Quick answer: Under EU rules, you generally need a visitor’s consent before setting non-essential cookies, which includes most analytics and advertising cookies. GDPR, which applies from 25 May, raises the bar for what counts as consent: it must be a clear, affirmative choice, not a “by continuing to browse” notice. In practice that means tags such as Google Analytics, the Facebook pixel and AdWords remarketing should only fire after the visitor agrees, and your reports will show fewer sessions and conversions from people who decline. Plan for that gap rather than ignoring it.
For years, many sites have shown a small cookie notice that people click away without thinking. The tracking runs whether they click or not. With GDPR about to apply, and regulators paying closer attention to cookies, that approach looks increasingly risky.
This guide explains what cookie consent means for your analytics and marketing tags, how to set it up properly, and what to expect in your data. It is practical guidance, not legal advice; talk to a lawyer about your own situation.
The rules in brief
Two pieces of EU law matter here.
- The ePrivacy Directive (often called the cookie law), implemented in the UK through PECR, requires consent before storing or reading cookies and similar technologies on a user’s device, unless they are strictly necessary for a service the user asked for.
- GDPR defines what valid consent looks like. It must be freely given, specific, informed and unambiguous, given by a clear affirmative action. Pre-ticked boxes and silence do not count.
Put together, this means non-essential cookies need a real opt-in. A replacement ePrivacy Regulation is being negotiated in Brussels, but until it is agreed, the current rules apply, read alongside GDPR’s consent standard.
These rules apply to sites that target or track people in the EU, not only to businesses based there.
Which cookies need consent?
- Strictly necessary: shopping basket, login sessions, security tokens, load balancing. Generally no consent needed.
- Preferences: remembering language or region. Often need consent unless directly requested by the user.
- Analytics: Google Analytics, Hotjar, other measurement tools. Consent is generally expected, though some regulators have shown more tolerance for privacy-friendly first-party analytics.
- Marketing: Facebook pixel, AdWords remarketing, LinkedIn Insight Tag, affiliate tracking. Consent needed.
Why “implied consent” banners fall short
Many current banners say something like “We use cookies. By continuing to use this site you agree.” Under GDPR’s standard, continuing to browse is not a clear affirmative action. A banner that sets all cookies on page load, before the visitor does anything, is not asking for consent at all; it is informing them after the fact.
A compliant setup generally has:
- A banner that explains what cookies are used for, in plain language.
- A clear way to accept and an equally clear way to decline or choose categories.
- No non-essential cookies set before the choice is made.
- A way to change or withdraw consent later, such as a link in the footer.
- A cookie policy that lists cookies, their purpose and duration.
- A record of consent so you can show when and how it was given.
What consent does to your tracking
This is the part marketing teams feel most.
Fewer sessions in Google Analytics
If Google Analytics only loads after consent, visitors who decline or ignore the banner are not tracked. Your reported sessions, users and pageviews drop, sometimes noticeably, depending on how your banner is designed and how many visitors are in the EU. The traffic has not gone anywhere; you simply cannot see part of it.
Skewed metrics
Bounce rate, landing page data and conversion rates can shift because the tracked sample is different. Visitors who leave from the first page without interacting with the banner are not recorded at all, which can make bounce rate look better than reality.
Missing conversions and attribution
AdWords conversion tracking, Facebook pixel events and remarketing audiences all depend on cookies. When people decline, conversions from those visitors are not recorded, remarketing lists grow more slowly, and attribution reports show more gaps. Your ad platform will under-report results compared with your actual sales or leads.
Annotate the change
Whenever you change how consent works, add an annotation in Google Analytics. Months later, when someone asks why traffic dropped in May, the note will save a lot of confusion.
Setting up consent with Google Tag Manager
If you use Google Tag Manager, it is the natural place to control which tags fire.
- Choose a consent tool. Dedicated consent platforms such as Cookiebot, free open-source banner scripts such as Cookie Consent, and WordPress plugins like Cookie Notice all display a banner and record choices. Pick one that supports opt-in and category choices.
- Push the choice to the data layer. Most tools can push an event (for example, consent given for analytics) or set a first-party cookie storing the visitor’s choices.
- Create variables in GTM that read the consent state.
- Add trigger conditions. Change your Google Analytics, AdWords and pixel tags so they only fire when the matching consent category is granted. Use a custom event trigger so tags fire as soon as consent is given, not only on the next page.
- Handle returning visitors. On later pages, tags should fire on page view if consent is already stored.
- Test thoroughly. Use GTM preview mode and your browser’s developer tools to check that no marketing or analytics cookies appear before consent.
If tags are hardcoded in your theme rather than managed through GTM, moving them into GTM first makes consent much easier to manage. Our guide to Google Analytics setup covers a clean GTM-based installation.
Reducing the privacy footprint of analytics
Some changes make analytics less intrusive regardless of consent, and they may matter to regulators and your users:
- Turn on IP anonymisation in Google Analytics.
- Disable advertising features and remarketing in GA unless you actually use them.
- Review data sharing settings in your GA account.
- Avoid sending personal data, such as email addresses in URLs, to Google Analytics, which breaks Google’s terms as well.
- Sign Google’s data processing terms in the account settings.
We cover these steps in detail in our article on GDPR and Google Analytics.
Designing a banner people actually answer
A consent banner affects user experience as much as compliance.
- Keep it short. One or two sentences and clear buttons.
- Make choices equal. An Accept button and a Settings or Decline option that are both easy to find.
- Do not block the whole page unless you have a good reason; a bottom bar or small panel lets visitors keep reading.
- Check mobile. A banner that covers half a phone screen frustrates visitors and may also count as an intrusive interstitial in Google’s eyes.
- Use plain language. Explain what you use cookies for in terms a visitor understands, such as “to measure which pages are useful” or “to show you relevant ads on other sites”.
Planning around the data gap
You cannot recover data from visitors who decline, but you can plan for it:
- Compare analytics with server logs, CRM records or order data to understand the size of the gap.
- Report on trends and ratios rather than absolute numbers when comparing periods before and after consent changes.
- Rely more on first-party data you collect with permission, such as form submissions and logged-in behaviour.
- Brief stakeholders before the change so a drop in reported traffic does not cause panic.
FAQ
Do I need a cookie banner if my business is outside the EU?
If you target or track visitors in the EU, the rules can still apply to you. Many businesses outside the EU choose to show consent banners only to EU visitors.
Is Google Analytics a strictly necessary cookie?
Generally no. It measures site usage rather than providing a service the visitor requested, so most guidance treats it as needing consent.
Will a consent banner hurt my SEO?
Not if it is a reasonable size and does not block content. Avoid full-screen overlays on mobile.
Measure what you can, clearly
Cookie consent changes what you can see in your reports, but it does not stop you understanding what is working. If you need help setting up consent in Tag Manager and keeping your reporting meaningful, our analytics and reporting service can help.
