Does POPIA Require a Cookie Banner for Google Analytics?

Why Google Analytics data can be personal information

Google Analytics counts visitors by giving each browser a random ID and saving it in a cookie. Google's own cookie list describes the main one, _ga, as "Used to distinguish users", and it lasts two years by default. That ID doesn't carry a name. It doesn't need to.

POPIA's definition of personal information covers information relating to an identifiable person, and it lists "location information, online identifier or other particular assignment to the person" by name. A cookie ID that follows one browser from visit to visit is exactly that kind of assignment. So the safe reading is that Google Analytics collects personal information about your visitors, and the Act's rules apply.

What POPIA actually asks for

The claim you'll often see online, "POPIA requires an opt-in cookie banner", goes further than the Act does. What the Act asks for is a lawful reason, honesty about what you collect and care when the data leaves the country. A banner is the usual way to meet the first one.

Section 11 does list other grounds, including the legitimate interests of the business. Some people argue that basic, anonymous-leaning analytics fits there. The Act doesn't settle it for cookies, and a visitor can object to processing on that ground at any time, on reasonable grounds. Consent avoids the argument, and it's the ground Google's Consent Mode and cookie banners are built around. If you rely on consent, remember the other half of section 11: a person "may withdraw" it at any time. Your site needs a way to change the choice later, not only on the first visit.

One section that doesn't apply here is section 69. It covers direct marketing by email, SMS and similar messages, not analytics. Our guide to sending email from your app covers where it does apply.

Consent Mode v2, in plain words

Consent Mode is Google's way for your site to tell Google's tags (the small scripts Google Analytics and Google Ads add to your pages) what the visitor agreed to. Your code sends one message when the page loads (the default, before any choice) and another when the visitor chooses (the update). Google's tags adjust what they do to match.

For Google's own tags, version 2 uses four settings. For a site that only uses Google Analytics, the one that matters is analytics_storage, which Google describes as enabling storage "related to analytics, for example, visit duration". The other three, ad_storage, ad_user_data and ad_personalization, cover advertising. Setting all four to denied by default costs you nothing, and it covers you if an ad tag is added later.

Order is everything. Google's setup guide says "The order of the code here is vital. If your consent code is called out of order, consent defaults won't work." The default has to be set before Google Analytics loads. This is what that default looks like; you don't need to write it, but you should be able to spot it at the top of your pages:

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('consent', 'default', {
    'analytics_storage': 'denied',
    'ad_storage': 'denied',
    'ad_user_data': 'denied',
    'ad_personalization': 'denied'
  });
</script>

Basic or advanced Consent Mode: which fits POPIA

Google offers two ways to run Consent Mode, and they behave very differently before the visitor chooses.

In Google's words, basic mode means you "prevent Google tags from loading until a user interacts with a consent banner", while in advanced mode tags "send measurements without cookies" while consent is denied. Advanced mode gives you more data, but something still goes to Google before the visitor has said yes. If your aim is consent before tracking, basic mode is the plain fit: no choice, no Google Analytics.

Either way, Consent Mode doesn't ask for consent. Google says so directly: "You are responsible for obtaining users' consent", through a banner or another consent tool. Consent Mode only passes the answer on.

What a good banner does

• Nothing runs before the choice. No Google Analytics request and no _ga cookie until the visitor clicks accept.
• Accept and decline look alike. Same size, same prominence, same number of clicks. A tiny grey "decline" link next to a big green button isn't a voluntary choice.
• It says what it's for. One or two plain sentences, and a link to your privacy notice.
• The choice sticks. A visitor who declined isn't asked again on every page, and a visitor who accepted isn't asked again every visit.
• It can be changed. A link in the footer, or anywhere easy to find, lets someone reopen the choice and withdraw consent.

How to check it yourself

You don't need to read code for this. Open your live site in a private browser window, so no earlier choice is remembered, and open your browser's developer tools (usually F12, or right-click and "Inspect"). Two panels matter: the one that lists network requests, and the one that lists the site's cookies.

1. Before clicking anything, look for requests containing "google-analytics" or "googletagmanager", and for cookies starting with _ga. With basic Consent Mode there should be none.
2. Click decline and reload the page. Still none.
3. Open a fresh private window, click accept and reload. Now the requests and the _ga cookie should appear.
4. Look for the way to change your mind, and try it.

If anything from Google appears in step 1 or 2, the default isn't set early enough or the script loads regardless of the choice. Send your AI what you saw, word for word.

What isn't possible

• A banner doesn't make the site compliant on its own. It covers the lawful reason. You still need the privacy notice and a written ground for sending data abroad.
• Consent Mode only controls Google's tags. A Facebook or TikTok pixel, a chat widget or an embedded video player sets its own cookies. Each one has to wait for the same choice, and your AI has to wire that in separately.
• You can't count the people who decline. With basic mode, visitors who say no never reach Google Analytics. Your numbers will be lower than your real traffic, sometimes a lot lower. That's the cost of asking first.
• Your AI can't see your live site. It can write the banner and the loading order. Only the check above tells you it works.
• A guide isn't legal advice. If your site handles health, financial or children's information, have a South African data-protection lawyer look at your whole setup.

The prompt to give your AI

Copy this into your AI coding agent's chat. It asks for a plan first, so you can check it against this guide before any code changes.

I'm not a coder. I want to add Google Analytics 4 to my
site, but only for visitors who agree to it. My
measurement ID is [G-XXXXXXXXXX]. Don't write any code
yet. First give me a plan that covers:

1. A Consent Mode default with analytics_storage,
   ad_storage, ad_user_data and ad_personalization all
   set to 'denied', placed before any Google tag on
   every page.
2. Basic Consent Mode: the Google Analytics script only
   loads after the visitor clicks Accept.
3. A cookie banner with Accept and Decline buttons of
   equal size and prominence, and a link to my privacy
   notice.
4. Where the choice is saved, so the banner doesn't
   return on every page or visit.
5. A link, for example in the footer, that reopens the
   choice so a visitor can change it.
6. Every other script on the site that sets cookies or
   sends visitor data (pixels, chat widgets, embedded
   videos), and how each one waits for the same choice.
7. Which files you will change.

If you're not sure about something, say so.

What to check in the AI's answer

• The default comes first. The consent default must sit above the Google Analytics script, not after it or inside a file that loads later.
• Nothing says 'granted' by default. The word "granted" should only appear in the part that runs after Accept.
• Google Analytics loads only after Accept. If the plan loads it on every page and "blocks" it afterwards, that's advanced mode. Ask for basic.
• Decline is a real button. Not a smaller link, not hidden behind "settings".
• Other scripts are listed. If it says there are none, check your site's pages for embeds you added yourself.
• There's a way to change the choice later. If the plan has no link to reopen the banner, ask for one.

Then run the check above on the live site. The Custom Prompt Builder helps if you'd rather start from what you want in your own words.