Introduction
Get GA4 Consent right on EU-facing sites: collect a real analytics opt-in (with Reject), set Consent Mode v2 denied defaults before gtag/GTM, gate every GA4 path, and prove with a clean-session scan that Measurement ID traffic does not run before choice.
What it means
GA4 Consent is not a Google setting name alone—it means Measurement ID tags must not set analytics cookies or send cookied hits until the visitor grants analytics (or you have a documented lawful basis that your counsel accepts).
Consent Mode v2 supports GA4 Consent but does not replace the banner: set analytics_storage (and ad_* when Ads/remarketing exist) to denied before any gtag.js, GTM container, or theme GA4 snippet executes on first paint.
Map CMP categories explicitly: analytics → analytics_storage; marketing → ad_storage, ad_user_data, and ad_personalization. Reject all must keep analytics_storage denied and keep GA4 blocked across navigations.
In GTM, replace All Pages GA4 Config / event tags with consent-aware triggers; put Consent Initialization (or an equivalent early consent default) above tags that read consent state.
Audit duplicate paths: hardcoded gtag('config') in themes, Shopify/WordPress plugins, landing-page builders, and server-side clients that still fire from the browser can bypass a “fixed” GTM container.
Basic vs advanced: cookieless pings under denied Consent Mode may still appear in Network—distinguish them from cookie-setting hits, and confirm your legal stance covers the mode you enable.
Verification loop for GA4 Consent: private window → no _ga before interaction → Reject stays silent → Accept analytics grants analytics_storage and then allows hits → rescan the same production URL with GDPRChecker.
Why it matters
Pre-consent GA4 is one of the highest-frequency scanner findings and a common NGO/complaint screenshot (_ga on first paint).
Consent Mode coverage is a crowded competitor topic; a practical GA4 Consent page that separates analytics gating from Ads CMP badges helps teams ship the path that actually clears scans.
Correct GA4 Consent improves trust and data quality: granted states reflect real opt-ins, denied states avoid identifiers you cannot lawfully retain or activate.
Common mistakes
- Treating Consent Mode v2 as “GA4 Consent done” while GA4 still loads and sets cookies before any click.
- GA4 Config tag on All Pages with no consent requirement in GTM.
- Consent defaults placed after the first gtag/GTM bootstrap so the first hit races ahead.
- Granting ad_* signals when the user only enabled analytics (or the reverse).
- Verifying only Accept in a browser that already consented yesterday.
- Fixing GTM but leaving a second Measurement ID in the theme or a plugin.
- Using modeled conversions in Google UI as proof that first-load defaults were denied.
- Scanning staging while production still serves cached HTML without the guard.
Practical checklist
- Inventory every GA4 / gtag / GTM / plugin path that can load the Measurement ID on homepage and campaign URLs.
- Insert Consent Mode v2 defaults (denied) before GTM/gtag in <head>; confirm order with View Source on production.
- Gate GA4 tags on analytics consent; wire Accept, Reject, and preference changes to consent update for all four v2 parameters you use.
- Remove or defer hardcoded GA4 snippets and plugin injectors that bypass the CMP.
- Private window + Network: filter google-analytics / gtag / googletagmanager — no cookied GA4 before interaction.
- Reject all: no _ga after two internal navigations; Accept analytics only: analytics_storage granted, ad_* stay denied if marketing stayed off.
- Publish, purge CDN if needed, run GDPRChecker on the live URL, and archive the report ID with the fix date.
How GDPRChecker helps
GDPRChecker’s free scanner loads your page as a first-time visitor and flags Google Analytics / GA4 requests and cookies before consent—so you can validate GA4 Consent on the real HTML, not only in Tag Assistant after Accept.
Runtime protection can block configured analytics endpoints until the visitor grants the analytics category, then release tags with Consent Mode updates aligned to banner choices.
Rescan after every GTM publish or theme deploy to catch regressions that reintroduce pre-consent GA4.