Analytics and consent

Does Google Analytics need consent?

Do not assume every analytics setup is exempt simply because it produces statistics. UK rules include conditional exceptions for certain statistical purposes; whether your configuration qualifies depends on its purposes and safeguards. Advertising uses have different requirements. GDPRFix takes a clear approach on its own site: optional Google Analytics waits for an affirmative choice.

ICO: exceptions and consent requirements ↗

Consent Mode is not a cookie banner

Google Consent Mode communicates a choice to Google tags. You still need a way to obtain and honour that choice. In basic consent mode, Google tags are blocked until the visitor consents. An advanced implementation can send cookieless signals while consent is denied. “No analytics cookie” therefore does not necessarily mean “no information sent to Google”.

Google: basic and advanced consent mode ↗

Choose the behaviour deliberately

Decide what you need to measure before installing tags. Public content visits rarely require sending private account paths, submitted website addresses or form text. Avoid automatic form collection if it could include personal information. Document the purpose, provider and retention in your privacy and cookie notices; do not copy a policy that describes a different setup.

• Keep optional consent separate from accepting service terms.
• Make rejection as accessible as acceptance.
• Provide Cookie settings so someone can withdraw permission.
• Review Google signals, advertising features and automatic event collection instead of accepting defaults blindly.

Test more than the first click

Test a fresh visit before any choice, rejection followed by reload, acceptance in a separate browser session, and withdrawal after acceptance. Inspect both cookies and outgoing measurement requests. Also test moving between public pages and private account pages. A website can honour the first choice but accidentally start a tag on a later page.

Turn a finding into a fix

If measurement runs earlier than intended, check the tag manager, theme, analytics plugin and hard-coded snippets for duplicate installation. Run a new scan after changes and keep the dated evidence. The scanner can show observable activity; it cannot decide every legal exception or inspect your Google account settings.

Scan your cookie setup ↗ · Compare audits and website fixes ↗