Google Analytics 4 (GA4) is the default analytics platform for most ecommerce stores. It uses cookies like _ga and _ga_* to distinguish users and track behavior across sessions. Under GDPR and similar privacy laws, analytics cookies are not strictly necessary—which means you need user consent before GA4 collects data from EU and UK visitors.
How GA4 Uses Cookies
GA4 sets first-party cookies on your domain to identify returning visitors, measure sessions, and attribute traffic sources. It also sends event data—page views, purchases, scroll depth—to Google's servers. Even though GA4 can run without third-party cookies in some configurations, the first-party cookies it sets still require consent under EU law.
- _ga: distinguishes users (default 2-year expiration)
- _ga_*: stores session state for GA4 property
- Event collection: page views, ecommerce events, custom events
- Google Signals: cross-device tracking when enabled (requires additional consent)
- Advertising features: remarketing audiences when linked to Google Ads
GDPR Requirements for GA4
EU data protection authorities have consistently ruled that analytics cookies require opt-in consent. The French CNIL, Austrian DSB, and others have issued guidance specifically addressing Google Analytics. You must block GA4 from firing until users accept analytics cookies, provide a reject option equal to accept, and document consent.
IP anonymization is not enough
GA4 no longer relies on IP anonymization settings from Universal Analytics. Consent must be obtained before any GA4 data collection begins, regardless of IP handling.
Google Consent Mode v2
Google Consent Mode v2 lets your site communicate consent status to Google tags. When users deny analytics cookies, GA4 operates in a limited mode without cookies, using cookieless pings for aggregate modeling. When users accept, full tracking resumes. Google requires Consent Mode v2 for ads personalization in the EEA and UK as of 2024.
- Set default consent state to denied for analytics_storage and ad_storage
- Update consent state when the user accepts or rejects cookie categories
- Pass consent signals before Google tags load using gtag or Google Tag Manager
- Verify Consent Mode is active in GA4's Admin → Data collection settings
- Test that denied consent prevents _ga cookies from being set
Implementing GA4 with Cookie Consent on Shopify
Remove GA4 from unconditional positions in theme.liquid and Shopify's Google & YouTube channel until you have consent gating in place. Route GA4 through Google Tag Manager with Consent Mode triggers, or use a compliance tool that handles both blocking and consent signal updates automatically.
Setup steps
- Audit where GA4 is installed—theme code, GTM container, Shopify channel, apps
- Remove or disable unconditional GA4 loading
- Configure your cookie banner to categorize GA4 under analytics cookies
- Implement Consent Mode v2 with default denied state
- Load GA4 only after analytics consent or via Consent Mode's cookieless mode
- Test with browser DevTools to confirm no _ga cookies before consent
GA4 and Google Ads Together
Many stores link GA4 to Google Ads for conversion tracking and remarketing. This means both analytics_storage and ad_storage consent parameters matter. If a user accepts analytics but rejects marketing, GA4 can run in analytics-only mode while ad personalization stays disabled. Map your cookie categories to the correct Consent Mode parameters.
Cookie Policy Disclosures for GA4
Your cookie policy must name _ga and related cookies, explain that data is sent to Google LLC, describe the purpose as website analytics, and state retention periods. If you enable Google Signals or Ads linking, disclose those data flows as well.
Simplifying GA4 Compliance
Managing Consent Mode v2 and policy updates manually is error-prone. StoreComply sets Google Consent Mode defaults from your banner, provides deferred GA4/Meta install snippets, and logs visitor choices. Remove unconditional tracking code from your theme so tags only load after consent.
Verifying Your Setup Works
- Use GA4 DebugView with consent denied—confirm limited data collection only
- Check browser cookies after rejecting analytics—no _ga cookies should appear
- Accept analytics and verify _ga cookies are set and events appear in DebugView
- Use Google Tag Assistant to confirm Consent Mode parameters are passed correctly
- Re-test after any theme update, app install, or GTM container change