Google Analytics (GA) tracks how people use your websites and mobile apps. It collects data like page views, location, time spent, and what users click on.
Because this involves personal data, laws like the General Data Protection Regulation (GDPR) in the EU and the California Consumer Privacy Act (CCPA) in the US say you can’t collect it without permission. That means Google Analytics must obtain user consent before collecting or storing data through cookies or similar technologies.
If you're using Google Analytics, you should follow the following steps:
Google Analytics uses cookies to track visitors. Because of privacy laws, you need to wait until a user agrees before loading it. If you load it right away, you're likely not compliant.
The easiest way to handle consent is with a CMP. It shows users a cookie banner and only runs Google Analytics if they click “Accept.” If you don’t have one installed, start with UniConsent. It provides a customizable consent banner, automatic blocking of tracking scripts until consent is granted, and straightforward setup by adding a script to your site's <head> section.
To get started:
Visit uniconsent.com
Create an account
Follow the setup instructions
Add the provided script to the site
Check that Google Analytics does not load before consent
Once your CMP is installed: Open the site in a private browser window. Verify that Google Analytics does not run immediately. Additionally, in GA under Data Collection and Modification → Consent Settings, you should see that both Behavioral analytics consent signals and Advertising consent signals are shown as inactive.
consent-settings
behavior-analytics-inactive
ad-consent-signals-inactive
Click "Accept" and confirm that GA only begins tracking afterward.Then you should see that both Behavioral analytics consent signals and Advertising consent signals are shown as active.
behavior-analytics-active
ad-consent-signals-active
Include clear information about:
The use of Google Analytics
The type of data being collected
The reason for collecting it
How users can change or withdraw their consent
In short, to ensure your use of Google Analytics is compliant:
Don’t load GA by default, wait for user consent before tracking.
Use a Consent Management Platform (CMP) like UniConsent to manage consent and block GA until users agree.
Test your setup to confirm GA only runs after consent is given and that consent signals in GA update correctly.
Update your privacy policy to clearly explain your data collection practices and how users can manage their consent.
By following these steps, you will respect user privacy, stay compliant with regulations, and maintain transparency with your website visitors.