If you have visitors in the EU or UK: no. Google Analytics 4 sets cookies such as _ga to recognise returning visitors, and those aren’t strictly necessary, so they need consent before they’re set.
This is a practical guide, not legal advice. If real money, health data, children or a regulator’s letter is involved, talk to a lawyer.
What goes wrong in practice
The usual setup is a snippet pasted into the site’s layout, which runs for every visitor the instant the page opens. Adding a banner afterwards doesn’t fix it unless the banner actually holds the script back. Tags inside Google Tag Manager are a second trap: the container loads, and everything in it fires, whatever the banner says.
Your options
- Gate it properly. Load the GA script only after the visitor clicks Accept. You’ll lose data from everyone who declines, which in Europe is often most people.
- Use Google’s consent mode. It lets tags adjust their behaviour to the visitor’s choice. It’s a way to respect consent, not a way around asking for it.
- Switch to cookieless analytics. Plausible, Fathom, Simple Analytics and Vercel Analytics count visits without cookies or personal identifiers, so no banner is needed for them. For most small products, page views and referrers are all you were using anyway.
Two more things to get right
- Name Google Analytics in your privacy policy, say what it collects and link to Google’s opt-out. Running analytics with no notice is its own problem.
- Several European regulators ruled against Google Analytics in 2022 over transfers of data to the US. The EU–US Data Privacy Framework, adopted in 2023, eased that, but it’s one more reason small sites choose an EU-hosted, cookieless tool.
Check yours
Open your site in a private window with DevTools’ Network tab open and don’t click anything. If you see requests to google-analytics.com or googletagmanager.com, it’s firing before consent. A vibeliq scan does exactly this in a real browser and names what it sees.