No, not for visitors in the EEA. GA4 sets cookies and processes personal data (identifiers, IP address, behaviour), so it needs prior consent under GDPR and Romanian Law 506/2004. You can keep some data without cookies through Google Consent Mode v2, but "normal" cookie-based analytics only starts once the visitor accepts.
Is it legal to fire GA4 without a banner?
In short: no, not for traffic from the European Economic Area. Google Analytics 4 is not a "neutral" tracker — it sets cookies (_ga, _ga_<ID>) and processes data that, under GDPR, is personal: client identifiers, IP address, navigation events. Processing this for statistics is not "strictly necessary", so it needs a legal basis — and in practice that basis is prior consent.
Law 506/2004 (Romania's ePrivacy transposition) requires informed consent before storing non-essential cookies. Analytics falls squarely into the non-essential category. So a GA4 that fires on page load, before any click, collects data with no legal basis — even if "nobody is looking". Any visitor can file a free complaint with ANSPDCP, and GDPR fines reach €20 million or 4% of global turnover.
What does GA4 store and collect?
To understand why it needs consent, look at what it actually leaves in the browser and what it sends on:
| Cookie / data | Role | Duration |
|---|---|---|
_ga | Uniquely identifies a visitor (client ID) | ~2 years |
_ga_<ID> | Holds session state for a GA4 property | ~2 years |
| IP address | Used for geolocation (even when truncated) | At collection |
| Page events | Views, clicks, scroll, conversions | At collection |
All of this ties back to a person (even if pseudonymised), so it is personal data. Want to see what your site sends right now, before consent? A free scan shows you whether _ga fires before the click — the single most common violation we find.
Consent Mode v2: basic vs advanced
Since March 2024, Google requires Consent Mode v2 for Ads features and remarketing in the EEA. Consent Mode does not replace consent — it tells Google whether you have consent and adapts behaviour. There are two modes:
| Mode | Before consent | What you get |
|---|---|---|
| Basic | GA4 does not load at all; no signal leaves until accept | Zero data from those who don't accept; simpler to implement |
| Advanced | GA4 loads but without cookies; sends anonymous cookieless pings | Modelled aggregate data even from those who reject; nothing identifiable |
In both cases, the four signals must be sent correctly: ad_storage, analytics_storage, ad_user_data, ad_personalization. The implementation detail is in our guide on Consent Mode v2 in Romania.
What do you lose and keep with gated analytics?
The main fear is "I'll lose all my data if I block GA4 until accept". In practice:
- You keep full, cookie-based data from visitors who accept — that is, most of them, if the banner is designed correctly.
- You keep, in advanced mode, a modelled estimate of the traffic that rejects, via the cookieless pings.
- You lose individual, cookie-based tracking of those who reject — exactly what you are not legally allowed to do anyway.
In other words, the "data" you would have without a banner is data collected illegally. A properly blocked GA4 gives you numbers you can defend, not ones that trigger a complaint.
How to configure it right, step by step
Setting up a compliant GA4 without losing the data that matters:
- Block GA4 until consent. The script must not fire before the click — showing a message over it is not enough.
- Send all four Consent Mode v2 signals. Set the default state to "denied" and update it to the visitor's real choice.
- Verify the result. Use the free Consent Mode v2 checker and the browser's Network tab.
- Document the cookies. Your cookie policy must list
_gaand its purpose.
A CMP like FewCookies does steps 1–2 out of the box: it blocks scripts until consent and sends all four signals, with a banner and policies in Romanian and English, at €6/month (tax included, 7-day trial without a card). Whatever you do, start from a free scan — if you see _ga firing before the click, you already have the problem you need to fix. See also how to handle the Meta Pixel under GDPR, because marketing trackers have even stricter rules.
Frequently asked questions
Can I use GA4 without cookies and without a banner?
You can run GA4 in "advanced" mode with Consent Mode v2, which sends cookieless pings before consent. But you still need a banner: cookieless pings do not let you set GA4 cookies without accept, and the banner is what collects consent for full tracking.
Does IP anonymisation make GA4 legal without consent?
No. Even with a truncated IP, GA4 sets identifying cookies and processes other personal data. Consent is required for storing non-essential cookies under Law 506/2004, regardless of what you do with the IP.
What is the real risk if I let GA4 fire before accept?
You collect data with no legal basis, which breaches both GDPR and Law 506/2004. Any visitor can file a free complaint with ANSPDCP, which can order you to comply and impose fines of up to €20 million or 4% of global turnover.
Want to see which cookies and trackers fire on your site before consent? The scan is free and needs no account. Check your site for free →