Introduction
The default Google Analytics snippet starts collecting data the instant your page loads setting _ga cookies before your visitor has even seen the banner, let alone clicked it. Under GDPR and the ePrivacy Directive that’s a violation, and it remains the single most common finding in regulator sweeps: the ICO’s review of the UK’s top 1,000 websites repeatedly flagged analytics cookies dropping before consent. Here’s how to fix it properly, without wrecking your data or your site.
Why “Having a Banner” Isn’t Enough
A cookie banner is a user interface. Blocking is an engineering behavior. Regulators test the behavior: they load your site with a clean browser, open the network tab, and check whether requests to google-analytics.com fire before any interaction. If they do, the banner is decorative and you are non-compliant – exactly the pattern behind the CNIL’s cookie fines, where pre-consent tag firing (not banner wording) is the most-cited violation.
What must be blocked pre-consent for EU/UK visitors:
- Google Analytics 4 (
gtag.js) — cookies_ga,_ga_* - Google Ads / DoubleClick —
IDE,NID - Meta Pixel —
_fbp,fr - Embedded iframes that set cookies (YouTube, maps, social widgets) and tracking pixels — the EDPB’s Guidelines 2/2023 explicitly extended consent requirements to pixels and fingerprinting techniques.
The Three Correct Approaches
Method 1: Google Consent Mode v2 with denied defaults (recommended)
Consent Mode is Google’s official mechanism: tags load, but behave according to consent state. The critical part is setting defaults to denied before any Google tag executes. Place this as the very first script in your <head>:
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
// MUST run before gtag.js or GTM loads
gtag('consent', 'default', {
ad_storage: 'denied',
analytics_storage: 'denied',
ad_user_data: 'denied',
ad_personalization: 'denied',
wait_for_update: 500
});
</script>When the visitor accepts, your CMP fires the update:
gtag('consent', 'update', {
analytics_storage: 'granted'
// plus ad signals if marketing consent was given
});Two flavors exist. Basic mode hard-blocks Google tags entirely until acceptance maximum caution, zero data from non-consenting users. Advanced mode lets tags send cookieless, anonymous pings while denied, which feeds Google’s conversion modeling and can recover a meaningful share of lost conversions. With average opt-in rates hovering around 51%, advanced mode is why most marketers keep any visibility at all but review it with your DPO, as some EU regulators scrutinize even cookieless pings.
Method 2: Script-type rewriting (how CMPs auto-block)
The classic blocking technique swaps the script’s MIME type so the browser ignores it:
<script type="text/plain" data-category="analytics"
src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX">
</script>Browsers skip scripts with unknown types. When the visitor consents to the analytics category, the CMP flips type back to text/javascript and the script executes. CookieLet applies this automatically to known trackers detected in your scan including async/deferred scripts, iframes, and pixels so you don’t hand-edit templates.
- Method 3: Google Tag Manager with consent gating
- If GA runs through GTM, configure consent inside the container:
- In Admin → Container Settings, tick Enable consent overview.
- Create a tag that fires the
gtag('consent','default',…)denied state on the built-in Consent Initialization – All Pages trigger, which runs before every other trigger. - Set your GA4 tag’s built-in consent checks to require
analytics_storage. - Have your CMP push the consent update event, and let tags fire (or re-fire) on it.
- The most common GTM mistake: GA4 configured to fire on the plain “All Pages” trigger with no consent check — it will beat your banner every time.
Common pitfalls
Duplicate installs (GA hardcoded in the theme and in GTM) mean one copy escapes blocking. Defaults set to “granted” waiting for the banner to deny is backwards -always default denied and update to granted. Caching plugins can inline or reorder scripts and silently break blocking – re-test after every performance-plugin change.
How to Test That It Actually Works
Never trust a green checkmark in Tag Assistant – verify network behavior:
- Open an incognito window, DevTools → Network tab, filter for
collectorgoogle-analytics. - Load your site and touch nothing. You should see either no GA requests at all (basic/hard blocking) or requests carrying
gcs=G100— the consent-denied signal (advanced mode). - Check Application → Cookies. No
_ga,_gid, or ad cookies should exist pre-consent. - Click Accept. Requests should now show
gcs=G111, and thegcdparameter encodes all four v2 consent decisions. Cookies may now be set. - Click Reject / withdraw. Tracking must stop and consented cookies should be cleared – regulators specifically fined Shein and American Express for cookies still being read after withdrawal.
- Repeat monthly. CMP updates, GTM changes, and new marketing tags silently break consent sequencing; scheduled re-scans are what keep you compliant over time.
What About Your Data?
Yes, blocking costs raw pageviews from non-consenting visitors. Mitigations that keep you both compliant and informed:
- Consent Mode advanced + behavioral modeling in GA4 fills gaps with modeled data once you clear Google’s traffic thresholds.
- Optimize the banner itself — clear copy, honest value exchange, and fast load measurably improve opt-in rates. (Dark patterns improve them too, and then get you fined — don’t.)
- Invest in first-party data — newsletter signups, account data, and server logs aggregated without identifiers don’t depend on tracking consent.
Frequently Asked Questions
No – using it without consent is. Austrian, French, and Italian regulators have all ruled against unconsented GA use. Blocked-until-consent GA4, with Consent Mode v2 correctly configured, is the widely accepted implementation pattern in 2026.
Consent Mode with denied defaults is a blocking mechanism for Google tags – cookies aren’t written while denied. But it only governs Google. Meta, TikTok, LinkedIn, Hotjar and everything else still needs category-based script blocking from your CMP.
No a persistent misconception. Consent requirements attach to the processing, not the transport. Your server-side GTM container must receive and respect the same consent signals as the browser.
US state laws are opt-out, so pre-blocking analytics isn’t required – but you must honor opt-outs and GPC signals, and stop sharing data with ad platforms when they fire. A geo-aware CMP applies each behavior automatically – see how to set up a Do Not Sell page.
Auto-block every tracker – not just Google
CookieLet scans your site, categorizes every cookie and script, and blocks them until consent -with Google Consent Mode v2 signals wired in out of the box.
