UK GUIDE · UPDATED AUGUST 2026
Does Google Analytics Need Cookie Consent in the UK?
Google Analytics 4 is widely used to measure traffic, page views, user journeys and conversions. In 2026, the UK position is more nuanced than a simple “yes” or “no”: a new statistical-purposes exception can apply to some analytics use, but only where specific conditions are met.
This guide explains when GA4 may require consent, when the 2026 analytics exception may be relevant, how Google Consent Mode fits in, and how to test what your website is actually doing.
Last reviewed: August 2026 · Practical website guidance only. Not legal advice or formal compliance certification.
Google Analytics Cookie Consent: The 2026 Answer
For many standard GA4 implementations, consent will still be needed. However, UK law now includes a limited statistical-purposes exception for storage or access used solely to collect statistical information about how a website or service is used, with a view to improving it.
Consent May Still Be Needed
Especially where analytics is combined with advertising, profiling, remarketing, cross-service tracking or purposes beyond simple website statistics.
A 2026 Exception Now Exists
The statistical-purposes exception can apply where the sole purpose is collecting statistical information to improve the website or service and the statutory conditions are met.
GA4 Is Not Automatically Exempt
The fact that a tool is described as “analytics” does not itself mean every use of that tool falls within the exception.
The UK Statistical-Purposes Exception
The ICO’s 2026 Storage and Access Technologies guidance confirms that consent is not required under PECR where the statistical-purposes exception applies. The exception is narrow and depends on how the technology is actually used.
Sole Statistical Purpose
The storage or access must be for the sole purpose of collecting statistical information about use of the website or service with a view to improving it.
Clear Information
Users must receive clear and comprehensive information about the purpose of the storage or access.
Simple, Free Objection
The website must provide a simple means for the user to object to the storage or access, free of charge.
Important Limits
The ICO also says the information should be aggregated and personal data should not be kept longer than necessary for the aggregation process. If the use goes beyond the statistical purpose — for example by making inferences or decisions about people, retaining individual-level information, or using the data for wider advertising or tracking purposes — the exception will not apply and consent may be required.
When Might GA4 Still Need Consent?
Whether a particular GA4 setup can rely on the statistical-purposes exception depends on purpose and configuration. These are practical warning signs that the use may extend beyond simple aggregate website statistics.
Google Ads Linking
If Analytics data is used with Google Ads for advertising measurement, remarketing, audience creation or other advertising purposes, review whether the use still falls within the narrow statistical purpose.
Google Signals or Advertising Features
Features linked to advertising personalisation, cross-device reporting or broader advertising use should be reviewed separately from basic website statistics.
Individual-Level Retention or Profiling
If data is retained or used at an individual level, or used to make inferences or decisions about people, the ICO says the exception will not apply.
Why Google Analytics Consent Still Needs Testing
A cookie banner can look correct while Google Analytics is installed elsewhere through Google Tag Manager, a plugin, a theme, Shopify or another platform integration.
The practical question is not only what the banner says. It is what the website actually stores, accesses and sends before a visitor makes a choice, after rejection and after acceptance.
That is why a technical review should identify how GA4 is installed, how consent states are communicated and whether advertising or other purposes are also involved.
Google Consent Mode and GA4
Google Consent Mode lets supported Google tags adjust their behaviour according to a visitor’s consent choices. For GA4, analytics_storage is the key storage signal.
analytics_storage: granted
Google Analytics can use analytics storage normally, subject to the wider implementation and settings.
analytics_storage: denied
Google says analytics cookies are not read or written. In Advanced Consent Mode, measurements without cookies may still be sent to Google Analytics for basic measurement and modelling.
Consent Mode does not itself determine whether your GA4 implementation can rely on a PECR exception. It is a technical framework for communicating consent states to Google tags. See our Google Consent Mode v2 UK guide for the Basic vs Advanced distinction and the four main consent signals.
How to Review Your Google Analytics Consent Setup
The exact answer depends on how GA4 is installed and what it is used for. Start with the technology, then the purpose, then the consent behaviour.
Step One: Find Every GA4 Installation
Check GTM, hard-coded scripts, WordPress plugins, Shopify integrations, themes and other platform tools. Duplicate installations are common.
Step Two: Identify the Purpose
Separate simple website statistics from advertising, remarketing, audience creation, profiling or other uses. The purpose matters to the 2026 exception.
Step Three: Test the Real Behaviour
Check before choice, after Reject, after Accept and after changing a saved preference. Look at both consent signals and actual cookies, storage and network requests.
How to Test Google Analytics Cookie Consent
A good test should cover what happens before any interaction as well as the Reject and Accept states.
Before Any Choice
Open a fresh private session. Check whether GA4 tags load, whether analytics cookies appear, what the analytics_storage state is and what requests are sent to Google Analytics.
After Rejection
Reject optional technologies. Check whether the analytics consent state and actual GA4 behaviour reflect the rejection. In Advanced Consent Mode, measurements without cookies may still be sent.
After Acceptance
Accept the analytics category and confirm the expected consent update. Check that the website does not accidentally grant advertising consent where only analytics was selected.
Useful tools include Google Tag Assistant, GTM Preview, browser developer tools, the Network panel, cookie/storage inspection and your consent platform’s debug tools.
Google Analytics Consent Checklist
- Identify every GA4 installation on the website.
- Check whether GA4 is used only for website statistics.
- Check whether Google Ads is linked.
- Check whether Google Signals or advertising features are enabled.
- Review whether individual-level information is retained or used.
- Confirm what the cookie banner tells visitors about analytics.
- Confirm whether a simple, free means to object is available where the statistical exception is relied upon.
- Check the default
analytics_storagestate. - Test before any visitor choice.
- Test Reject.
- Test Accept.
- Test changing or withdrawing a saved choice.
- Look for duplicate GA4 tags.
- Compare actual behaviour with your cookie and privacy information.
Common Google Analytics Consent Mistakes
Assuming All Analytics Needs Consent
The 2026 statistical-purposes exception means this is no longer always correct. The correct answer depends on purpose and conditions.
Assuming GA4 Is Automatically Exempt
The exception is purpose-based. GA4 used for advertising, profiling or wider tracking may fall outside it.
Testing Only the Banner
A banner can show the right wording while GA4 is loaded elsewhere through GTM, a plugin, a theme or a platform integration.
Need a Practical Google Analytics Consent Review?
Our Google Consent Mode Audit UK can help identify visible GA4, Google Ads and Consent Mode behaviour across the public consent journey, including what happens before choice, after rejection and after acceptance.
- GA4 and Google tag observations
- Consent Mode signal checks
- Behaviour before choice
- Reject and Accept behaviour
- Possible duplicate tags
- Practical points for your developer, PPC agency or marketing team
Google Analytics Cookie Consent FAQs
Does Google Analytics need cookie consent in the UK in 2026?
Often yes, but not always. A limited statistical-purposes exception now exists under PECR. Whether it applies depends on the sole purpose of the storage or access and whether the statutory conditions are met.
Is Google Analytics 4 automatically covered by the analytics exception?
No. The exception is not based simply on the name of the product. It depends on how the technology is configured and used.
Can GA4 be used without consent for basic statistics?
Potentially, where the statistical-purposes exception genuinely applies and all of its conditions are met. That requires a purpose-limited implementation, clear information, a simple free means to object and appropriate aggregation and retention practices.
Does linking GA4 to Google Ads matter?
It can. If Analytics data is used for advertising, remarketing, audience creation or other purposes beyond simple website statistics, review whether the statistical exception still applies.
Does Google Consent Mode replace a cookie banner?
No. Consent Mode communicates consent states to Google tags. It does not provide the visitor-facing consent mechanism itself.
What happens when analytics_storage is denied?
Google says GA4 will not read or write first-party analytics cookies. In Advanced Consent Mode, measurements without cookies may still be sent to Google Analytics for basic measurement and modelling.
How should I test GA4 consent?
Test before any choice, after Reject, after Accept and after changing or withdrawing a saved choice. Check the real consent signals, cookies, storage and network behaviour.
Official Guidance and Platform Sources
Related Cookie Banner Guides
Check Your Google Analytics Consent Setup
Download the free checklist or review how GA4, Consent Mode, Google Ads and your cookie banner behave together across the public consent journey.
This is practical website guidance only and is not legal advice or formal compliance certification.