Google Analytics without a cookie banner

By Edward Grundy · updated 1 October 2026

The cookie banner on most UK websites exists because of Google Analytics. This guide explains which law requires it, what changed in February 2026, and the options for measuring a site with fewer consent prompts or none.

It describes the regulations as we read them. It is not legal advice.

Two laws apply to analytics, and they ask different questions.

UK GDPR governs personal data: anything that identifies a person, directly or indirectly. It requires a lawful basis for processing, which for analytics is often legitimate interests.

PECR regulation 6 governs storing information on, or reading information from, a visitor’s device. It applies whether or not the information is personal data, and before February 2026 its only exception was for storage strictly necessary to provide the service the visitor asked for. Analytics was never treated as strictly necessary, so analytics storage needed consent.

The cookie banner is a PECR consent mechanism. Removing it is a PECR question first.

What Google Analytics 4 stores

The GA4 tag sets first-party cookies, by default:

_ga, a client identifier with a two-year lifetime.
_ga_<container-id>, which holds session state for the property.

The client identifier persists across visits so that a returning visitor is counted as the same user. That persistence is what makes GA’s user, retention and audience reports work, and it is the storage regulation 6 covers.

Google’s consent mode lets the tag adjust to the visitor’s choice. When analytics storage is denied, the tag sets no analytics cookies. In the advanced implementation it still sends cookieless pings, and Google models the behaviour of visitors who declined. Consent mode version 2 has been a requirement for using Google’s advertising features with visitors from the UK and EEA since March 2024.

Consent mode reduces what is stored when a visitor declines. It still relies on a consent prompt to ask.

What changed in February 2026

The Data (Use and Access) Act 2025 amended PECR. Since 5 February 2026, regulation 6 includes further exceptions from consent, one of them for statistical purposes. Storage is exempt where:

its sole purpose is collecting information about how the service is used, with a view to making improvements to the service;
the information is not shared with anyone except to help make those improvements;
the visitor is given clear and comprehensive information about the purpose; and
the visitor is given a simple, free means of objecting, and does not object.

This is an opt-out model for first-party improvement analytics. The ICO’s detailed guidance on the new exceptions is the place to confirm how they apply.

Does Google Analytics fit the exception

It depends on configuration, and the sharing condition is the one to examine. The questions to answer for a GA4 property:

Purpose. Is the data used only to understand and improve the site? A property linked to Google Ads, with Google signals or audiences enabled, uses analytics data for advertising.
Sharing. Does Google use the data for any purpose beyond helping you improve the site? That depends on your data sharing settings and the terms you have accepted.
Objection. Can a visitor turn measurement off simply and for free?

A GA4 property used purely for site improvement, with advertising links and data sharing turned off, presents a different case from one feeding Google Ads. Sites outside the UK, or with visitors from the EU, remain under the ePrivacy rules, where the exemptions differ by country.

The options

Keep the banner. Run GA4 with consent mode. This is the established position, and it is the one to keep if GA feeds your advertising.

Use the exception with GA4. Turn off advertising features and data sharing, document the purpose, publish the information, and provide an objection mechanism. Confirm the position against ICO guidance before removing the banner.

Use analytics with no persistent identifier. A tool that stores nothing beyond the visit, uses the data only for site improvement, and processes it as your processor sits squarely within the purpose of the exception. You still provide the information and the means of objecting.

Use server logs. Request logs held on your own server involve no storage on the visitor’s device. They record requests, not behaviour on the page.

How Clientlog approaches it

Clientlog sets no cookies. Its only device storage is one sessionStorage key holding an identifier such as 1782693098872-7xzwuxbzd, which lasts for one tab and one visit and is derived from nothing about the device.

Purpose. The data reports on how the site is used: journeys, landing pages, exits, and the conversions you define in rules.
Sharing. Bay Information Systems processes the data on your behalf to provide that reporting. Nothing reaches an advertising platform unless you enable a conversion relay, which is a separate decision with its own consent position.
Information. Your privacy notice describes the measurement. The privacy page gives the details to draw on.
Objection. The client’s respectDoNotTrack option disables all logging when the browser sends Do Not Track. A site-level opt-out control gives visitors a second route.

A privacy notice entry

A starting point, to adapt to your own notice:

This site measures how pages are used with Clientlog, to improve the site. It records the pages visited, clicks, scroll depth and time on page, with browser type and approximate location. It sets no cookies and keeps no record that links one visit to another. The data is processed by Bay Information Systems in the UK on our behalf. To turn measurement off, [describe your opt-out].

Checklist

List every script that stores anything on the visitor’s device.
For each, record its purpose and who receives the data.
Separate improvement analytics from advertising.
Keep consent for anything used for advertising.
For improvement analytics, publish the information and provide an objection mechanism.
Check the result against current ICO guidance.

Installation is covered in the quickstart.