Consentfolio Is Google Analytics GDPR Compliant in 2026?
Google Analytics is not compliant by default, but a GA4 setup can be made compliant for UK and EU traffic. It takes three things: block GA4 until the visitor consents, run Google Consent Mode v2 so Google's tags respect that choice, and set GA4's own data controls to limit what is collected and shared. Install GA4 the standard way with no banner, and it sets cookies and sends data before consent, which breaches UK PECR.
The honest position is "compliant if configured, non-compliant if not". Most sites that assume GA4 is fine out of the box are running it unlawfully.
What makes GA4 compliant
| Requirement | What it means |
|---|---|
| Consent before collection | GA4 must not set cookies or measure until the visitor accepts |
| Consent Mode v2 | Google's tags receive the consent signals and adjust accordingly |
| Data controls | Disable or limit data-sharing settings you do not need, such as ad features |
| A recorded choice | You can prove the visitor consented, per event |
Why GA4 needs consent at all
The first-party analytics exception in the DUAA 2025 covers analytics used only by you. A standard GA4 setup shares data with Google, which takes it outside that exception, so consent applies. That is why GA4 is not covered by the UK analytics exemption the way a self-hosted, first-party tool might be. See the DUAA 2025 and cookies.
How to make it compliant
The practical steps are one guide each:
- Block GA4 until consent. See how to block Google Analytics until consent.
- Run Consent Mode v2. See the Google Consent Mode v2 guide.
- Record the consent. See how to prove cookie consent.
Consentfolio does the first two from one script tag and records the third, so a standard GA4 install becomes a compliant one without extra tagging.
Frequently asked questions
Is Google Analytics illegal in the UK or EU? No. It is lawful when you block it until consent, run Consent Mode v2, and configure GA4's data controls. It is unlawful when it collects data before consent.
Does the UK analytics exemption cover Google Analytics? Usually not. The exemption covers analytics used only by you. GA4 shares data with Google, which takes a standard setup outside it, so consent still applies.
Do I still need a banner if I use Consent Mode? Yes. Consent Mode adjusts how Google tags behave, but you need a banner to collect and record the consent that sets the signals.
Written by Tudor Rusmanica, founder of Consentfolio. Tudor has spent over a decade in agency SEO, working where search performance meets data protection: the analytics, tagging and consent setups that keep measurement useful and lawful. Connect on LinkedIn.
Published 13 July 2026. This guide is general information, not legal advice.