An analytics cookie is a cookie used to measure visitor behaviour on a website. It enables the collection of statistics such as page views, session duration, traffic sources and navigation flow. Cookies set by tools like Google Analytics belong to this category. Since it is not technically necessary for the site to function, its use requires consent.
Analytics cookies help site owners understand how their site is used: which pages attract interest, where visitors come from, at which step they leave. Although valuable for the business, these cookies work through online identifiers tied to the visitor, so personal data is being processed. Under the the KVKK, the GDPR and the ePrivacy rules framework, analytics cookies are not strictly necessary, because the site works without them; consent must therefore be obtained before they run, and they must stay blocked until it arrives.
The most common mistake is firing analytics scripts on page load without waiting for consent. In a correct setup, analytics is wired to consent management: measurement starts only if the visitor approves the analytics category. For sites using Google tools, Google Consent Mode is the standard mechanism for passing the consent state to Google tags; without consent, some tools can continue limited, cookieless measurement. Practical steps: scan the site to find active analytics cookies, present them as a separate category in the banner, list them in the cookie policy, and use tool settings such as IP masking and shorter retention to support data minimisation.
Frequently asked questions
Do I need cookie consent for Google Analytics?
Yes. Google Analytics cookies measure visitor behaviour through online identifiers, so they are not strictly necessary and require consent. In a correct setup, Analytics writes no cookies until the visitor approves the analytics category. With Google Consent Mode, the consent state is passed to Google tags; without consent, measurement stays limited to cookieless signals.
What data do analytics cookies collect?
Typically a random identifier assigned to the visitor, pages viewed, session duration, traffic source (search, social, direct), device and browser details, and approximate location. Direct identity data such as name or email is usually not collected, but because the identifiers can be linked to a person, the law still treats this data as personal data.
This content is for information only and is not legal advice.