Does GA4 Use Cookies? Analytics & Consent Explained

Which cookies GA4 actually sets

GA4 is lighter on cookies than the old Universal Analytics was — notably, the short-lived _gid cookie from Universal Analytics is gone in GA4. What remains are a small set of first-party cookies, with two doing nearly all the work.

Two things to note. First, these are first-party cookies — set on your own domain by the tag on your site, not by a google.com domain. Second, the default two-year lifespan is adjustable: in GA4's data-stream settings you can shorten it (down to as little as session-only, up to a 25-month maximum), and browsers may cap it anyway — Chrome limits non-returning-visitor cookies to around 400 days, and Safari's tracking prevention can cut first-party script-set cookies to roughly 7 days. Linking Google Ads or other Google products can introduce additional cookies beyond the three above.

Crucially, Google also states that the GA4 libraries do not require cookies to transmit data. The cookies mainly exist to recognise returning visitors and link sessions together; the measurement calls themselves can happen without them. That fact is the hinge for the whole "cookieless" discussion below.

First-party doesn't mean exempt

A common misreading: "GA4's cookies are first-party, so I don't need consent for them." That conflates two separate questions. First-party vs third-party is about who sets the cookie and on which domain. Essential vs non-essential is about whether the cookie is strictly necessary to deliver what the user asked for. Consent law keys off the second question, not the first.

Analytics cookies — first-party or not — are non-essential: a visitor can read your page perfectly well without GA4 ever recognising them. As the plain test goes, analytics cookies "are not needed to deliver the page the visitor asked for." That's why, under the EU's ePrivacy rules and the GDPR, storing or reading them generally requires prior consent, exactly as it would for an advertising pixel. Being first-party changes the cookie's resilience to browser blocking; it does not change the consent obligation.

So "it's just first-party analytics" is not a compliance position. The question that matters is whether GA4's cookies are strictly necessary (they aren't), and therefore whether you obtained consent before they fired (you need to).

The "cookieless" question: what Consent Mode really does

Google markets GA4 as able to run "cookieless," and that's where confusion peaks. The mechanism is Google Consent Mode, which governs GA4's storage behaviour through a signal called analytics_storage. When that signal is set to "denied," the GA4 tag does not read or write its analytics cookies. Instead, it can send cookieless pings — stripped-down, anonymised hits that Google uses to model (statistically estimate) the behaviour and conversions it can no longer observe directly.

There are two flavours. Basic consent mode doesn't load the Google tags at all until the visitor consents, so a declining visitor produces no data. Advanced consent mode loads the tags with consent denied by default and sends those cookieless pings until (and unless) the visitor consents — which is why, with advanced mode, a chunk of your GA4 reporting becomes modelled rather than directly measured.

The trap is treating "cookieless" as "consent-free." A cookieless ping is still a transmission of data about the visitor to Google. Whether that specific transmission needs consent is a live and jurisdiction-dependent question — not an automatic exemption. Running advanced consent mode can reduce your cookie exposure while leaving a data-transfer question open.

When you actually need consent for GA4

Whether you need consent before GA4 sets its cookies depends on where your visitors are — and the answer is "usually yes" in the places with the strictest rules.

• EU and UK. Generally yes. GA4's analytics cookies are non-essential, and ePrivacy rules plus the GDPR require prior consent before non-essential cookies are stored or read. In practice that means GA4 should not fire its cookies until the visitor opts in — the prevention-first pattern — and Consent Mode is how you wire that choice through to the tag.
• France (CNIL), specifically. France offers a narrow audience-measurement exemption that can let certain analytics run without consent — but only under strict conditions, including a cookie lifetime capped at 13 months. GA4's two-year default blows past that, and the CNIL has said plainly that "most large audience measurement offerings do not fall within the scope of the exemption." So the exemption rarely rescues a standard GA4 install.
• United States. There's no single federal cookie-consent law, so GA4 cookies aren't gated the way they are in the EU. But several state privacy laws (California's CCPA/CPRA and others) give consumers opt-out rights over certain tracking and sale/sharing of data — and, as we'll see, a separate US theory (wiretapping) can apply regardless of cookies.

The simplest safe posture for a site with any EU/UK traffic: treat GA4 as requiring prior consent, don't rely on the French exemption, and don't assume "first-party" or "cookieless" removes the obligation.

Is GA4 GDPR-compliant in 2026? The honest answer

This is where most competitor articles give you a confident yes or a confident no, and both are wrong. The accurate 2026 answer is "defensibly yes — if configured correctly — but with an unresolved footnote." Here's the real arc, because the history matters.

In 2022, several EU data-protection authorities — Austria's DSB (January), France's CNIL (February), and Italy's Garante (June) — ruled that specific websites' use of Google Analytics violated the GDPR, because it transferred personal data to the US without adequate safeguards after the Schrems II judgment struck down Privacy Shield. For a stretch, "Google Analytics is illegal in Europe" was a fair summary of the risk.

What changed was the EU-US Data Privacy Framework (DPF), which the European Commission adopted on 10 July 2023. Certified US companies — Google among them — gained a clearer legal basis for transatlantic data transfers, addressing the central objection in those 2022 rulings. That's why the flat "GA is illegal in the EU" claim is now out of date.

And there's a quieter failure point that sits entirely on your side: the consent banner itself. A large share of EU consent banners fail one or more GDPR requirements, and a banner that doesn't actually block GA4 until consent — or that nudges users toward "accept" — passes its own non-compliance straight through to your analytics. The tool can be configured correctly and still be unlawful because the gate in front of it leaks.

The US catch most GA4 guides skip: CIPA

Here's the angle you won't find on the typical "does GA4 use cookies" page, and it's the one with teeth in the US. California's Invasion of Privacy Act (CIPA) — a wiretapping statute — is being used to sue websites whose analytics and tracking tools route a visitor's activity to a third party without consent. And this theory doesn't depend on cookies at all. It depends on the data flow: is a visitor's interaction being shared with an outside party, in a way that looks like interception?

That's why GA4 can carry US risk even in a cookieless configuration. The question a CIPA claim asks isn't "did you set a cookie?" — it's "did Google receive this visitor's data as a third party, without consent?" GA4's data-sharing settings, which can make Google a recipient of your visitors' data for its own purposes, are what tip it from a first-party measurement tool into potential third-party interception territory. Cookieless pings still send data; server-side GA4 still forwards it. The cookie question and the wiretapping question are genuinely separate.

How to run GA4 the right way

You don't have to drop GA4 to be compliant — you have to gate it and configure it deliberately. A practical sequence:

The quickest first step is to see what GA4 is doing on your live site right now, because the settings in your GA4 admin and the behaviour in a visitor's browser aren't always the same thing.