GA4 and Cookie Compliance in 2026: What Your Analytics Setup Is Probably Getting Wrong

There’s a version of “cookie compliance” that a lot of marketing teams think they’ve handled. They added a consent banner two years ago, ticked a box in their legal checklist, and moved on. GA4 was set up around the same time. Job done.

The problem is that what “compliant” meant in 2022 is materially different from what it means today. Google changed the rules in March 2024. Regulators across the EU have been issuing fines not for having no consent mechanism, but for having one that doesn’t actually work correctly. And GA4’s relationship with cookies is more nuanced than most implementation guides let on.

This article is for marketing managers, analytics leads, and agency teams who want to understand what’s actually required in 2026 not a surface-level overview, but the specific things that break in real implementations and how to verify yours is doing what you think it’s doing.

First, Let’s Clarify What GA4 Actually Tracks (And How)

GA4 is event-based, which is a genuine architectural shift from Universal Analytics. But what hasn’t changed is that by default, GA4 still uses first-party cookies to persist user identifiers across sessions.

The two cookies you need to know:

**_ga**The main GA4 cookie. Stores a randomly generated Client ID that identifies a browser across sessions. Default expiry is 2 years. This is the one that requires consent under GDPR and ePrivacy, because it creates a persistent identifier tied to browsing behaviour.

**_ga_<container-id>** A session-level cookie specific to your GA4 property. Stores session state and is used to stitch events into sessions. Also subject to consent requirements.

Neither of these cookies collects your name, email, or anything directly identifying. But under GDPR and the ePrivacy Directive, the act of storing any persistent identifier on a user’s device for the purpose of tracking their behaviour requires prior, informed, freely given consent. The content of the cookie is less relevant than its purpose.

This is the part many teams get wrong. They assume because GA4 doesn’t collect PII directly, it doesn’t require consent. It does.

What Changed in March 2024: Google’s CMP Mandate

In March 2024, Google made Consent Mode v2 a hard requirement for all advertisers serving ads to users in the European Economic Area. This wasn’t a recommendation. If you’re running Google Ads campaigns targeting EU traffic and you haven’t implemented Consent Mode v2 correctly, your conversion tracking and remarketing audiences are out of compliance — and potentially not working as intended anyway.

Here’s what Consent Mode v2 actually does, in plain terms:

When a user declines analytics or advertising cookies, Consent Mode doesn’t just stop GA4 from setting cookies. It shifts GA4 into a cookieless observation mode — firing “pings” without identifiers to capture aggregate signals. Google then uses those signals to model conversions for the users who declined, filling the gap in your conversion data through statistical inference rather than individual tracking.

The four consent signals that Consent Mode v2 introduced:

Signal Controls analytics_storage GA4 cookie setting and behavioural measurement ad_storage Google Ads conversion and remarketing cookies ad_personalization Personalised advertising (remarketing lists) ad_user_data Sending user data to Google for ad matching

All four need to default to 'denied' for EU users before any tags fire. Your CMP then updates these signals to 'granted' when a user consents.

The critical word there is before. If your GA4 tag fires — even without setting a cookie — before the consent default is established, you have a sequencing problem that regulators have specifically targeted in recent enforcement actions.

The Three Most Common Compliance Failures in Real GA4 Setups

1. The CMP Banner Is Cosmetic

This is more common than it should be. The consent banner appears, the user clicks “Accept All” or “Decline,” and absolutely nothing changes in the dataLayer. The banner was installed by a developer who followed the UI setup guide for the CMP but never wired it to GTM or the GA4 tag.

You can verify this in about 30 seconds. Open your browser’s developer console, go to the Console tab, and type dataLayer. Look for any object with event: 'consent_update' or similar. Now click "Decline All" on your consent banner. Does a new dataLayer push appear with updated consent signals? If nothing happens, your CMP is decorative.

2. Default Consent State Is Missing or Incorrect

Many implementations set Consent Mode to update consent on acceptance but forget to set the default state to denied first. The result: GA4 runs unconstrained until a user interacts with the banner. On a typical e-commerce site, 60–70% of users never interact with a consent banner at all — they just browse. Every one of those sessions is being tracked without consent.

The correct GTM setup has a tag with the highest priority (trigger priority 999 or equivalent) that fires on “Consent Initialization” and sets:

gtag('consent', 'default', {
  'analytics_storage': 'denied',
  'ad_storage': 'denied',
  'ad_personalization': 'denied',
  'ad_user_data': 'denied',
  'wait_for_update': 500
});

The wait_for_update parameter tells GA4 to hold for 500ms for the CMP to load and potentially update consent before firing any tags. Without it, there's a race condition where tags can fire before consent is established on slow connections.

3. The “Legitimate Interest” Shortcut

Some CMPs offer a “legitimate interest” legal basis toggle for analytics cookies, which allows them to fire without explicit consent. This has been used and abused as a workaround to avoid the consent requirement.

In January 2024, the French data protection authority (CNIL) explicitly ruled that analytics cookies cannot rely on legitimate interest as a legal basis. Similar positions have been taken by data protection authorities in Germany, Italy, and the Netherlands. If your CMP is using legitimate interest to fire GA4 without consent for EU users, you’re not compliant regardless of what the CMP vendor’s documentation suggests.

GA4’s Built-In Privacy Controls And Their Limits

IP Anonymisation is on by default in GA4 (unlike Universal Analytics, where you had to enable it). GA4 truncates the last octet of IP addresses before storing any data.

Data Retention Controls let you set how long individual user and event data is stored in GA4 before automatic deletion. The maximum is 14 months.

User Deletion API allows you to respond to “right to erasure” requests under GDPR by submitting deletion requests programmatically.

Google Signals is where many teams unknowingly expand their data collection beyond what their consent setup covers. Google Signals enables cross-device tracking and demographic reports by linking GA4 data to users’ signed-in Google accounts. If you’re using Google Signals, your privacy policy needs to disclose it, and your consent mechanism needs to explicitly cover it.

Cross-Border Compliance: It’s Not Just GDPR

• UK GDPR Mirrors EU GDPR, enforced by the ICO. Same opt-in consent requirement for analytics cookies.
• US State Laws (CCPA/CPRA, VCDPA, CPA, CTDPA) Opt-out model rather than opt-in, but “Do Not Sell or Share” and opt-out of targeted advertising are relevant if you use GA4 data for ad targeting.
• Brazil LGPD Explicit consent required for data processing. Closer to GDPR than US state laws.

How to Actually Verify Your Setup Is Working

Step 1 Check consent default state. Open your site in a private/incognito window. Before interacting with any banner, open DevTools → Console, type dataLayer, and look for a consent default push with 'denied' values.

Step 2 Verify CMP wiring. Click “Decline All” on your consent banner. Check whether gtag('consent', 'update', {...}) fires in the console with 'denied' values.

Step 3 Check cookie expiry on server-side setups. Open DevTools → Application → Cookies. Find your _ga cookie and check its expiry. 7 days = ITP limiting it. 2 years set by your own domain = server-side working correctly.

Step 4 Run an automated audit. GetInlytics’ free GA4 & GTM Gap Analysis tool scans your site server-side and checks consent firing behaviour, cookie classification, CMP wiring, and compliance against GDPR, CCPA, ePrivacy, and LGPD simultaneously in under 60 seconds, no account needed.

What “Compliant” Actually Looks Like in 2026

• Consent Mode v2 with all four signals defaulting to 'denied' for EEA users
• CMP correctly wired to GTM via dataLayer push on consent interaction
• wait_for_update set on the consent default tag
• GA4 tag firing only after consent is established
• Google Signals disabled unless privacy policy explicitly covers cross-device tracking
• Data retention set to minimum period your reporting requires
• Documented process for handling user data deletion requests
• Regular quarterly audits to catch regressions after site updates

FAQ

Does GA4 work at all without cookies?

Yes. With Consent Mode v2 active and analytics_storage denied, GA4 fires cookieless pings that capture aggregate signals. Google uses these to model conversions for non-consenting users.

If I use Google’s built-in consent banner, am I automatically compliant?

Not necessarily. The banner alone doesn’t make you compliant if the dataLayer integration is missing.

Can I use GA4 for users in the EU without a consent banner at all?

No. There is no legal basis under ePrivacy that allows analytics cookies to fire on EU users without prior consent.

What happens if I get a GDPR complaint about my GA4 setup?

The complaint goes to the local DPA. Fines range from warnings for first-time technical violations to percentage-of-revenue fines for serious or repeated breaches.

How do I check if my GA4 setup is actually GDPR compliant right now?

The fastest way is an automated scan. GetInlytics’ free Gap Analysis tool checks your site against GDPR, CCPA, ePrivacy, and LGPD in one scan cookie classification, pre-consent firing behaviour, CMP detection, and GA4/GTM configuration.

Does GA4’s IP anonymisation mean I don’t need consent?

No. IP anonymisation reduces one dimension of personal data risk but doesn’t remove the ePrivacy requirement, which is triggered by storing or accessing information on a user’s device regardless of whether that constitutes personal data under GDPR.

The Bottom Line

Cookie compliance and GA4 are not a one-time setup problem. They break every time a developer pushes a site update, every time a new tag is added to GTM, and every time your CMP vendor releases a UI change.

The teams that stay compliant aren’t the ones who set it up correctly once. They’re the ones who audit it regularly.

If you haven’t checked your setup since you first configured it, there’s a good chance something has drifted. The free GA4 and cookie compliance audit at GetInlytics takes 60 seconds and will tell you exactly where you stand no account, no credit card, no waiting.