Managing Consent for Analytics Cookies

Overview

Analytics cookies present a unique compliance challenge: they are among the most widely deployed non-essential cookies, yet many organizations depend on them for business intelligence. The ePrivacy Directive Article 5(3) requires consent for analytics cookies (they are not strictly necessary for the service requested by the user), confirmed by the Planet49 ruling. However, some Data Protection Authorities — notably the CNIL — have explored whether analytics can qualify for a consent exemption if configured with sufficient privacy safeguards. This skill covers compliant analytics implementation, consent mode fallback behavior, and alternatives that reduce or eliminate the need for consent.

GA4 Privacy Configuration

Privacy-First GA4 Setup for Pinnacle E-Commerce Ltd

Configure GA4 with maximum privacy protections:

GA4 Property Settings:

GA4 Data Stream Settings:

Consent Mode Integration

GA4 behavior changes based on analytics_storage consent state:

When analytics_storage = granted:

• _ga cookie set (client ID persisted)
• _gid cookie set (session distinction)
• Full event data collected
• User-level and session-level reporting available
• Real-time reports populated

When analytics_storage = denied:

• No analytics cookies set
• Cookieless pings sent to Google (if Consent Mode enabled)
• Pings include: timestamp, page path, user agent, referrer, consent state
• Pings do NOT include: client ID, session ID, user ID
• GA4 uses behavioral modeling to estimate metrics from these pings
• Modeled data appears in reports with a "modeled" badge

Behavioral Modeling Thresholds

For GA4 to provide modeled data for non-consenting users:

If thresholds are not met, GA4 reports will show only consented users — creating an undercount.

Analytics Without Consent — CNIL Exemption Criteria

CNIL Cookie Exemption for Audience Measurement

The CNIL published guidance (September 2020, updated June 2021) identifying limited conditions under which audience measurement cookies may be exempt from consent under ePrivacy Article 5(3). This is an interpretation specific to French law (transposition of ePrivacy Directive) and is not universally accepted across all EU member states.

CNIL Exemption Conditions:

CNIL-Exempt Analytics Tools:

The CNIL maintains a list of analytics solutions that can be configured to meet exemption criteria:

GA4 Cannot Qualify for CNIL Exemption Because:

1. Data is processed by Google (a third party)
2. Data may be combined with other Google services
3. Data is transferred to the United States
4. Google retains control over processing purposes

Implementing Matomo as CNIL-Exempt Alternative

For Pinnacle E-Commerce Ltd, deploy Matomo alongside GA4:

Matomo CNIL-Exempt Configuration:

Dual Analytics Architecture:

Page Load
    │
    ├── Always fire (no consent needed):
    │   └── Matomo (CNIL-exempt configuration)
    │       └── Basic pageview, session, referrer data
    │
    └── Fire only with analytics consent:
        └── GA4 (full measurement)
            └── Enhanced measurement, events, conversions

This gives Pinnacle E-Commerce Ltd baseline analytics for all users (via Matomo) and richer data for consenting users (via GA4).

Aggregate Reporting Alternatives

Privacy-Preserving Measurement Approaches

Server-Side Log Analytics

The most privacy-preserving approach uses existing server access logs:

Available Metrics from Access Logs:

Limitations:

• No client-side event tracking (clicks, scrolls, form interactions)
• No session stitching across pages (without cookies)
• No conversion attribution
• Bot traffic must be filtered (estimated 30-50% of web traffic)

Consent Rate Impact Analysis

Typical analytics consent rates observed across industries:

Pinnacle E-Commerce Ltd Expected Impact: With a CNIL-compliant equal-prominence banner, expect approximately 45-55% analytics consent rate. This means:

• GA4 direct measurement covers ~50% of users
• Consent Mode behavioral modeling recovers ~20-30% of lost data
• Combined coverage: ~70-80% of actual traffic
• Matomo (CNIL-exempt) provides 100% coverage for basic metrics

Key Legal and Technical References

• ePrivacy Directive 2002/58/EC, Article 5(3) — Consent required for analytics cookies (not strictly necessary)
• CJEU Case C-673/17 (Planet49) — Active consent for all non-essential cookies including analytics
• CNIL Deliberation No. 2020-091 (17 September 2020) — Cookie guidelines including audience measurement exemption
• CNIL Guidelines on Audience Measurement Exemption (June 2021) — Conditions for consent-exempt analytics
• EDPB Guidelines 05/2020 on Consent — Analytics cookies require consent under GDPR
• Google Analytics 4 Privacy Documentation — GA4 data controls, consent mode, data retention
• Matomo GDPR/CNIL Compliance Guide — Self-hosted configuration for consent exemption
• Austrian DPA Decision (December 2021, DSB D155.027) — Found Google Analytics non-compliant with GDPR due to US data transfers
• CNIL Decision on Google Analytics (February 2022) — Ordered website to comply or cease using GA; US transfer concern