Does Google Analytics require cookie consent?

In the EU and UK, yes, for the storage it performs. Whether the tag may load at all before consent depends on your Consent Mode configuration; whether it may store a _ga identifier does not — that needs consent.

Why does _ga appear before I click the banner?

Because the tag ran before the consent state reached it. Usually the tag was added to the tag manager without a consent trigger, or the consent platform's script loads after it.

Is Consent Mode v2 enough on its own?

It handles Google's own tags. Everything else on the page — session replay, advertising pixels from other vendors, chat widgets — needs its own gating, which is why a scan lists all third parties rather than only Google's.

Published 2026-09-01

Google Analytics Cookie Consent: What Fires Before You Click

ConsentProof is a cookie consent checker that scans any website with a real browser and records which cookies and third-party trackers fire before the visitor consents.

What Google Analytics sets, and when

GA4 sets a first-party _ga cookie holding a client identifier, plus a per-property _ga_<container> cookie. Both are set by JavaScript once the tag runs, so their timing is entirely a function of when your tag manager decides to run it.

In our scans, _ga appearing about a second after page load with no consent interaction in between is one of the most frequent findings, and it is almost never deliberate.

Consent Mode is not the same as blocking

With Consent Mode v2 configured, the Google tag still loads and still sends pings, but without cookies and with the consent state attached. That is a defensible configuration in many setups, and it is different from the tag not running at all.

The distinction matters when you read a scan: a request to a Google host before consent is not automatically a failure if no identifier was stored and the consent state said denied. A _ga cookie in the pre-consent window is a failure, because storage happened.

The measurement consequence

Since 21 July 2025, EEA and UK traffic without the required Consent Mode v2 signals no longer feeds personalised advertising and remarketing features. Missing signals therefore cost you audiences before they cost you a fine, which is usually what gets the work prioritised.

A scan reports all four signals separately, and distinguishes a signal that was denied from one that was never sent.

Frequently asked

Does Google Analytics require cookie consent?: In the EU and UK, yes, for the storage it performs. Whether the tag may load at all before consent depends on your Consent Mode configuration; whether it may store a _ga identifier does not — that needs consent.
Why does _ga appear before I click the banner?: Because the tag ran before the consent state reached it. Usually the tag was added to the tag manager without a consent trigger, or the consent platform's script loads after it.
Is Consent Mode v2 enough on its own?: It handles Google's own tags. Everything else on the page — session replay, advertising pixels from other vendors, chat widgets — needs its own gating, which is why a scan lists all third parties rather than only Google's.

Try ConsentProof

Free public scan, no account needed.

Start free Pricing