ConsentGate

All guides

Does Google Analytics need consent?

Updated: 13 October 2026

The short answer

Yes. Google Analytics stores cookies on the visitor's device that are not necessary for the site to work, so the rules require consent first. Google also requires consent under its own policy for visitors from Europe.

Why statistics are not an exception

The rules allow storage without consent only for what is necessary for a service the visitor asked for. Someone who opens a hairdresser's website wants to check the prices. They did not ask to be counted.

Statistics serve you, not the visitor. That is why they fall outside the exception. Polish law has only two exceptions, and neither covers statistics.

The argument that these are only numbers and you recognise nobody does not help. The rule is about storing and reading on the device, whether or not a particular person can be identified from it.

What regulators in the region say

We checked ten countries of Central Europe and the Baltic states. Nine of them have no exception for statistics.

The Latvian authority names the Google Analytics cookies _ga, _gat and _gid as ones that need consent. The Slovenian authority writes that analytics cookies are never strictly necessary and always need prior, active consent, even when they come from the site's own domain. The Hungarian authority treats statistics as a separate category that visitors should be asked about.

The Czech and Slovak authorities class statistics among cookies that are not necessary, meaning ones that need prior consent. The Estonian authority lists analytics cookies alongside advertising ones.

The Bulgarian authority's guidance allows statistics without consent if the data is anonymised and not passed on. It gives no technical conditions, however, and names Google Analytics itself as an example of a tool that needs consent.

What Google itself requires

Apart from the law, Google has its own policy for sites that use its products and have visitors from the European Economic Area, the United Kingdom and Switzerland.

In short, Google expects four things. You collect valid consent where the law requires it. You keep records of consent. You show clearly how consent can be withdrawn. You name who may receive data through the Google product.

Then there is the technical side. The visitor's decision has to reach the Google tags. That is what Consent Mode v2 is for.

What it looks like in practice

A well set up site works like this. Before the visitor clicks anything, the Google tags are told "denied". When the visitor agrees to statistics, that changes to "granted", and only then does Analytics store its cookies.

The order matters. If a Google tag runs before it has been told "denied", cookies may be stored ahead of the decision. This is the most common reason why a site appears to have a consent window and still tracks from the first second.

Some visitors will refuse, and you will not see those people in your ordinary reports. That is the honest price. The numbers will be lower than they used to be, but they will come from people who agreed.

The decision should be changeable. A visitor who agreed needs a simple way to withdraw consent, and the Google tags should be told when that happens.

What you lose and what you gain

If you link Analytics with Google Ads, more than reports is at stake. Without consent signals, remarketing lists and conversion measurement stop working for visitors from Europe. A small shop then loses sight of which advert pays for itself.

You also gain peace of mind if questions come. The rules expect you to be able to show that consent was given. A log of decisions takes care of that.

Legal basis in Poland: Article 399 of the Electronic Communications Law. We describe the rules and how regulators apply them. We are not advising on your particular case.

Consent signals can be set by hand in the site's code or left to a tool such as ConsentGate, which sets them for you before any Google tag runs.

Key points

Sources

This guide is for information only and is not legal advice.