Article · June 17, 2026
Do you need a cookie banner if you only use Google Analytics?
Using Google Analytics typically still requires a cookie banner because it uses non-essential cookies and may trigger obligations under the PDPL.
Quick answer
Do you need a cookie banner if you only use Google Analytics?
Yes, in most cases you should still have a cookie banner. The reason is that Google Analytics typically uses cookies to measure, track sessions, traffic sources, and user behavior. These are not “essential” cookies for basic website operation like a shopping cart, login, or session security.
If you aim to comply with the Personal Data Protection Law (Law 91/2025/QH15, expected to take effect 01/01/2026), the safe approach is to treat GA as a data processing activity that must be notified and managed by consent under the regulations. With the PDPL, businesses should not assume that “having a privacy policy is enough.”
Why does Google Analytics trigger the need for a cookie banner?
Google Analytics may collect online identifiers, device data, referrers, click events, and other behavioral signals. Even if you don’t store a name or phone number, this data can still relate to a specific user or a specific device.
The important point is: a cookie banner isn’t just “a pretty notice,” it’s where you:
- Notify the types of cookies you use
- State the measurement/analytics purpose
- Let users accept or decline non-essential cookies
- Record and store evidence of consent, if any
For GA, you should also prepare a description of sharing data with the third party Google, depending on your deployment configuration and internal policy.
When might a banner not be required?
If a website only uses essential cookies for basic operation, for example:
- Preserving login state
- Session security
- Remembering language or necessary technical choices
then you may not need a banner in the sense of “asking consent for all cookies.” But with Google Analytics, this scenario usually does not apply because GA is not an essential cookie.
In short: do you need a cookie banner if you only use Google Analytics — the practical answer is yes, if you want strong compliance and reduced legal risk.
What should businesses do when only using GA?
Review what GA collects:
Check cookies, events, IP masking, data retention, and supporting integrations like Google Ads or Tag Manager.
Classify cookies:
Separate essential cookies from analytics cookies. GA usually falls under analytics/non-essential.
Implement a banner based on explicit consent:
Users should have “Accept” and “Decline” buttons, with nothing enabled by default.
Block GA before consent if needed:
Technically, don’t let GA run before the user consents, if your configuration depends on consent.
Store evidence of consent:
Log timestamp, choices, banner version, and a consent ID so you can demonstrate compliance during inspections.
Update the privacy policy:
Clearly state measurement purposes, providers, how to withdraw consent, and how to contact you.
Prepare processes to handle user requests:
If a user asks to delete data, objects to measurement, or wants to access their data, you need someone responsible.
What are the risks if there is no cookie banner?
The main risk isn’t just “missing a popup.” The problem is you may be unable to prove that users were properly informed and consented to non-essential cookies.
Under Law 91/2025/QH15, violations can be handled under the Government’s guiding decree; serious cases may be subject to criminal liability. The enforcement authority is the Ministry of Public Security, specifically the Department of Cybersecurity and High-Tech Crime Prevention (A05). If a data incident occurs, notification obligations usually must be fulfilled within 72 hours of discovery.
For SMEs, common mistakes include:
- Enabling GA as soon as the page loads
- No “Decline” button
- Not logging consent
- Not updating the cookie policy when changing tag configurations
Sample cookie banner content for a website that only uses Google Analytics
You can use the short template below and adjust it to your actual setup:
Cookie notice We use cookies to operate the website and analyze traffic. Analytics cookies, including Google Analytics, help us understand how you use the website to improve your experience. You can accept or decline non-essential cookies.
Buttons:
- Accept
- Decline
- Cookie settings
Description in the cookie policy: This website uses Google Analytics to measure traffic and improve content. Analytics cookies are only activated according to your settings/consent, if applicable under the current configuration. You can change your choices at any time in Cookie settings.
FAQ
- Usually yes, because GA4 may still use cookies or similar mechanisms to measure and analyze visits. You should have a banner and a consent management mechanism as required.
- You should still reassess. Even without names, website analytics data may be personal data or data related to an individual under a broader legal interpretation, so you shouldn’t assume an exemption.
- You should include both. For non-essential cookies like GA, a clear refusal mechanism improves transparency and reduces compliance risk.
- No. GA is a measurement tool, while the cookie policy explains what you collect, why you collect it, who receives the data, and how users can exercise control.
If you are implementing a banner, storing proof of consent, or DSAR processes, consent.vn can help you standardize faster for SME websites.
Source: the Personal Data Protection Law (Law 91/2025/QH15); Decree 13/2023/ND-CP — thuvienphapluat.vn, A05 — bocongan.gov.vn
Get started — no account needed.
Ready to comply with PDPL?