Article · June 17, 2026
Do you need consent to use GA4 on Vietnamese websites?
GA4 on Vietnamese websites may require consent under the PDPL/Decree 13. Learn banner setup, configuration, and consent evidence.
Quick answer
Do you need consent to use GA4 on Vietnamese websites?
Yes, in most cases you should seek consent before running GA4, because GA4 often results in collecting personal data or data that can be used to identify individuals, under the consent rules in Decree 13/2023/ND-CP and the anticipated compliance posture when the Personal Data Protection Law (Law 91/2025/QH15) is expected to take effect from 01/01/2026.
The key point is not the tool’s name, but how you configure it. If GA4 is only loaded after the user clicks “Agree,” you will find it easier to demonstrate compliance. If GA4 runs immediately on page load, you risk having to justify the legal basis, clearly disclose purposes, and prove that users were properly informed.
A practical example: a Vietnamese online shop uses GA4 to measure conversions, track traffic sources, and remarketing. Even if the data appears “anonymous” at the report level, you are still processing on-site behavioral data. Therefore, a consent banner and separate accept/decline controls for analytics are more appropriate than “letting GA4 run by default.”
When is consent required for GA4?
You should treat consent as necessary when GA4 or related tags:
- set cookies or similar identifiers in the browser;
- track user behavior across multiple pages/sessions;
- are combined with Google Ads, remarketing, enhanced measurement, or other tags;
- transfer data to third parties for analytics/measurement.
Conversely, if you only use truly aggregated, non-identifying data, with no cookies and no linkage to an account or device, the risk is lower; however, with a standard GA4 setup on an e-commerce website, most businesses should still deploy a consent banner and keep analytics off by default until consent is given.
| Scenario | Should you request consent? | Suggested practice | |
|---|---|---|---|
| GA4 runs on page load | Yes | Block scripts/tags until consent | |
| GA4 only enabled after “Agree” click | Yes, but stronger compliance | Store consent logs, allow withdrawal | |
| GA4 combined with remarketing/ads | Strongly recommended | Separate analytics/marketing in the banner | |
| Only aggregated, non-identifying measurement | Requirements may be reduced, depending on setup | Review carefully with legal counsel |
How to implement GA4 under the PDPL/Decree 13?
Follow the steps below to reduce compliance risk:
Data inventory:
List what GA4 collects: cookies, events, client ID, IP, page path, traffic source, conversions.
Define purposes:
Separate analytics, marketing, UX optimization, and fraud prevention. Do not lump everything under one consent button.
Design the consent banner:
Provide “Agree,” “Decline,” and “Preferences”; avoid an agree-only pattern.
Block tags before consent:
Configure GTM/GA4 so analytics tags fire only after consent; avoid “preload then ask.”
Store evidence:
Record timestamp, banner version, user choices, and session ID to prove consent.
Allow withdrawal:
Provide a control in the footer/cookie settings; when withdrawn, stop firing new tags as required.
Update policies:
State the data types, purposes, recipients, retention period, and contact details.
What should a GA4 consent banner include?
At minimum, the banner should have four parts:
- a brief notice about using cookies/analytics;
- a link to the privacy policy;
- accept and reject buttons with equal prominence;
- a control to manage choices by cookie/tag category.
Sample short copy you can use:
“We use cookies and analytics tools like GA4 to measure traffic and improve your experience. You can accept, reject, or choose per data category. Your choices will be saved.”
For websites with multiple conversion flows, separate “Analytics” and “Marketing.” If you bundle them, it will be hard to prove users understood what they agreed to.
Do you need to keep evidence of consent?
Yes. This is what many dev teams overlook most. It’s not enough to “ask for consent”; you must be able to prove that consent was given freely, specifically, with sufficient information, and was recorded.
You should store evidence data such as:
- the time when the user made their choice;
- the banner/policy content version;
- choices per category;
- minimum page source and device information for audit;
- withdrawal status, if any.
If you use a consent management platform or your own code, make sure logs do not expose excessive data yet remain sufficient for checks by competent authorities.
What should you do first if GA4 is already installed?
If GA4 is already running, prioritize three tasks:
- audit all tags firing via GTM/gtag;
- temporarily block analytics by default for new visitors;
- add a consent banner, privacy policy, and consent logs.
If your business has Vietnamese user data—especially in e-commerce, SaaS, education, or recruitment—treat this as urgent work before the Personal Data Protection Law (Law 91/2025/QH15) is expected to take effect. For complex scenarios like cross-border transfers, sensitive data processing records, or measurement combined with multi-platform advertising, consult a lawyer to finalize your implementation.
- Typically yes, especially when GA4 sets cookies, tracks behavior, or is combined with advertising/remarketing. The safe approach is to activate it only after users agree.
- If GA4 still collects cookies or identifying/session data, you should still seek consent under the rules. Do not rely solely on the purpose of “viewing metrics” to conclude consent isn’t needed.
- It should. For cookies/analytics, users should be able to accept, decline, or choose per data category, and declining should be as easy as accepting.
- Yes. You should keep consent logs to prove the time, content, and the user’s choices when audited or in disputes.
If you’re implementing a cookie banner, storing consent evidence, or need a DSAR flow for your website, consent.vn can help you design it for both SMEs and dev teams.
Source: the Personal Data Protection Law (Law 91/2025/QH15) and Decree 13/2023/ND-CP on thuvienphapluat.vn; enforcement authority Ministry of Public Security (A05) on bocongan.gov.vn
Get started — no account needed.
Ready to comply with PDPL?