Is GA4 GDPR-Compliant? Cookie Consent and Consent Mode v2 for EU Sites (2026)

Companies with customers in Europe, and Japanese companies running sites for the EU, keep asking the same question. "I heard GA4 is illegal under the GDPR. Can we still use it?" If you only follow headlines, the 2022 reports of "illegal" and the 2023 reports of "solved by a new framework" blur together. You either keep using it and feel uneasy, or stop measuring and lose the evidence behind your ads and improvements. Both are poor choices.

This article splits whether GA4 can be used in Europe into three separate questions. Is consent needed for cookies? Is there a basis for processing personal data? Is the transfer of data to the US permitted? The three rest on different laws and are overseen by different bodies. I then checked the position of the Dutch data protection authority (Autoriteit Persoonsgegevens, the AP), the current state of the EU-US Data Privacy Framework (DPF), and Google's Consent Mode v2 specification against official documents. Setup steps and the configuration of DevNJ's own site are included, limited to facts.

How to watch your numbers after launch is covered in "Automating Search Console and GA4 monitoring". This article comes before that: what you may measure in the first place.

Main sources used: the AP's cookie guidance and its nine rules for cookie banners, the AP's official reply of 13 November 2025 (ambtsbericht), the European Commission's DPF adequacy decision, Google's help pages for Consent Mode, GA4 and Tag Manager, and Google's EU User Consent Policy. All were checked on 30 October 2026.

What you will learn	The short answer
Can GA4 be used in Europe	Yes, but there are three separate conditions (Chapter 1)
What has happened so far	From the 2020 ruling to the AP's 2025 reply (Chapter 2)
The Dutch position	Only limited analytics cookies need no consent; GA4 is undecided (Chapter 3)
Is the DPF stable	In force, but an appeal is pending (Chapter 4)
What Consent Mode v2 is	A way to pass consent to tags; the banner is separate (Chapter 5)
What to hold back before consent	Cookies, identifier-bearing sends, ad tags, third-party embeds (Chapter 7)
Setup and verification	Set defaults to denied in GTM and the CMP, then check on screen (Chapters 8-9)

1. The short version: "can we use it" splits into three questions

"Does GA4 violate the GDPR" is not one question. Running GA4 raises at least three separate legal issues at once. Mixing them produces half-right judgements such as "we have a banner, so we are fine" or "the DPF exists, so we are fine".

1-1. The three layers and their legal bases

The first layer is storage on, and reading from, the device. Writing cookies to a visitor's browser and reading them falls under article 5(3) of the ePrivacy Directive. In the Netherlands, the Telecommunications Act (Telecommunicatiewet) article 11.7a implements this. The question here is whether consent is needed.

The second layer is processing of personal data. If the client ID or IP address that GA4 collects is personal data, the principles of the GDPR apply. Processing needs a legal basis (consent or legitimate interest) and explanation in a privacy notice.

The third layer is transfer to the US. Google LLC is a US company. Moving EU personal data to the US needs a basis under Chapter V of the GDPR. Since 10 July 2023, the DPF adequacy decision has been that basis.

In the figure, meeting one layer does not excuse the others. A banner does not help if the privacy policy is empty, which leaves layer 2 unmet. A valid DPF does not help if you write cookies without consent, which is a layer 1 problem.

1-2. What a business checks at each layer

The table lists what a business checks at each layer: the question on the left, the task on the right.

Layer	Question	What the business does
1. Device	Is consent needed	List the cookies and separate those needing consent
2. Processing	Are there a basis and a notice	State purposes, recipients and retention in the privacy policy
3. Transfer	Is there a basis for the US transfer	Check that the provider participates in the DPF
Across	Can you record and withdraw	Keep a record of consent and provide a way to withdraw

What this shows is that introducing GA4 is not the job of pasting a tag but of making three checks. Pasting a tag takes minutes, but skipping the checks leaves you rebuilding the banner and losing data later.

2. What has happened: from "illegal" reports to the DPF, and an appeal still pending

The lawfulness of GA4 has swung since 2020 through rulings and regulators' decisions. Headlines alone make it hard to tell which moment they describe, so here is a timeline. The first caution is not to read old information as the current situation.

2-1. The flow in a timeline

The last item is dotted because no ruling on the appeal had come out, as far as I could confirm, on 30 October 2026. I do not write something that has not happened as if it had.

2-2. What exactly was held unlawful in 2022

On 10 February 2022, France's CNIL decided that one website operator's use of Google Analytics breached the GDPR because personal data was transferred to the US. The case began with complaints from the organisation noyb, and several European authorities were looking at the same issue.

The point to hold on to is that what was held unlawful was not "the tool Google Analytics" but "the absence of a basis for the US transfer at that time". On 16 July 2020 the Court of Justice (Schrems II) had invalidated the Privacy Shield that had been the basis. The DPF adequacy decision of 10 July 2023 changed the premise.

2-3. What the AP did

The Dutch AP also began an investigation into the use of Google Analytics in 2022. According to the AP's official reply of 13 November 2025, given to inform answers to parliamentary questions, the investigation ended in a reprimand (berisping) to a single party, and the AP has not published a separate decision. Under AP policy, reprimands are not made public.

In the same document the AP explains that the investigation concerned the third version of Google Analytics (the so-called Universal Analytics), and that the issue was the US transfer. It adds that, because the DPF adequacy decision now exists, the earlier investigation cannot simply be applied to current use of GA.

Period	Issue	Situation then	Situation now (checked 30 October 2026)
2020-2023	US transfer	No adequacy decision	DPF adequacy decision in force
2022	CNIL decision	Found no basis for the transfer	The underlying basis has changed
2022 onward	AP investigation (GA3)	Opened	Closed with a reprimand; decision not public
Sep 2025	Action against the DPF	Before the General Court	Dismissed; appeal pending

Reading the table, most of the "illegal" reports describe the pre-DPF situation. But with an appeal pending, you cannot say flatly that it is all settled. Chapter 4 covers that.

3. The Dutch position: what the AP says, and what it does not

The first thing that worries people on Dutch-facing sites is the Dutch-specific idea that analytics cookies need no consent. Dutch rules have indeed been described as looser than those of other countries. Here I set out only what the AP's official pages and documents say.

3-1. The three types of cookie

The AP divides cookies into three: functional cookies, limited analytics cookies, and everything else (tracking cookies and the like).

Type	Examples	Consent	What the owner must do
Functional cookies	Login, language, cart	Not needed	Say that they are placed (e.g. in the privacy notice)
Limited analytics cookies	Visitor counts, most-viewed pages	Not needed if privacy impact is small	If personal data is processed, have a basis and state it
Everything else	Tracking cookies	Needed	Inform in advance of purposes, processors and the right to withdraw

The middle row is what matters. It does not say that every "analytics cookie" needs no consent. The AP's wording is limited analytics with no or little impact on privacy. The AP explains that this is set out in Telecommunications Act article 11.7a.

3-2. How far GA4 is from "limited analytics"

So is GA4 a "limited analytics cookie"? The AP does not settle this in its November 2025 document. It says only that it is examining how much it can say about which cookies fall under the exception, and that when it can answer depends on the shift of supervisory powers.

So as of 30 October 2026, I could not find an official basis for saying "GA4 needs no consent". Nor did I find a document in which the AP states that "GA4 always needs consent". Where the position is unsettled, designing for consent is the safe side for a business. DevNJ does the same on its own site (Chapter 10).

3-3. Who supervises

Another caution is how supervision is divided. According to the November 2025 document, supervision of the cookie provision (Telecommunications Act 11.7a) currently belongs to the ACM (Authority for Consumers and Markets). The AP, after consulting the ACM, has proposed to the Minister of Economic Affairs that this supervision be given to the AP.

Supervision of personal data processing (GDPR) belongs to the AP. For the same cookie, consent is the ACM's matter and data handling the AP's, so the windows differ, which makes it easy to approach the wrong one.

3-4. The nine rules for banners, and the AP's enforcement

The AP has published nine rules on how to build a cookie banner. Violations can lead to warnings and investigations.

Rule	What it means in practice
Inform about processing and purpose	State on the first layer that personal data is processed and why
No pre-ticked boxes	Do not switch consent boxes on in advance
Plain language	What is being chosen is clear on reading
Choices on a single layer	Do not make people go deep to refuse
Do not hide choices	Do not make refusal less visible
Do not require extra clicks	Do not make refusing take more effort than accepting
No inconspicuous links	Do not put key choices in small in-text links
Withdrawal as easy as consent	Withdrawing is as easy as consenting
Do not confuse consent with legitimate interest	Do not ask for consent and continue processing if refused

The nine look like points of appearance, but they are in fact conditions for consent to be valid. The AP says that continuing to scroll or doing nothing cannot count as consent. It also explains that a "cookie wall", which blocks use if cookies are refused, is prohibited under the GDPR.

Since April 2025, the AP has been systematically checking whether Dutch sites collect cookie consent correctly. Its announcement of 11 November 2025 said that it had warned more than 200 sites, that about three-quarters fixed their banners, and that those that did not face investigation or enforcement. As an example of a sanction, on 16 July 2024 AS Watson was fined 600,000 euros for using tracking cookies on the Kruidvat site without consent (the AP's page carries an update dated 12 June 2025 saying the fine was reduced after AS Watson objected; I could not confirm the reduced amount).

4. The EU-US Data Privacy Framework: in force, but still contested

Now the third layer, transfer to the US. This concerns the whole EU, not only the Netherlands. On 10 July 2023 the European Commission adopted the DPF adequacy decision, and transfers of personal data to participating US companies became possible without additional measures.

4-1. Does Google participate in the DPF

Google's official page on data transfer frameworks shows that Google LLC has certified that it adheres to the DPF principles. Google's page for advertising and analytics products also says that since 1 September 2023 it relies on the DPF for transfers of personal data from the EEA to the US. The same page says that in certain cases it may rely on standard contractual clauses (SCCs).

What this tells us is that Google relies mainly on the DPF but has an alternative for when the DPF is unavailable. But this is how Google describes its own transfers. It does not remove the duties that stay with the business using it (consent, notice, records).

4-2. The state of the appeal

French MP Philippe Latombe sought annulment of the DPF. On 3 September 2025 the EU General Court dismissed the action in case T-553/23. Mr Latombe appealed on 31 October 2025, and the case is pending before the Court of Justice as C-703/25 P. The Official Journal published the content of the appeal on 22 December 2025.

As of 30 October 2026, I did not find that a ruling or an Advocate General's opinion on the appeal had been issued. The accurate way to put it is therefore: "the DPF is in force, but the legal possibility of annulment is not zero."

4-3. What a business loses if the DPF falls

Consider, from the business side, the case where the DPF is annulled. This includes conjecture. From past events (Schrems II), what can be said is that if an adequacy decision is invalidated, transfers to the US need another basis, such as SCCs, plus additional assessment. Google says it may rely on SCCs.

The preparation a business can make now is the three items below.

Preparation	Content	Cost feel
Design for consent	Send nothing before consent; needed regardless of the DPF	Once, at design time
Check the provider's contract and certification	Confirm Google's transfer basis once a year	About an hour a year
Reduce dependence on measurement	Also watch metrics that do not rely on cookies, such as Search Console	Half a day at design time

The last row is insurance separate from the transfer issue: keep metrics that do not depend on cookies. Search Console clicks are not affected by consent.

5. Consent Mode v2: what it does and what it does not

Now the technical side. Consent Mode passes the visitor's consent state to Google tags (GA4, Google Ads and others). The name leads people to mistake it for "a feature that collects consent", but neither the screen that asks for consent nor the record of it is Consent Mode's job. Google's technical documentation states that consent mode does not save consent choices.

5-1. The four consent types

Consent Mode v2 handles four consent types.

Type	Meaning	Effect when denied
ad_storage	Storing advertising cookies and similar	No new cookies for advertising purposes
analytics_storage	Storing analytics cookies and similar	GA cookies are not read or written
ad_user_data	Sending ad-related user data to Google	Cannot be used for ad measurement
ad_personalization	Personalised advertising	Cannot be used for personalisation or remarketing

The first two have existed for some time; the last two were added in v2. Google explains that if you measure EEA users with Google tags, you must pass their consent choices to Google. Even a business that does not run ads must, as long as it runs the tags, pass all four values correctly.

GTM also handles functionality_storage, personalization_storage and security_storage in addition to the same four.

5-2. default, update and wait_for_update

Setup rests on two commands. default sets the initial value when the page loads. In Google's documentation it is called on every page of the site, before commands that send measurement data (config or event). update changes the values after the visitor chooses.

If the CMP loads asynchronously, specify wait_for_update in milliseconds to hold tags back. Google's example is 500 milliseconds. This value is the wait until the CMP reads a stored choice and calls update. If it is too short, tags run before a returning visitor's choice is applied.

Step 1 in the figure is the easiest to get wrong. If the default is set after the measurement tag runs, measurement starts before consent. In GTM, place the tag that sets the consent default on the Consent Initialization trigger. This trigger is provided in the container from the start and runs before all other tags.

5-3. Different defaults by region (region)

default can target regions by ISO 3166-2 code. For example, you can set denied as the default for EEA countries and granted elsewhere. A default without a region applies to all visitors not covered by any region-specific default.

But "it is a site for the EU, so EEA codes are enough" is not always true. Google's EU User Consent Policy covers users in the UK and Switzerland as well as the EEA. A site aimed at the Netherlands still receives visitors from the UK. If you narrow by region, check that the UK and Switzerland are in the range.

5-4. Other settings (url_passthrough and ads_data_redaction)

There are two supporting settings. url_passthrough carries click IDs and similar information in the URL when cookies cannot be used. ads_data_redaction hides advertising click IDs from network requests while advertising storage is denied.

Both help preserve measurement accuracy, but using them does not make the consent question go away. The effect of identifiers appearing in URLs needs separate assessment. On sites that do not run ads, DevNJ does not use either by default.

6. Basic and advanced mode: what is sent before consent

Consent Mode can be implemented in two ways: basic and advanced. The choice decides what reaches Google before consent.

6-1. The difference between the two modes

Item	Basic mode	Advanced mode
Loading Google tags	Not loaded until consent	Loaded before consent
Sending before consent	None	Cookieless pings
GA4 modelling	Basically unavailable	Available if conditions are met
Traffic before consent	Does not reach Google	Reaches Google

As the table shows, Google explains that in basic mode Google tags stay blocked until consent, while in advanced mode they load before consent and send cookieless pings when consent is absent. These pings can include the user agent, screen resolution and IP address. Google explains that GA does not log or store IP addresses.

6-2. Is advanced mode legally fine

This is the point practitioners most struggle to decide. To begin with the conclusion, I could not find, among the AP's public materials, anything that directly addresses the lawfulness of Consent Mode advanced mode. Google explains that the pings are coarse information that cannot directly identify a person, but that is Google's explanation, not a regulator's judgement.

The rule on storage on devices (layer 1) asks about storing and reading cookies and the like. By contrast, pings that reach Google carrying an IP address and similar data are assessed separately as processing of personal data (layer 2). That assessment is the business's own responsibility.

DevNJ's approach is as follows. It is a recommendation, not a legal guarantee.

• A site that does not run ads and puts "send nothing before consent" ahead of complete numbers should use basic mode
• Consider advanced mode only for sites that need modelling for ad measurement and have legal sign-off
• In either case, check the traffic before consent on a real screen (Chapter 9)

6-3. When modelling works

The benefit of advanced mode is that GA4 can fill the gaps by modelling. Google's conditions are two. First, at least 1,000 events per day for at least 7 days with consent denied. Second, at least 1,000 daily users on at least 7 of the previous 28 days with consent granted.

In addition, Consent Mode must be on all pages of the site, and Google tags must be set to load regardless of consent. Google says that even when the conditions are met, modelling does not always run.

Site size	Likelihood modelling runs	Practical handling
Small (a few hundred visits a day)	Conditions hard to meet	Read numbers assuming gaps
Medium (a few thousand a day)	Conditions may be met	Record the size of the gap
Large	Conditions easier to meet	Check in the admin screen whether modelling is active

The sizes in this table are DevNJ's own rough grouping based on Google's conditions (1,000 events and 1,000 users a day). On a small business's site, modelling often does not run even in advanced mode, and basic mode is enough in many cases.

7. What must not be sent before consent

Now to put all this in practical terms: "what to hold back before consent". The basic idea is simple: storage and sending that need consent run only after consent.

7-1. The list of what to hold back

Target	Before consent	Reason
Analytics cookies such as _ga and ga*	Do not write	Storage used to tell visitors apart
GA4 measurement requests carrying a client ID	Do not send (basic mode)	Processing involving an identifier
Advertising and remarketing tags	Do not run	Tracking for advertising
Social and video embeds	Do not load, or show a stand-in notice	The provider receives visitor information
External fonts, maps and measurement components	Self-host, or load after consent	The provider receives the IP address
Consent record (CMP cookie)	May run	The record is needed to manage consent
Session items such as CSRF tokens	May run	Needed for the site to work

The bottom two rows are what you need not hold back. Cookies for managing consent and cookies the site needs to function can run before consent. The AP too says functional cookies need no consent, and that stating they are placed is enough.

7-2. Why stopping only cookies is not enough

Some people think "no cookies, so no consent needed", but whether consent is needed is not decided by cookies alone. Article 5(3) of the ePrivacy Directive covers the storing of information on a device and access to information already stored there. Local storage and mechanisms that read device information can be covered even if they are not cookies.

At the GDPR layer, the fact that an IP address or identifier reaches Google is itself assessed as processing of personal data. Even a design without cookies leaves the layer 2 and layer 3 checks.

7-3. Conditions for valid consent

For consent to be valid, it must meet the GDPR definition (article 4(11)): freely given, specific, informed and an unambiguous indication of wishes. In its judgment of 1 October 2019 in Planet49, the Court of Justice held that a pre-ticked box is not valid consent.

The AP's nine rules put this into practice. A design in which refusing takes more effort than accepting damages the validity of consent itself.

8. Setup steps: set defaults to denied with GTM and a CMP

I describe the setup using GTM (Google Tag Manager) with a CMP (consent management platform). DevNJ's own site also uses GTM, so the configuration is the same.

8-1. Steps

1. Inventory the cookies. Use the browser's developer tools to list the cookies the site actually sets and the external requests it makes
2. Choose a CMP. GTM's help lists Cookiebot, OneTrust and Usercentrics among supported CMPs. Check that the reject button can appear on the same layer and look the same as accept
3. Set defaults to denied. In GTM, use the Consent Initialization trigger to set all four consent types to denied. Include the EEA, the UK and Switzerland without fail
4. Connect the CMP. Use the CMP's GTM template or integration so that update is called after the choice
5. Check each tag's consent settings. Google tags have built-in checks that change behaviour with consent. For other vendors' tags, specify the required consent types in additional consent checks
6. Check the GA4 side. In the admin screen's consent settings, look at the share of EEA traffic and the state of consent signals for each data stream
7. Verify on a real screen before release. Do the checks in Chapter 9

8-2. Consent checks per tag

In GTM you can set additional consent checks per tag: "Not set", "No additional consent required", and "Require additional consent for tag to fire".

Setting	Meaning	When to use
Not set	No additional check (default)	Tags not yet reviewed
No additional consent required	Reviewed, no check	Tags needed for function
Require additional consent for tag to fire	Runs only if the specified consent is granted	Analytics, ads and other vendors' tags

"Not set" in the table means an unreviewed tag. If you turn on GTM's consent overview, tags without consent settings appear as a list, so empty that list before release.

8-3. What to look at in a CMP

When choosing a CMP, look not at the number of features but at whether it can meet the AP's nine rules.

What to check	What to look at
Reject button	Does it appear on the first layer at the same size as accept
Pre-ticked boxes	Is everything off from the start
Record of choice	Are the date and choice kept
Withdrawal	Can it be redone from anywhere on screen as easily
Language	Does it appear in the visitor's language (Dutch, English, Japanese)

"Record of choice" in the table also overlaps with Google's EU User Consent Policy, which asks that records of consent be kept. You have not only collected consent but can later show that you did.

9. Verification: what actually runs after you press "reject"

Settings do not always work as written. Tag order, caching and CMP loading delay can make the behaviour differ from intent. On the consent side, the key is to check in the state after pressing "reject".

9-1. Check in the browser

Open the site in a private window. When the consent banner appears, open developer tools without pressing anything. Look at three things.

Where to look	What you expect before consent
Cookies (Application tab)	_ga and ga* do not exist
Network (Network tab)	No GA4 measurement requests (basic mode)
Requests to external domains	No requests to ad or third-party components

Next press "reject" and look at the same three. The expected result is that the state stays the same as before consent after rejecting. Finally press "accept" and confirm that measurement starts.

9-2. Check in the GA4 admin screen

GA4's admin screen has a consent settings screen. It shows the share of EEA traffic and, for each data stream, the state of advertising-related and behaviour-analytics consent signals. Google says it can take 48 to 72 hours after a site update for the display to refresh.

If a warning appears here, the CMP is not passing Consent Mode values. Even on sites that do not run ads, design so that the values for ad_user_data and ad_personalization are passed.

9-3. Check regularly after release

Consent behaviour breaks when tags are added or the banner is updated. DevNJ recommends checking at the frequencies below. This is DevNJ's operating guideline.

Frequency	What to check
Whenever a new tag is added	That the tag does not run in the rejected state
Whenever the CMP is updated	The banner display and the reject button position
Quarterly	The list of cookies and the wording of the privacy and cookie policies
Once a year	Google's transfer basis and the state of the DPF

10. DevNJ's own site configuration (facts only)

Explanation alone is hard to follow, so here is the configuration of DevNJ's site (dev-nj.com), to the extent it can be known from the templates and published policies. I separate what could be confirmed as fact from what could not.

10-1. What could be confirmed

Item	Content	Confirmed from
Measurement entry point	A Google Tag Manager (GTM) snippet in the head and body of every page	The site's templates
How the GTM ID is held	Managed in a config file and an environment variable; not output if unset	The site's templates and config
Consent management	Uses Cookiebot	The published cookie policy
Consent tag	Cookiebot consent tag and Consent Mode configured inside the GTM container	Read the publicly served GTM container (gtm.js) and confirmed (30 October 2026)
Consent record	CookieConsent (Cookiebot) kept for 12 months	The published cookie policy
Analytics cookies	States that _ga and ga* (2 years) do not run until consent	The published cookie policy
Advertising	No advertising cookies and no social-embed tracking	The published cookie policy
Fonts	All served from DevNJ's own server	The published cookie policy
Form protection	reCAPTCHA v3 used only on the contact page	The templates and cookie policy

In the table, what could be confirmed as implementation is that the GTM snippet is in the templates. The templates contain no consent banner script and no Consent Mode default command.

10-2. What could not be confirmed

The templates contain no consent commands because the Cookiebot consent tag and the Consent Mode configuration sit inside the GTM container. I read the publicly served GTM container (gtm.js) on 30 October 2026 and confirmed that a Cookiebot consent tag (the GTM implementation) and Consent Mode settings are present. But I have not been able to confirm from reading alone what the defaults are, or whether anything is sent before consent.

Whether DevNJ's site uses basic or advanced mode is unconfirmed, and this article does not assert it. The points below need to be confirmed in the GTM admin screen and on a real screen.

What to confirm	How
Whether the default is denied	See the Consent Initialization tag in GTM preview
Whether GA4 requests appear before consent	Watch the network in the rejected state (Chapter 9)
Whether the UK and Switzerland are in the default's scope	See the region setting of the default in GTM
Whether GA4 runs only when consent is granted	See the tag's consent check

The implication for readers is to put yourself in a position to run the same checks on your own site. Sites where the container configuration depends on one person and nobody can explain the whole are in fact not rare.

10-3. What this configuration teaches

DevNJ's site is built like many small companies' sites: a dedicated tool for consent, GTM for measurement, self-hosted fonts, no ads. Deciding what not to use makes consent design simplest.

If you do not use an external font service, one check in layer 3 disappears. If you do not run ads, the design for ad_storage and ad_personalization is minimal. The order is to decide the measurement requirement first, then choose the components.

11. When numbers go missing: how to read the impact on measurement

Once you collect consent, GA4's numbers are missing by the amount of visitors who refuse. That is the result of a correct setup. To avoid mistaking the gap for a fault, decide how to read it in advance.

11-1. What goes missing and what does not

Metric	Effect of consent	How to read it
GA4 sessions and users	Refused visits go missing (basic mode)	Look at the trend more than the absolute value
GA4 key events	Refused visits go missing	Keep the actual number of enquiries separately
Search Console clicks and impressions	Not affected	Use as the baseline for search traffic
Contact form submissions	Not affected	Use as the actual number of outcomes

As the table shows, the actual outcome (number of enquiries) and the actual search traffic (Search Console) are not affected by consent. If you set these two as the baseline and treat GA4 as "a tool for seeing behavioural trends", the gaps will not throw you off.

11-2. Record the size of the gap

The size of the gap differs by site. The consent rate depends on banner design, visitors' countries and industry. Rather than borrowing a general figure, measuring and recording your own site's ratio is more reliable.

A simple way is to record weekly the ratio of Search Console clicks to GA4 organic search sessions. If the ratio suddenly changes, suspect a banner or tag fault. This method is covered in detail in "Automating Search Console and GA4 monitoring".

11-3. Supplement outside measurement

You can combine approaches that do not depend on consent. You can put an optional field in the enquiry form asking where the visitor came from, or use server-side counting (counting only page views without identifying individuals). Both need separate assessment of how personal data is handled.

12. Where people stumble

Common failures in real consultations, in a table.

Failure	What happens	Fix
There is a banner, but tags run first	Cookies are written before consent	Put the default tag on Consent Initialization
The reject button is only on the second layer	Consent may be judged invalid	Show it on the first layer at the same size
The consent choice is not passed with update	Nothing is measured even after consent	Check the CMP and GTM integration
Only the EEA was set to default denied	UK and Swiss visitors are missed	Match the scope of Google's policy
Map and video embeds load before consent	Visitor information goes to third parties	Load after consent or show a stand-in notice
The cookie policy differs from reality	The duty to inform is not met	Check against the cookie list quarterly
"We added Consent Mode, so we are fine"	The banner, record and notice are missing	Understand Consent Mode as one part

The most common failure in the table is the gap between technical settings and documents (policies). Consent design is complete only once it includes consistency with the policy, not only what is on screen.

12-1. Preventing gaps between policy and implementation

A cookie policy that was right when written becomes wrong as soon as one tag is added. DevNJ builds into its procedure that, whenever a tag or component is added, the policy is updated in the same piece of work.

Writing the policy's update date on the page also helps. DevNJ's cookie policy carries an update date too.

13. Where Japanese businesses come into scope

When a Japanese company runs a site for the EU, thinking that "the GDPR does not concern a Japanese company" is a mistake. Article 3(2) of the GDPR provides that it applies to businesses outside the EU when they offer goods or services to people in the EU, or monitor their behaviour in the EU.

13-1. Clues that you are in scope

Whether there is an intention to offer to people in the EU is read from how the site is built. The main clues are below.

Clue	Example more likely in scope	Example less likely in scope
Language	Pages in Dutch, German and so on	Japanese only
Currency	Prices shown in euros	Yen only
Delivery or service area	Delivery to EU countries advertised	Japan only
Promotion	EU-targeted ads or appeals to EU residents	Promotion aimed at Japan only

The table lists example clues, and these alone do not decide whether you are covered. It is a case-by-case judgement, so check with a specialist if unsure.

13-2. Relation to Japanese law

Japan has its own rules, such as the Act on the Protection of Personal Information. This article covers European rules and not compliance with Japanese law. A site aimed at both Japan and the EU needs both checked.

14. Thinking about effort: where the work goes

"How much effort does consent work take" varies greatly with the state of the site. What follows is DevNJ's way of estimating, not a fixed price.

State	Work	Estimated effort (varies with the state of the site)
CMP and GTM already in place	Check and fix settings, verify on screen, update the policy	4-8 hours
No CMP	Choose and install a CMP, GTM defaults, integration, verification, write the policy	8-16 hours
Many ad and third-party embeds	The above plus per-tag consent checks and stand-in notice	16-32 hours

The CMP tool's own fee is separate. It varies by service and visit volume and can change, so check the provider's official pricing page before adopting one. This article gives no figure. For a DevNJ estimate, ask through the contact page.

14-1. What drives effort up

Three main factors raise the hours. First, many tags. Each tag needs a consent setting and a check. Second, many languages. The banner and policies must be prepared per language. Third, existing settings depend on one person. If nobody can explain the whole, the inventory takes time.

Conversely, using fewer things reduces the hours. No ads, self-hosting external components, keeping fonts in-house: these are the most effective cuts, and they can be decided at design time.

15. Thinking through cases (three fictional people)

From here on, the cases are fictional. They are not real people or companies. They illustrate that the answer changes with the position.

15-1. Three cases

Case	Situation	Recommended design
A: A Dutch ZZP consultant	About 10 pages. No ads. Enquiries are the main outcome	Basic mode. GA4 only for trends. Use Search Console and enquiry count as the baseline
B: A small Japanese e-commerce shop selling to Europe	100 pages. Prices in euros. Considering ads	Install a CMP; use Consent Mode v2 for ad measurement. Advanced mode only after legal review
C: A Japanese B2B company that also publishes for the EU	Mostly Japanese. A few English pages	Collect consent on the range with English pages. Separate settings from Japan-facing pages

Case A is the most common position. A site that relies little on numbers loses little by designing for consent. If anything, a design that sends nothing before consent becomes a value in itself, because it is easy to explain.

Case B involves ad measurement, so the values of ad_user_data and ad_personalization matter. Whether to take the advantage of advanced mode (modelling) or the certainty of basic mode is decided together with legal review.

In case C, whether consent is needed may differ between Japan-facing and EU-facing pages. Separating pages and separating settings makes operation easier.

15-2. Answers by position

The same question gets different answers by position. The table gives answers to common questions by position.

Question	ZZP and small businesses	Businesses that run ads
Is advanced mode needed	Often not	Consider if accurate measurement is needed
We want a higher consent rate	Improve banner wording and presentation	Same, but avoid leading designs
Should we drop GA4	No need to	No need to
Priority	A design that sends nothing before consent	Passing the four consent types correctly

The table shows that efforts to raise the consent rate must not move toward making refusal harder. The AP lists making refusal inconspicuous or adding effort to refuse as things that damage valid consent.

16. What not to do

What not to do	Why
Run the GA4 tag as normal before consent	It means cookie writes and identifier sends before consent
Make the reject button inconspicuous or bury it deeper	Against the AP's rules; consent may be invalid
Treat continued scrolling as consent	The AP does not accept it as valid consent
Block viewing if cookies are refused (cookie wall)	Prohibited under the GDPR
Copy another site's banner text as is	It will not match your own processing
Stop at installing Consent Mode	Records, notice and withdrawal are needed separately
Stop measuring on old "illegal" reports alone	The situation has changed since the DPF
Use the "no consent" exception without checking	Whether GA4 falls under it is undecided

Every row is something people tend to choose because "it is easier to set up" or "the numbers will drop". Accepting the gap in numbers as the result of a correct design is the choice that lasts.

17. Checklist

Check the following before release.

• There is a list of the cookies the site actually sets and the external requests it makes
• In the CMP banner, reject appears on the first layer, looking the same as accept
• No choices are pre-ticked
• Defaults are denied for the EEA, the UK and Switzerland
• The default tag runs on Consent Initialization
• update is called after the choice
• The values for the four consent types (ad_storage, analytics_storage, ad_user_data, ad_personalization) are passed
• In the rejected state, _ga does not exist and no GA4 measurement requests appear (basic mode)
• Measurement starts after consent
• Third-party embeds are not loaded before consent
• The privacy and cookie policies match reality and carry an update date
• Consent is recorded and there is a way to withdraw
• There is no warning in GA4's consent settings screen
• Reading numbers on the assumption of gaps is shared within the company

18. Summary

• GA4 can be used under conditions. Check storage on the device, processing of personal data and transfer to the US separately
• The Dutch "analytics cookies need no consent" is limited to limited analytics. Whether GA4 qualifies is undecided, and designing for consent is the safe side
• The DPF is in force, but an appeal is pending. Consent design is needed regardless of the DPF
• Consent Mode v2 is a part that passes the result of consent to tags. The banner and the consent record are prepared separately
• What to hold back before consent is analytics cookies, identifier-bearing sends, ad tags and third-party embeds. What manages consent and what the site needs to function can run
• Make basic mode the standard and consider advanced mode together with legal review. On small sites modelling often does not run
• Check settings on a real screen in the rejected state. Accept the gap in numbers as the result of a correct design

If you want to talk it through

Consent handling is an area where a gap easily opens between "set up" and "working correctly". DevNJ is based in The Hague, the Netherlands, and supports the building and operation of websites for Europe. The scope can be fitted to the state of your site, from the cookie inventory and CMP and GTM setup to verification on a real screen and preparing the policies.

If you want to start by sorting out where you stand, see our services. If you want to know what to check on your own site, send your site URL and the measurement and consent tools you use through the contact page.

Sources consulted

Dutch authorities

• Cookies — Autoriteit Persoonsgegevens: the three types of cookie, when consent is needed, Telecommunications Act 11.7a
• Clear cookie banners — Autoriteit Persoonsgegevens: the nine rules for banners
• Ambtsbericht Google Analytics (13 November 2025) — Autoriteit Persoonsgegevens: course of the GA investigation, the reprimand, the outlook on a blanket ban, the ACM's powers
• AP: Three-quarters of websites have adjusted their misleading cookie banners — AP (11 November 2025): warnings to over 200 sites and about three-quarters fixed
• AP warns 50 organisations about misleading cookie banner — AP (15 April 2025): start of systematic checks
• AP launches campaign to help organisations develop sound cookie policy — AP (2 December 2025): call to review cookie policies
• Decision on fine AS Watson - Kruidvat — AP (16 July 2024): 600,000-euro fine for tracking cookies; an update dated 12 June 2025 mentions a reduction after objection

EU law, rulings and data transfers

• Directive 2002/58/EC (ePrivacy) — EUR-Lex: article 5(3)
• Regulation (EU) 2016/679 (GDPR) — EUR-Lex: articles 3, 4(11) and 7
• Planet49 (C-673/17) — EUR-Lex: a pre-ticked box is not valid consent
• Schrems II (C-311/18) — EUR-Lex: invalidation of the Privacy Shield
• European Commission adopts new adequacy decision (10 July 2023) — European Commission: the DPF adequacy decision
• EU-US data transfers — European Commission: overview of the DPF
• Notice of the Latombe appeal — Official Journal of the EU: the appeal against T-553/23
• European Court of Justice to Review Challenge to EU-U.S. Data Privacy Framework — WilmerHale: the General Court judgment and the appeal (law firm commentary)
• Utilisation de Google Analytics et transferts de données — CNIL: the February 2022 decision
• CNIL decides EU-US data transfer to Google Analytics illegal — noyb: commentary by the complainant organisation

Google specifications

• Set up consent mode on websites — Google for Developers: consent types, default and update, wait_for_update, region
• Consent mode — Google Analytics Help: basic and advanced mode, cookieless pings
• Behavioral modeling for consent mode — Google Analytics Help: modelling conditions
• Verify and update consent settings — Google Analytics Help: the consent settings screen
• Data retention and IP addresses — Google Analytics Help: handling of IP addresses
• Consent mode in Tag Manager — Tag Manager Help: Consent Initialization, per-tag consent checks
• Updates to consent mode for traffic in the EEA — Google Ads Help: ad_user_data and ad_personalization
• EU User Consent Policy — Google: the EEA, the UK and Switzerland, records of consent
• Data transfer frameworks — Google: Google LLC's DPF certification
• Advertising and analytics products: international data transfers — Google: reliance on the DPF since 1 September 2023, SCCs

DevNJ public information

• Cookie Policy — DevNJ: the cookies the site uses and how consent is handled
• Automating Search Console and GA4 monitoring — DevNJ: how to watch numbers after launch and how to treat gaps from consent

All were checked on 30 October 2026. The ruling on the appeal, the transfer of powers between the AP and the ACM, and Google's specifications may change. Check the official pages for the latest before deciding on settings. This article is not legal advice; where an individual judgement is needed, check with a lawyer or other specialist.

---

For help checking consent handling on your site, or building and operating a website for Europe, get in touch through our services or the contact page.