Guide · 6 min read · June 2026
Do I Need a Cookie Policy If I Use Google Analytics?
Yes. If Google Analytics runs on your website and you have UK or EU visitors, you need a cookie policy, a consent banner, and — this is the part most sites get wrong — the banner has to actually block Analytics until the visitor consents.
Running GA4 without proper consent is one of the most common compliance failures on small business websites. It's also one of the most visible: any regulator, competitor or curious visitor can open their browser's developer tools and see your cookies firing before they've clicked anything.
Here's what the rules actually require and how to get it right.
Why Google Analytics triggers cookie rules
Google Analytics 4 sets cookies on your visitors' devices — primarily _ga and a _ga_<container-id> cookie — to distinguish users and sessions. It also collects data that counts as personal data under UK and EU GDPR, including online identifiers and, depending on configuration, IP-derived location data.
Two separate laws apply:
PECR (UK) and the ePrivacy Directive (EU) govern the cookies themselves. Under UK PECR Regulation 6, you need the visitor's consent before storing or accessing information on their device — unless the cookie is strictly necessary for a service the visitor requested.
UK and EU GDPR govern the personal data the cookies collect once they're set.
The key word is strictly necessary. Analytics cookies are not. They're useful to you, but the visitor didn't request them and your site works without them. The ICO has been explicit on this point: analytics cookies require consent. "Legitimate interests" — the lawful basis many sites try to lean on — is not available as a way around the PECR consent requirement.
What a compliant setup looks like
Four pieces, working together:
1. A consent banner that offers a real choice
The banner appears on first visit, before any non-essential cookies load. Crucially, "Reject" must be as easy as "Accept" — a big green Accept button next to a buried "manage preferences" link is a dark pattern regulators have specifically called out. One click to accept, one click to reject.
2. Analytics blocked until consent
This is where most sites fail. The banner exists, but GA4 loads anyway in the background. Consent that's collected after the cookies have already fired is not consent — it's theatre. Your tag setup (usually via Google Tag Manager with consent mode, or your consent platform's blocking feature) must hold Analytics back until the visitor opts in.
3. A cookie policy that names what you set
The policy should list your cookies by category — strictly necessary, analytics, marketing — and for each: what it's called, who sets it (you or a third party like Google), what it does, and how long it lasts. "We use cookies to improve your experience" is not a cookie policy.
4. A way to change your mind
Visitors must be able to withdraw consent as easily as they gave it — typically a persistent "cookie settings" link in your footer that reopens the preferences panel.
Common mistakes that look like compliance but aren't
The banner that informs but doesn't ask. "By continuing to use this site you accept cookies" was arguably acceptable a decade ago. It isn't now. Continuing to browse is not consent under GDPR's standard, which requires a clear affirmative action.
Consent collected after loading. Covered above, but it's worth repeating because it's the single most common failure: if _ga appears in a visitor's browser before they've interacted with your banner, your setup is non-compliant regardless of how nice the banner looks.
Pre-ticked boxes. Explicitly invalid under GDPR. Every non-essential category starts unticked.
No mention of Google as a third party. Your policy needs to identify Google as the recipient of the data, link to their privacy information, and — for the full-marks version — acknowledge the international transfer involved in sending data to a US provider.
Copying a cookie policy from another site. Their cookies aren't your cookies. A policy listing trackers you don't use, while missing ones you do, is worse than useless if anyone ever checks — and checking takes thirty seconds.
Does this apply to small sites and hobby blogs?
If the site is run by a business — including a sole trader — yes. Size doesn't exempt you from PECR or GDPR. A purely personal blog with no commercial element has more latitude, but the moment there's a business behind the site, the rules apply in full.
Frequently asked questions
Is Google Analytics itself illegal in the EU?
No. Several EU regulators raised serious concerns about the old Universal Analytics over US data transfers, and GA4 plus the current EU–US data framework improved the position. The product is usable — the obligation is on you to deploy it with valid consent and proper disclosure.
Can I use cookieless analytics to avoid all this?
Largely, yes. Privacy-focused tools like Plausible or Fathom are designed to work without consent-requiring cookies, which removes the banner requirement for analytics specifically. You still need a privacy policy covering whatever data they process.
What about Google Tag Manager itself?
GTM is a delivery mechanism rather than a tracker, but everything it loads is your responsibility. Configure consent mode so tags respect the visitor's choice.
What's the realistic risk if I just leave it?
ICO enforcement on cookies has historically focused on large publishers, but the ICO publicly warned the UK's top websites about non-compliant banners and has signalled broader cookie enforcement. The bigger everyday risk is trust: your customers, clients and competitors can see your cookies. So can we.
Check your site in 30 seconds
Flagged scans your website, detects exactly which trackers are running — GA4, Tag Manager, Meta Pixel, Hotjar and dozens more — checks whether they fire before consent, reads your cookie policy against what's actually on the site, and shows you every gap. Free, no account needed.
This guide is general information, not legal advice. Last updated: June 2026.