Can I use Google Analytics without a cookie banner?

In the US, state law does not require one, though you must disclose GA4 and honor opt-outs if data is shared for advertising. In the EU, GA4 needs consent for its cookies. Consent mode does not remove the banner; it changes what Google collects when visitors refuse.

Does consent mode make GA4 cookieless?

Only for visitors who deny consent. Then tags store no cookies and send cookieless pings to Google instead. Visitors who accept get the normal _ga cookies.

Google Analytics without a cookie banner: your options

In the US, no state law requires an opt-in banner before Google Analytics 4 runs, but its data goes to Google, which raises opt-out and CIPA questions. In the EU, GA4’s cookies need consent; consent mode only changes what Google collects after a refusal. Running without a banner there usually means a different tool.

Updated October 25, 2026

What GA4 sets and sends

Cookies: _ga (2 years, distinguishes users) and _ga_<container-id> (2 years, keeps session state). Linking a Google Ads account adds advertising cookies.
Data sharing: with the “Google products & services” setting on, Google can analyze your data and use it to improve Google products and services, such as Google Ads tools.
IP addresses: Google says GA4 does not log or store IP addresses of users in the EU, Switzerland or the UK; it derives coarse location (city, region, country) from them.
Consent mode: when consent is denied, tags do not store cookies and send “cookieless pings” with a minimum of information instead.

Where GA4 needs a banner

GA4 and consent, by region
Region	Banner before GA4?	Why
United States	Not required by state law	Opt-out model: disclose it in the privacy policy; if data is shared for cross-context advertising, offer “Do Not Sell or Share” and honor Global Privacy Control
European Union	Yes	GA4 stores identifiers on the device, and its sharing settings let Google use the data for its own products, which audience-measurement exemptions such as the CNIL’s rule out
United Kingdom	Only if the exception fits	The 2026 exception covers storage used only for statistics about your own service; check GA4’s sharing and advertising settings against that test with counsel

In the US the open question is CIPA, not consent law. GA4 sends visit data to Google, a separate company: the third-party pattern behind pen-register suits (Shah v. Fandom). Google was among the trackers named in the Kaiser case. SB 690 removes private pen-register suits from 2027; section 631 wiretap claims remain.

Your options

Ways to run analytics, with or without a banner
Option	Banner	Trade-off
Keep GA4 behind a consent banner, with consent mode	Yes	Works in every region and is a consent defense to CIPA claims; you lose detail on visitors who refuse
Keep GA4 without a banner (US-only audience)	No	Disclose it, consider switching off Google products & services sharing and Ads links, honor opt-outs; third-party data flow to Google remains
Switch to a cookieless analytics vendor	Depends on region and configuration	Check what it stores on the device, whether it uses your data for itself, and whether it records replay or typed text
Self-host open-source analytics	Depends on configuration	Data never leaves you, the strongest position under the party exception; you run the servers
Server-log analytics, no client script	Least likely to need one	Least to consent to, but least detail; the EDPB’s IP-tracking reading can still apply

Editor’s pick:OnyxMetric

If you are replacing a tracker, OnyxMetric is the tool this guide picks. What it does by default:

Its script sets no cookies.
With the default settings it does not keep IP addresses and salts visitor IDs daily.
Session replay and form tracking stay off until you turn them on; most options are configurable per site.
It can run through a first-party proxy on your own domain.
Its privacy policy says data is never sold, shared with advertisers or used for model training.
It is hosted on AWS in the United States.
When session replay is on, it masks form inputs.

Try OnyxMetric free for 7 daysmade by this guide’s publisher

Disclosure: OnyxMetric is made by the publisher of this guide. It is recorded with the same field marks as every other tool, and links to it carry a referral tag so we can count visits.

Questions

Can I use Google Analytics without a cookie banner?: In the US, state law does not require one, though you must disclose GA4 and honor opt-outs if data is shared for advertising. In the EU, GA4 needs consent for its cookies. Consent mode does not remove the banner; it changes what Google collects when visitors refuse.
Does consent mode make GA4 cookieless?: Only for visitors who deny consent. Then tags store no cookies and send cookieless pings to Google instead. Visitors who accept get the normal _ga cookies.

Sources

This note is general information compiled from public sources, not legal advice. Laws and cases change; ask your own counsel before you rely on it.