Does GA4 Need a Cookie Banner? Consent Mode and Data Loss

GA4's relationship with consent is often misunderstood in both directions. Some site owners believe GA4 is fine to run bare because "it's just analytics". Others believe consent mode makes the banner problem disappear. Neither is true, and the truth determines how much of your audience your reports actually contain.

Why GA4 requires consent in the EU

The legal trigger is mechanical: GA4 stores cookies, principally the _ga client identifier, on the visitor's device, and reads them back on later visits. Under the EU's ePrivacy rules, storing or reading anything on a device that is not strictly necessary for the service the visitor requested requires prior consent. Regulators have been consistent that analytics is not strictly necessary. The GDPR then layers on top, because a persistent unique identifier tied to browsing behavior is personal data.

So a GA4 property receiving EU or UK traffic needs an opt-in banner, and the tag must actually wait for the answer. Several European data protection authorities have also, in past decisions, found configurations of Google Analytics unlawful over data transfers to the US, a situation the EU-US Data Privacy Framework later eased but did not erase from memory. The banner is not paranoia; it is the documented baseline.

What consent mode v2 actually does

Consent mode is Google's answer to the awkward fact that its tags need consent that many visitors refuse. It is a signaling layer: your banner tells Google's tags which consent states the visitor granted, analytics_storage and ad_storage among them, and the tags adjust. Version 2, which Google required for EEA traffic from March 2024 for ads features, added two more signals, ad_user_data and ad_personalization, governing whether data may be used for advertising purposes.

The important fork is between the two implementations. In basic consent mode, tags do not fire at all until consent is granted; a rejecting visitor sends nothing. In advanced consent mode, tags fire even when consent is denied, sending cookieless pings: anonymous, stateless signals with no identifier stored on the device.

Those pings feed modeling. When enough of them accumulate, GA4 estimates the sessions and conversions that unconsented visitors would have generated and blends those estimates into your reports. Behavioral modeling has activation requirements around traffic volume and configuration, so smaller properties may send pings and never see modeled data at all.

What you lose anyway

Start with the observed data. Consent rejection rates vary widely with audience and banner design, but between explicit rejections and visitors who bounce before answering, sites commonly lose 30 to 60 percent of EU visitors from observed analytics. Those people bought things, read pages, and converted; they are simply not in the recorded sessions.

Modeling gives back totals, not detail. Modeled visitors have no real acquisition path, no individual journey to inspect, and no presence in the granular slices where analysis happens. And because the missing visitors were never recorded, there is no way to check the model's homework: you cannot audit an estimate of people you have no data about. Whether consent rejecters behave like consenters, which the modeling implicitly assumes at some level, is exactly the kind of question the setup cannot answer.

There is also the quieter cost: the banner itself. Consent walls add friction to every first visit, and the legal requirement exists only because the tool insists on storing an identifier.

Making the best of a GA4 setup

If you stay on GA4 with EU traffic, do it properly. Use a certified consent management platform wired into consent mode v2, choose advanced mode if modeled totals are worth more to you than strict minimalism, and confirm with the browser's network tools that nothing fires before consent. Then annotate your reporting: note the consent rejection rate somewhere visible, so nobody reads GA4's EU numbers as a census when they are a survey of the consenting.

The Analyse position: nothing to consent to

Analyse removes the trigger instead of managing it. No cookies are stored, no persistent identifier is created, and no personal data is kept, so the ePrivacy consent requirement does not attach and no banner is needed, reasoning covered in the GDPR guide. The practical result is that the 30 to 60 percent of visitors GA4 loses or models are simply measured: every EU visitor appears in reports as an observed visit with a real source and real behavior. How counting works without an identifier is explained in the cookieless analytics guide.