If your website has visitors in the EU, GA4 usually needs their agreement before it runs. Most setups don't wait for it.
Two laws do the work here. The GDPR covers what happens to personal data. The ePrivacy Directive, implemented differently in each member state, covers storing or reading anything on a visitor's device, which is what analytics cookies do. Together they mean a banner that asks first, and tags that listen to the answer.
Analytics needs consent in the EU.
Under the ePrivacy rules, only cookies that are strictly necessary for the service the visitor asked for are exempt. Analytics isn't one of them. GA4's cookies, and the identifiers it reads, need the visitor's agreement before they're set.
A few regulators allow narrow exemptions for simple audience measurement. France's CNIL is the best known. Its conditions include anonymous statistics, no sharing with third parties and no tracking across sites, and GA4 as normally set up doesn't meet them.
The EU has proposed loosening the rules for some first-party audience measurement, as part of its Digital Omnibus package. At the time of writing it's still being negotiated, and even the proposal leaves out tools that feed data to third parties. Until it's law, plan on consent.
It's stricter than the UK now.
Since the Data (Use and Access) Act 2025, UK law allows some analytics cookies without consent, as long as visitors are told and can object easily. The EU has no general equivalent. A site with visitors from both can't use one banner and one rule for everyone and be right in both places.
The practical answer is consent by region: EU visitors are asked first, and visitors elsewhere get the setup that suits their rules. That's what the guide to region-specific consent in Tag Manager covers.
What a valid consent looks like.
Regulators in several member states have set out what they expect from cookie banners. The common points:
- Reject is as easy as accept. A "Reject all" button on the first screen, not buried in settings.
- Nothing is ticked in advance. Consent has to be an action the visitor takes.
- Each purpose is named. Analytics and advertising are separate choices.
- Withdrawing is easy. A visible link, such as "Cookie settings", lets people change their mind later.
- Choices are kept, and so is the record. You can show what someone agreed to, and when.
Where GA4 setups go wrong.
The banner is usually fine. The problem is what happens underneath it.
- Tags fire before the banner. GA4 loads on page load, and the banner appears a moment later. The first page view has already been sent.
- The choice never reaches Google's tags. The banner records "reject", but Consent Mode isn't wired to it, so GA4 and Google Ads carry on as normal.
- Other tags ignore it. Meta, LinkedIn and TikTok pixels added straight into the site, or into GTM without consent checks, run whatever the visitor chose.
- Rejecting doesn't remove anything. Cookies set before the choice stay in the browser.
- Nobody has tested it as an EU visitor. The team is in the UK or the US, and sees a different banner.
How to check yours.
Open your site in a private window from an EU location, with a VPN if you need one. Before you touch the banner, open the browser's developer tools and look at two things: the cookies set, and the network requests to Google, Meta and other platforms.
If _ga cookies appear, or requests to Google Analytics carry a full page view, before you've chosen anything, the setup isn't waiting. Then reject everything, reload, and check again. The guide to testing Consent Mode v2 goes through each state step by step, and the free tracking checker shows what a first-time visitor triggers.
Consent Mode is part of the answer, not all of it.
Google's Consent Mode passes each visitor's choice to Google's own tags, and Google requires it for EEA traffic if you use Google Ads. It doesn't block other platforms' tags, and it doesn't decide what your banner asks. Which version to use, basic or advanced, is a decision in its own right, covered in Consent Mode v2 for EEA traffic.
Which rules apply to your business, and how cautious to be, is a question for your lawyer or data protection officer. Making the tracking do exactly what they decide is a technical job, and it's the part most often left undone.
Marc Alexander sets up GA4 and Google Tag Manager for European businesses, with consent that works under EU rules. The GA4 mini audit checks what your site does before a visitor agrees, along with the rest of your tracking.