Analytics cookies, also called analytical cookies, are small text files stored in a visitor's browser that record how they interact with your website. They track page views, session duration, traffic sources and similar behavioural data. Unlike strictly necessary cookies that keep a site working, analytics cookies exist to help site owners understand their audience, and that is what makes them legally sensitive. In the EU they need consent, with narrow national exemptions. In the UK, since 5 February 2026, first-party statistics can run without opt-in consent if visitors are told and can object.
What analytics cookies actually do
Every time someone visits your site, analytics cookies assign them a unique identifier so the analytics platform can distinguish one visitor from another. That identifier persists across pages and sessions, building a picture of how each person navigates your site over time.
The data typically includes which pages were viewed and in what order, time spent on each page, the referring source, the visitor's device type and browser, geographic location based on IP address, and interactions like button clicks or form submissions. None of this is needed for the website to work. A visitor who refuses analytics cookies will experience your site identically to one who accepts them. Because analytics cookies are not strictly necessary, privacy laws across the EU, Brazil and beyond classify them as non-essential, and most require consent before they load.
Google Analytics cookies and other common analytics cookies
Google Analytics 4 (GA4) is the most widely deployed analytics platform, and it sets first-party cookies on every site that uses it. According to Google's page on GA4 cookie usage, GA4 sets two: _ga, which stores a unique client ID, and _ga_<container-id>, which keeps session state, both with a default expiry of 2 years. Chrome caps any cookie at 400 days. The _gid and _gat cookies belong to Universal Analytics, which stopped processing data in July 2023, so you only see them on sites that still load old tags.
GA4 is not the only source of analytics cookies. Other common examples include:
| Cookie | Platform | Purpose | Typical duration |
|---|---|---|---|
_ga | Google Analytics 4 | Distinguishes unique users across sessions | 2 years (Chrome caps it at 400 days) |
_ga_<id> | Google Analytics 4 | Persists session state | 2 years (Chrome caps it at 400 days) |
_pk_id | Matomo | Stores unique visitor ID | 13 months |
_pk_ses | Matomo | Tracks active session | 30 minutes |
_hj_* | Hotjar | Session recordings, heatmaps, polls | Varies (session to 365 days) |
_clck and _clsk | Microsoft Clarity | Session replay and heatmap data | 1 year and 1 day |
All of these are classified as non-essential. Even though GA4 sets first-party cookies (from your domain rather than google.com), the data is sent to Google's servers. Regulators treat this as sharing with a third party, which is why analytics cookies receive the same scrutiny as third-party tracking.
Why analytics cookies require consent under the GDPR
Two laws work together to govern analytics cookies in the EU. The ePrivacy Directive (Article 5(3)) sets the rule: storing or accessing information on a user's device requires prior consent, unless it is strictly necessary for a service the user explicitly requested. The GDPR then defines what valid consent looks like: freely given, specific, informed and unambiguous (Article 4(11)), and provable and as easy to withdraw as to give (Article 7).
Analytics cookies fail the ePrivacy Directive's necessity test. A visitor requests a web page, not a visitor-counting service. Since measuring audience behaviour is the site owner's interest rather than the visitor's request, consent is required before any analytics cookie reaches the browser, unless a national exemption applies.
Can you rely on legitimate interest instead of consent? Not for the cookie itself. Article 5(3) allows only consent or the strictly necessary exemption, so a GDPR legal basis such as legitimate interest cannot replace consent for storing or reading an analytics identifier.
Enforcement shows what is at stake. The CNIL, France's data protection authority, imposed 83 sanctions totalling EUR 486,839,500 in 2025 across all subjects, according to its review of its 2025 sanctions, with cookies among the main themes. EUR 475 million of that came from two cookie decisions on 1 September 2025: EUR 325 million against Google and EUR 150 million against SHEIN.
When analytics can run without consent
As of October 2026, analytics can run without opt-in consent in two well-documented cases: under the French CNIL's audience measurement exemption, and under the UK's statistics exception in force since 5 February 2026. Both depend on conditions, and a standard Google Analytics setup with advertising features meets neither. Everywhere else in the EU, assume consent unless your national regulator says otherwise.
France: the CNIL's audience measurement exemption
The CNIL treats audience measurement cookies as exempt from consent when they meet its conditions, set out in its guidance on analytics for websites and apps. The data must be used only to produce anonymous statistics for the site owner, must not be cross-checked with other processing, and the trackers must not last longer than 13 months. The CNIL notes that most large audience measurement offerings fall outside the exemption whatever their configuration, and points to open-source software such as Matomo that you can configure yourself.
United Kingdom: the statistics exception
The Data (Use and Access) Act 2025 added a statistics exception to the Privacy and Electronic Communications Regulations (PECR). Under paragraph 5 of Schedule A1 to PECR, you can store or read analytics information without consent if all of these hold:
The sole purpose is collecting statistics about how your site or service is used, to improve it.
The information is not shared with anyone else, except to help you make those improvements.
Visitors get clear and comprehensive information about the purpose.
Visitors get a simple, free way to object, and do not object.
A provider that also uses the data for its own purposes breaks the second condition. GA4 with Google signals or a linked Google Ads account is therefore unlikely to fit, while a self-hosted or processor-only analytics tool can. Advertising, marketing and ad measurement cookies still need consent in the UK.
Can your analytics run without consent?
Browser restrictions that affect analytics cookies
Even when visitors do consent, browser-level restrictions can thin out your analytics data. Safari's Intelligent Tracking Prevention (ITP) deletes all cookies created in JavaScript, and other script-writeable storage, after 7 days of no user interaction with the website, according to WebKit's tracking prevention page. Since GA4 sets its cookies through JavaScript, a Safari visitor who comes back after more than a week without interacting is counted as a new user. If the visitor arrived through a link with click identifiers in the URL, WebKit caps the lifetime of cookies created in JavaScript on that landing page at 24 hours.
Chrome allows first-party cookies up to 400 days. Server-set cookies, delivered through HTTP Set-Cookie headers rather than JavaScript, keep their expiry in Safari only when servers that belong to your site set them: Safari caps cookies set through a CNAME to another company, or from another company's IP addresses, at 7 days. That is part of why server-side tracking is growing, though it adds complexity and does not remove the consent obligation.
How Google Consent Mode interacts with analytics cookies
Google Consent Mode v2 passes visitor consent choices to Google's tags through four parameters: analytics_storage, ad_storage, ad_user_data and ad_personalization. When analytics_storage is set to denied, GA4 does not write cookies. In advanced mode, it sends cookieless pings, signals without a cookie identifier, that Google uses for behavioural modelling.
That modelling is not a free pass. It estimates the behaviour of non-consenting visitors from patterns among consenting ones, and it needs minimum traffic levels to switch on. Whether advanced mode's cookieless pings are themselves lawful under the GDPR is debated: some privacy professionals argue that sending any data from visitors who declined tracking goes against their refusal.
Analytics cookies under other privacy laws
Outside the EU, the consent requirements for analytics cookies vary considerably.
| Jurisdiction | Law | Consent model for analytics cookies |
|---|---|---|
| EU and EEA | GDPR and ePrivacy Directive | Opt-in, with narrow national exemptions such as France's |
| United Kingdom | UK GDPR and PECR | Opt-in, or the statistics exception with a right to object (since 5 February 2026) |
| Germany | GDPR and TDDDG | Opt-in (prior consent required) |
| California (US) | CCPA and CPRA | Opt-out (disclose and allow refusal) |
| Brazil | LGPD | Opt-in consent required |
| Canada | PIPEDA and CASL | Implied or express consent depending on sensitivity |
| South Africa | POPIA | Opt-in for non-essential processing |
The California approach differs fundamentally: the CCPA and CPRA work on an opt-out basis, so analytics cookies can load by default as long as the site discloses their use and provides a way to refuse.
How to handle analytics cookies on your website
Getting analytics cookies right involves three practical steps: scanning, blocking and documenting.
1. Identify every analytics cookie your site sets
Run a cookie scan to catalogue every cookie your site places. Pay attention to cookies set by third-party scripts you may have forgotten about: an embedded YouTube video, a chat widget or an A/B testing tool can all drop analytics cookies. Scan again on a schedule, because cookies change every time you add a plugin or integrate a new tool.
2. Block analytics cookies until consent is given
A consent management platform should prevent analytics scripts from running until the visitor actively opts in. Displaying a banner while cookies fire in the background is the most common failure, and it is exactly what the CNIL found in its 2025 SHEIN decision. Your consent tool needs category-level choices, so visitors can accept analytics while rejecting marketing cookies, and it should pass those choices to GA4 through Google Consent Mode v2. If you rely on the UK statistics exception instead, it needs an easy way for visitors to object.
3. Maintain a cookie declaration
List every cookie in your cookie policy with its name, purpose, duration and any third parties involved. Generic descriptions like "improves your experience" are not enough, and the CNIL has targeted vague labels during enforcement. State clearly that _ga assigns a unique identifier and sends data to Google's servers.
Alternatives to traditional analytics cookies
If consent rates are low and data gaps are hurting your reporting, several approaches can recover insight without persistent cookies.
Cookieless analytics platforms such as Matomo (in cookieless mode), Plausible and Fathom collect aggregate traffic data without setting cookies. The trade-off is less accuracy for returning visitor counts, but the data is often enough to understand overall traffic patterns. Cookieless does not always mean consent-free: the EDPB's Guidelines 2/2023 bring other ways of reading information from a device within Article 5(3).
Server-side tracking moves data collection from the browser to your own server, reducing exposure to browser cookie restrictions. GA4 supports server-side tagging through Google Tag Manager's server container. This does not remove the consent requirement, but it can improve data quality for consenting visitors.
Google Consent Mode's modelling fills reporting gaps by estimating non-consenting visitor behaviour with machine learning. It narrows the gap for sites with enough traffic to train the model, though it is not a replacement for real data.
Questions about analytics cookies
Do analytics cookies count as personal data under the GDPR?
Yes. Analytics cookies assign unique identifiers to visitors, and under the GDPR online identifiers can be personal data (Recital 30). The combination of a unique ID, IP address and browsing history makes the visitor identifiable.
Can I use Google Analytics without consent if I anonymise IP addresses?
Not in the EU. IP anonymisation does not remove the consent requirement, because the _ga cookie still assigns a unique client ID and data is sent to Google's servers. In the UK, the statistics exception only applies if the data is not reused for Google's own purposes and visitors can object.
Can I run analytics without a cookie banner in the UK?
Sometimes. Since 5 February 2026, first-party statistics used only to improve your site can run without opt-in consent if visitors get clear information and a simple, free way to object. Advertising and marketing cookies still need consent.
What happens if I set analytics cookies before getting consent?
Setting non-essential cookies before consent breaches Article 5(3) of the ePrivacy Directive. On 20 November 2025 the CNIL fined Les Publications Condé Nast EUR 750,000 for cookies placed without consent on vanityfair.fr.
Why does Google Analytics show different user counts in Safari and Chrome?
Safari deletes cookies created in JavaScript after 7 days without user interaction on the site. A Safari visitor who returns after more than a week can lose the _ga cookie and be counted as a new user, while Chrome keeps it for up to 400 days.
Does Consent Mode v2 mean I do not need consent for analytics?
No. Consent Mode passes consent states to Google tags but does not replace the legal requirement to obtain consent. When analytics_storage is denied, GA4 does not set cookies but may still send cookieless pings in advanced mode.
Are analytics cookies the same as tracking cookies?
They overlap but are not identical. Analytics cookies measure site performance, and tracking cookies follow users across websites for advertising. Some cookies do both: GA4 cookies feed advertising audiences when Google signals or Google Ads linking is turned on.
Find out which analytics cookies your site sets
If you are unsure which analytics cookies your site sets, or whether they fire before consent, start with a scan. Kukie.io finds first-party and third-party cookies, sorts them into categories and holds analytics tags until visitors choose or passes their choice to Google Consent Mode v2.
