Cookie consent
Does Google Analytics need a cookie banner?
In the EU: yes
Article 5(3) of the ePrivacy Directive allows a site to store or read information on a visitor's device only with consent. The exceptions are storage needed only to send a communication, and storage strictly necessary for a service the visitor asked for.
EU regulators do not count analytics cookies as strictly necessary (Article 29 Working Party, Opinion 04/2012). So EU sites ask for consent before Google Analytics sets its cookies. That is the cookie banner.
In the UK: it depends on the purpose
Since 5 February 2026, PECR no longer asks for consent when the only purpose of a cookie is statistics about how a site is used, to improve it (commencement regulations). The site must explain the cookies, give an easy way to object, and share the data only with a provider that helps it improve the site (ICO guidance).
Consent Mode v2
What is Consent Mode v2?
Consent mode passes the choice a visitor makes in your cookie banner to Google's tags. It does not replace the banner.
In November 2023, Google added two settings to consent mode: ad_user_data and ad_personalization. This update is what people call Consent Mode v2 (Google: set up consent mode).
Since March 2024, Google expects sites with visitors in the EEA to send these signals if they use Google's advertising features, such as audience lists (Google Ads Help).
Data transfers
Is Google Analytics GDPR compliant?
Two questions decide it: can EU data go to Google in the US, and did the visitor agree to the cookies? The first answer changed over time. The second did not.
Privacy Shield ends. The EU Court of Justice strikes down the framework for EU–US data transfers (Schrems II, C-311/18).
Austria. The data protection authority finds that a website's use of Google Analytics breaks the GDPR because of its transfers to the US (noyb).
France. The CNIL orders a website to bring its Google Analytics use into line with the GDPR, or stop it (noyb).
Italy. The Garante reaches the same finding and gives Italian websites 90 days to comply (Garante).
A new framework. The European Commission adopts the EU–US Data Privacy Framework (Decision 2023/1795). Google LLC is certified under it (Google).
Upheld. The EU General Court dismisses a challenge to the framework (Latombe v Commission, T-553/23). An appeal is pending at the Court of Justice.
Today, transfers to Google rely on the Data Privacy Framework. The cookie question is unchanged: in the EU, Google Analytics needs consent before it sets cookies.
A banner-free option
Cookieless by default. No consent banner.
DataDad stores no cookies and no IP addresses. It counts visitors with an ID that changes every day, and it deletes each day's key after about two days.
You still see visitors, pages, sources, countries, goals, and the revenue each source brings.
See how privacy-first analytics worksCompare with Google Analytics
FAQ
Google Analytics and GDPR, answered.
Does Google Analytics 4 use cookies?
Yes. On websites, GA4 sets _ga to tell users apart and _ga_<container-id> to keep the session state. Both last two years by default.
Does Google Analytics need a cookie banner?
In the EU, yes. The ePrivacy Directive asks for consent before a site stores cookies that are not strictly necessary, and analytics cookies are not. In the UK, since 5 February 2026, cookies used only for statistics about your own site can be used without consent if visitors can object.
Does Consent Mode v2 replace the cookie banner?
No. Consent mode passes the choice a visitor makes in your cookie banner to Google's tags. You still need the banner.
Is Google Analytics GDPR compliant?
Two questions decide it. Transfers of EU data to Google in the US have relied on the EU–US Data Privacy Framework since 10 July 2023. Its cookies still need consent in the EU.
Is there web analytics that needs no cookie banner?
Yes. DataDad is cookieless by default: it sets no cookies and stores no IP addresses, so there is no consent banner for analytics.
Also in DataDad