Google Analytics and consent in ecommerce

What you need to know

Review how Google tags load, the default consent state and whether tracking stays blocked before consent where required.

Combine source-code review with browser tests: no choice, reject all and accept. Document which tags fire in each state.

What Merqivio does with this

The Cookie & Privacy Scan connects these signals to concrete pages, evidence and priority. The Fix Plan adds remediation steps.

When is consent relevant to analytics?

The legal assessment depends on the technology and purpose. Non-essential storage or access on a device is governed by Article 5(3) of the ePrivacy Directive; where personal data are processed, a valid GDPR legal basis is also required. Consent must be freely given, specific, informed and unambiguous.

What should happen before a choice?

Check that non-essential analytics and marketing tags remain technically blocked until the required choice has been made. Showing a banner is not the same as blocking tracking.

What must a sound consent flow support?

Visitors need a genuine and understandable choice. Where processing relies on consent, consent must be demonstrable and withdrawal must be as easy as giving it. Test accept, reject, category preferences and later changes.

How should Google Analytics be tested?

Use a clean browser session and test at least three states: before any choice, after rejecting all, and after accepting. Inspect network requests, cookies and browser storage and record which Google tags activate in each state. Consent Mode is a technical mechanism; it does not by itself make an incorrect consent flow compliant.

Why is a privacy policy alone insufficient?

The written policy must match actual technical behaviour. If it says analytics starts only after consent while tags transmit data on the first page load, policy and implementation do not match.