not just a banner sitting on the page while the tracking fires anyway. In the US there's no single federal law forcing this, but California and a growing list of states now expect an opt-out at minimum. The bit almost nobody tells you is that most "compliant" cookie banners are still firing GA before anyone clicks anything, which means the business isn't compliant at all, just decorated to look like it.
The one-line answer, then the messy bit
If your visitors are in the UK or EU, you need consent before Google Analytics sets its cookies, not after. That's the law under PECR (the UK's Privacy and Electronic Communications Regulations) and the ePrivacy Directive in Europe, both of which sit alongside GDPR. GA cookies aren't "strictly necessary" for the site to function, which is the only category that skips consent. They're there so you can see traffic numbers, which is useful to you, not essential to the visitor.
In the US it's murkier. There's no federal cookie law. But California's CCPA and CPRA treat the kind of data-sharing Google Analytics does (sending identifiers to Google) as something you need to disclose and, in some cases, let people opt out of. Virginia, Colorado, and Connecticut have similar state laws now. If you sell to a US audience only, you can get away with a lighter touch than the UK, but "lighter" isn't "none."
What needs consent (it's narrower than people think)
It's the cookie, not the tool. Google Analytics uses cookies to remember a visitor across pages and sessions, and it's those cookies that trigger the consent requirement, not the mere presence of GA on your site. This matters because plenty of businesses think swapping to a "privacy friendly" analytics tool magically solves everything. It doesn't, unless that tool drops the cookie-based tracking too. And plenty of businesses also think a cookie notice at the bottom of the page counts as consent. It doesn't, if the script is already running before anyone reads it.
Consent under GDPR has to be freely given, specific, informed, and unambiguous. A banner that says "by using this site you accept cookies" with no way to refuse is not consent, it's a notice. The Information Commissioner's Office has been clear on this for years, and the same logic underpins most EU regulators' position too.
The story that changed how I set this up for clients
A client of mine, a small B2B training company in Reading, got a polite but pointed email from a prospect's IT team in 2022 asking why their site loaded Google Analytics cookies before the cookie banner had even rendered. Nobody had complained officially, no fine, no drama, just an uncomfortable email from someone who clearly knew what they were looking at in the browser's developer tools. It took me about twenty minutes to confirm the problem: the GA tag was hardcoded in the header, and the cookie banner tool sitting underneath it was doing precisely nothing except displaying text. Two separate systems, never connected. That's the situation on a huge number of small business sites I've audited since, probably nine out of ten when a "consent" plugin was bolted on after the site was built rather than wired into the tracking from day one.
We fixed it by moving GA into Google Tag Manager and setting the tag to fire only when a consent variable was true. Total build time, about two hours including testing. The traffic numbers dropped by roughly 30 percent immediately, because a chunk of visitors either declined or ignored the banner. That drop is uncomfortable to look at, but it's the honest number. The old figure was never real consented data, it was just data.
How to set this up (step by step)
- Step 1: Add a consent management tool (Cookiebot, Osano, OneTrust, or a simpler plugin if you're on WordPress) that can block scripts by default, not just display a banner.
- Step 2: Move your Google Analytics tag into Google Tag Manager rather than pasting it straight into the site's header.
- Step 3: Set a trigger in GTM so the GA tag only fires after the consent tool confirms "analytics" consent has been granted.
- Step 4: Turn on Google's Consent Mode v2, which lets GA send anonymous, modelled data even for visitors who say no, without ever setting a cookie on their device. This became effectively mandatory in March 2024 for anyone using GA alongside Google Ads with an EEA audience.
- Step 5: Test it. Open your site in an incognito window, decline cookies, and check your browser's network tab for any request to google-analytics.com or googletagmanager.com firing before you clicked accept. If you see one, it's broken.
- Step 6: Document your cookie policy and privacy policy to match what's happening, not what you assumed was happening.
If you'd rather this were checked over rather than built from a blog post, that's exactly the kind of practical clean-up I do with clients as part of a wider hands-on implementation programme, because consent, tracking and the data you trust to make decisions all sit on the same foundation.
The part most articles on this topic quietly skip
In January 2022, Austria's data protection authority ruled that using Google Analytics breached GDPR, not because of the consent question but because visitor data was being transferred to the US, where (at the time) it wasn't considered adequately protected. France's CNIL and Italy's Garante followed with similar rulings within months. A lot of blog posts still quote this as though it's the current state of the world: "Google Analytics is illegal in Europe."
It isn't, not any more, at least not on that specific point. The EU-US Data Privacy Framework, adopted in July 2023, gave companies like Google a legal basis for those transatlantic transfers again. So the transfer problem that made headlines has largely been resolved. But here's the uncomfortable bit nobody likes admitting: fixing the transfer issue did absolutely nothing for the consent issue. You still need consent before the cookie fires, exactly as before, and most sites that panicked and "fixed" their GA setup in 2022 only ever addressed half the problem, or worse, addressed the headline and ignored the actual mechanics of when the tag fires. The legal drama moved on. The technical mistake, in my experience auditing sites, mostly didn't.
What happens if you skip consent
Realistically, for a small business, enforcement action is rare. The ICO and most EU regulators go after large-scale, repeat, or complaint-driven cases, not a five-person consultancy in Leeds. But rare isn't the same as zero, and the risk isn't only regulatory. It's reputational and it's about trust in your own numbers. If you're relying on Google Analytics data to guide real marketing decisions, and half your visitors are being blocked or dropping out because of a badly built consent flow, you're making decisions on a distorted sample. I've seen founders convinced their blog "doesn't work" when the truth was their cookie banner was so aggressive it was suppressing 40 percent of the data before it ever reached the dashboard. If your numbers look strange or incomplete, a broken consent setup is one of the first things worth checking, right alongside the more obvious causes covered in why Google Analytics might not be showing your website data.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
If you'd rather just avoid the whole question
Some businesses decide it's not worth the hassle and drop GA entirely, moving to a cookie-less analytics tool instead. That's a legitimate choice, and I've laid out the trade-offs in whether you should block Google Analytics on your business website. But swapping tools without understanding why you needed consent in the first place just moves the problem, it doesn't solve it. Most of the alternative tools still process data in ways that trigger some form of disclosure obligation, they just don't use cookies to do it.
Related: writing for us on data analytics.
I covered the follow-on problem in The Only Guide You Need for Effective Web Analytics.
Data scientists and analysts with a result worth sharing can submit a data science guest post.
Frequently asked questions
Do I need a cookie banner for Google Analytics in the UK?
Yes. UK PECR rules require consent before non-essential cookies, including Google Analytics cookies, are set on a visitor's device, and the banner has to give a genuine option to refuse, not just acknowledge.
Is Google Analytics illegal in the EU?
Not any more on the data transfer point, which was fixed by the EU-US Data Privacy Framework in 2023. It's still unlawful to run it without consent, because that requirement was never about the transfer, it was about the cookie.
What happens if visitors decline cookies, do I lose all my data?
Not entirely. Google's Consent Mode v2 can still send anonymised, modelled data from visitors who decline, without setting a tracking cookie, so you keep a rough picture of traffic volume without breaching consent rules.
Can I use Google Analytics for a US-only audience without any consent tools?
You can skip the EU-style cookie banner, but if any visitors are in California, Colorado, Virginia or Connecticut you still need a clear privacy disclosure and, in some cases, an opt-out for data sharing, so "no consent tools at all" is rarely the safe choice.
