Is consent required for analytics cookies?

The applicable legal framework

The short answer is yes, in most cases. The placement of analytics cookies is governed by the ePrivacy directive, which requires prior user consent for any access to or storage of information on their device, with limited exceptions.

Google Analytics, whether Universal Analytics or GA4, uses cookies to identify visitors and track their journey. These cookies are not strictly necessary for the functioning of the service requested by the user. They therefore require free, specific, informed, and unambiguous consent before any placement. This position has been confirmed by France’s CNIL in its 2020 guidelines and by the European Data Protection Board.

The audience measurement exception

The CNIL provides a consent exemption for certain audience measurement tools, provided they meet strict criteria: purpose limited to producing anonymous statistics, no cross-referencing with other processing, no data transfer outside the EU, cookie lifespan limited to 13 months, and aggregated data retention limited to 25 months maximum.

In practice, only Matomo in specific configuration and a few other tools (AT Internet/Piano Analytics) can benefit from this exemption. Google Analytics does not meet these criteria and always requires consent.

Practical consequences for your site

Implement a compliant CMP that blocks GA4 script loading until the visitor has accepted. Enable Consent Mode v2 to recover modeled data even without consent. Document the processing in your privacy policy and records. Non-compliance exposes you to significant fines: the CNIL has sanctioned several publishers for cookie placement without valid consent.