Do I need a cookie banner for Google Analytics? What EU, UK and California rules ask of a site that runs it

Do I need a cookie banner for Google Analytics: the answer by visitor

For EU visitors, the test is consent or necessity. Google says its tags set and read cookies to identify unique users across browsing sessions, and the ePrivacy Directive's Article 5(3), as the EDPB quotes it, allows storing or reading information on a device only on consent or necessity for specific purposes.

For UK visitors, the ICO adds a narrow exception for statistics, with conditions. For US visitors, California's official texts ask a business that sells or shares data for an opt-out link or signal handling.

This is general information, not legal advice. CookieYes is a technology platform that assists with compliance, and the site owner carries responsibility for the site. A qualified lawyer should answer how these rules treat your own Analytics setup. Rules and figures are as read on October 31, 2026.

EU and UK visitors: consent before Analytics cookies

The EDPB says access to a service must not be made conditional on consent to storing information on the device, and that scrolling or swiping is never a clear and affirmative action. The ICO's guidance, finalized and updated on April 29, 2026, requires prior consent to the UK GDPR standard unless an exception applies, and lists five exceptions.

Two matter here. One covers storage strictly necessary to provide a service the user requested. The other covers collecting statistics about visitors solely to improve the service. The ICO calls the statistics exception not a broad one covering all analytics, asks for clear information and a simple, free way to object, and excludes tracking individual visitors and purposes related to online advertising. Whether your setup meets those conditions is a lawyer's question.

Separately, Google's own EU user consent policy asks site owners for legally valid consent to cookies where legally required, for end users in the EEA, the UK and Switzerland.

US visitors: California's opt-out route

CookieYes's CCPA page says the law has no strict opt-in requirements. The official texts ask something narrower of a business that sells or shares personal information: a Do Not Sell or Share link or opt-out signal handling (Civil Code 1798.135; regulations section 7025(b)). A business that does not sell or share need not honor a signal such as Global Privacy Control (7025(c)(1)).

Whether your Analytics setup counts as selling or sharing is a lawyer's question; the wider US picture is in do I need a cookie banner in the US.

What Google Consent Mode v2 changes

Google updated consent mode in November 2023 with two added parameters: ad_user_data, which sets consent for sending user data related to advertising to Google, and ad_personalization, which sets consent for personalized advertising. In Basic mode, Google tags do not load until the visitor interacts with the consent banner. In Advanced mode, they load when the visitor opens the site, with default consent states set first. Setup is in Google Consent Mode v2 cookie banner.

Holding Analytics back with a banner

CookieYes includes Google Consent Mode v2 and cookie auto-blocking, which holds back scripts that set non-essential cookies until the visitor consents, on all four plans, the Free plan included. In CookieYes's Basic consent mode, on by default, Google tags load only after the visitor interacts with the banner. To check that it does, clear site data including third-party cookies, hard refresh with Ctrl+Shift+R, and confirm only strictly necessary cookies are present until you accept the banner.

The Free plan covers one domain, and Basic, Pro and Ultimate run a 14-day trial before billing; CookieYes's pricing FAQ says the card is charged automatically when it ends unless you cancel. Start with CookieYes free plan.