The default Google Analytics snippet starts collecting data the instant your page loads setting A cookie banner is a user interface. Blocking is an engineering behavior. Regulators test the behavior: they load your site with a clean browser, open the network tab, and check whether requests to What must be blocked pre-consent for EU\/UK visitors:<\/p>\n\n\n\n Consent Mode is Google’s official mechanism: tags load, but behave according to consent state. The critical part is setting defaults to denied before any Google tag executes<\/strong>. Place this as the very first script in your When the visitor accepts, your CMP fires the update:<\/p>\n\n\n\n Two flavors exist. Basic mode<\/strong> hard-blocks Google tags entirely until acceptance maximum caution, zero data from non-consenting users. Advanced mode<\/strong> lets tags send cookieless, anonymous pings while denied, which feeds Google’s conversion modeling and can recover a meaningful share of lost conversions. With average opt-in rates hovering around 51%, advanced mode is why most marketers keep any visibility at all but review it with your DPO, as some EU regulators scrutinize even cookieless pings.<\/p>\n\n\n\n The classic blocking technique swaps the script’s MIME type so the browser ignores it:<\/p>\n\n\n\n Browsers skip scripts with unknown types. When the visitor consents to the analytics category, the CMP flips Common pitfalls<\/strong><\/p>\n\n\n\n Duplicate installs<\/strong> (GA hardcoded in the theme and<\/em> in GTM) mean one copy escapes blocking. Defaults set to “granted”<\/strong> waiting for the banner to deny is backwards -always default denied and update to granted. Caching plugins<\/strong> can inline or reorder scripts and silently break blocking – re-test after every performance-plugin change.<\/p>\n<\/blockquote>\n\n\n\n Never trust a green checkmark in Tag Assistant – verify network behavior:<\/p>\n\n\n\n Yes, blocking costs raw pageviews from non-consenting visitors. Mitigations that keep you both compliant and informed:<\/p>\n\n\n\n No – using it\u00a0without consent<\/em>\u00a0is. Austrian, French, and Italian regulators have all ruled against unconsented GA use. Blocked-until-consent GA4, with Consent Mode v2 correctly configured, is the widely accepted implementation pattern in 2026.<\/p> <\/div> Consent Mode with denied defaults\u00a0is<\/em>\u00a0a blocking mechanism for Google tags – cookies aren’t written while denied. But it only governs Google. Meta, TikTok, LinkedIn, Hotjar and everything else still needs category-based script blocking from your CMP.<\/p> <\/div> No a persistent misconception. Consent requirements attach to the processing, not the transport. Your server-side GTM container must receive and respect the same consent signals as the browser.<\/p> <\/div> US state laws are opt-out, so pre-blocking analytics isn’t required – but you must honor opt-outs and GPC signals, and stop sharing data with ad platforms when they fire. A geo-aware CMP applies each behavior automatically – see\u00a0how to set up a Do Not Sell page.<\/p> <\/div> <\/div>\n\n\n\n CookieLet scans your site, categorizes every cookie and script, and blocks them until consent -with Google Consent Mode v2 signals wired in out of the box.<\/p>\n\n\n\n_ga<\/code> cookies before your visitor has even seen the banner, let alone clicked it. Under GDPR and the ePrivacy Directive that’s a violation, and it remains the single most common finding in regulator sweeps: the ICO’s review of the UK’s top 1,000 websites repeatedly flagged analytics cookies dropping before consent. Here’s how to fix it properly, without wrecking your data or your site.<\/p>\n\n\n\nWhy “Having a Banner” Isn’t Enough<\/h2>\n\n\n\n
google-analytics.com<\/code> fire before any interaction. If they do, the banner is decorative and you are non-compliant – exactly the pattern behind the CNIL’s cookie fines, where pre-consent tag firing (not banner wording) is the most-cited violation.<\/p>\n\n\n\n\n
gtag.js<\/code>) \u2014 cookies _ga<\/code>, _ga_*<\/code><\/li>\n\n\n\nIDE<\/code>, NID<\/code><\/li>\n\n\n\n_fbp<\/code>, fr<\/code><\/li>\n\n\n\nThe Three Correct Approaches<\/h2>\n\n\n\n
Method 1: Google Consent Mode v2 with denied defaults (recommended)<\/h3>\n\n\n\n
<head><\/code>:<\/p>\n\n\n\n<script>\nwindow.dataLayer = window.dataLayer || [];\nfunction gtag(){dataLayer.push(arguments);}\n\n\/\/ MUST run before gtag.js or GTM loads\ngtag('consent', 'default', {\n ad_storage: 'denied',\n analytics_storage: 'denied',\n ad_user_data: 'denied',\n ad_personalization: 'denied',\n wait_for_update: 500\n});\n<\/script><\/code><\/pre>\n\n\n\ngtag('consent', 'update', {\n analytics_storage: 'granted'\n \/\/ plus ad signals if marketing consent was given\n});<\/code><\/pre>\n\n\n\nMethod 2: Script-type rewriting (how CMPs auto-block)<\/h3>\n\n\n\n
<script type=\"text\/plain\" data-category=\"analytics\"\n src=\"https:\/\/www.googletagmanager.com\/gtag\/js?id=G-XXXXXXX\">\n<\/script><\/code><\/pre>\n\n\n\ntype<\/code> back to text\/javascript<\/code> and the script executes. CookieLet applies this automatically to known trackers detected in your scan including async\/deferred scripts, iframes, and pixels so you don’t hand-edit templates.<\/p>\n\n\n\n\n
gtag('consent','default',\u2026)<\/code> denied state on the built-in Consent Initialization \u2013 All Pages<\/strong> trigger, which runs before every other trigger.<\/li>\n\n\n\nanalytics_storage<\/code>.<\/li>\n\n\n\n\n
How to Test That It Actually Works<\/h2>\n\n\n\n
\n
collect<\/code> or google-analytics<\/code>.<\/li>\n\n\n\ngcs=G100<\/code> \u2014 the consent-denied signal (advanced mode).<\/li>\n\n\n\n_ga<\/code>, _gid<\/code>, or ad cookies should exist pre-consent.<\/li>\n\n\n\ngcs=G111<\/code>, and the gcd<\/code> parameter encodes all four v2 consent decisions. Cookies may now be set.<\/li>\n\n\n\nWhat About Your Data?<\/h2>\n\n\n\n
\n
Frequently Asked Questions<\/h2>\n\n\n\n
\n
Auto-block every tracker – not just Google<\/h2>\n\n\n\n