Every agency pitch deck has the same slide: “GDPR-compliant tracking setup.” What it actually means, almost without exception, is: we will bolt a consent banner onto your site because that’s what everyone does.
Nobody asks the more interesting question: do you need the thing the banner exists to protect?
The banner is not the law. The tool is.
Cookie banners aren’t a legal requirement. They’re a UX pattern that grew up around a specific class of tools — tools that read or write to a visitor’s device, or ship personal data to a third country for that third party’s own purposes. § 25 TTDSG (Germany’s cookie law) doesn’t say “show a banner.” It says: don’t access information on someone’s device without consent, unless it’s strictly necessary for the service they asked for.
Google Analytics needs a banner because Google Analytics needs consent. Not the other way around. The banner is a symptom. Most agencies treat the symptom and never touch the disease.
The tool you picked is the problem you’re solving
Ask yourself what you’re actually buying when you install GA4:
- Behavioral analytics you could get, cookieless and IP-anonymized, from Matomo or Plausible — no consent required, no banner required, full stop.
- Conversion tracking for ads — which, contrary to what every agency will tell your client, does not require Google Analytics. The Google Ads conversion tag does that job on its own, natively, with no GA4 dependency whatsoever.
- Remarketing audiences — the one piece that genuinely needs a Google-specific pixel, because only Google’s own tag can write to Google’s own ad-serving identity graph.
Two of these three don’t need Google. One doesn’t need consent at all. Only the third — showing ads back to people who already visited you — actually requires what a banner is for.
So why is almost every WordPress site in Germany running GA4 with a banner bolted on the front door, blocking the page for every single visitor, to protect a use case (remarketing) that maybe a third of those visitors will ever be eligible for?
The banner is failing at its own job
In Germany, the average marketing-cookie opt-in rate is 36% — the lowest in the EU, against an EU average of 46%.[^1] And when a site actually offers a real, symmetric “Reject All” button (as German courts increasingly require), rejection climbs even further — recent studies put it at roughly half to two-thirds of visitors once that option is genuinely visible.[^2]
So the banner: annoys 100% of visitors, blocks the page for 100% of visitors, and in exchange, unlocks the tracking it was built for on roughly a third of them. The other two-thirds get modeled, statistically-guessed data standing in for the real thing — studies on real “Reject All” banners report 40–70% fewer usable tracking data points once genuine rejection is possible.[^3] That’s data quality any agency worth its invoice would reject if it came from anywhere else.
You paid the full UX cost. You got a third of the reward. That’s not a compliance tool. That’s a bad trade.
“But Consent Mode makes GA4 cookieless”
No. Cookieless is not the same as consent-free. GA4’s Advanced Consent Mode, when a visitor declines, doesn’t stop tracking — it switches to anonymous “ping” signals and statistically models the rest.[^4] In its default setting, that signal still carries the visitor’s IP address to Google’s servers before any consent is given[^5] — precisely the kind of transfer German and other EU data authorities have treated as requiring consent in the first place. “Cookieless” here is a technical footnote on a banner you still have to show.
This is the industry’s favorite trick: rebrand the same requirement with a friendlier word and sell it as a fix.
What building without a banner actually looks like
- Analytics: Self-hosted, cookieless, IP-anonymized. Matomo or Plausible, EU-hosted, no cross-site profiling. Runs under legitimate interest. No banner, because there’s nothing to consent to.
- Ad attribution: UTM parameters, read by the analytics tool above. Same channel-level insight agencies charge five figures to set up in GA4, with zero Google dependency.
- Conversion measurement for ads: The native Google Ads conversion tag — direct, simpler to set up, and doesn’t require GA4 at all.[^6]
- Remarketing: If — and only if — the business case for retargeting past visitors on Google’s network justifies it, add a scoped, click-triggered consent control for that one feature. Not a blocking modal on page load. A quiet, persistent, opt-in surface that only asks when it’s actually relevant — the same pattern every site already accepts for embedding a YouTube video.
That’s it. No overlay. No “Manage Preferences” maze. No cookie-consent-platform subscription. No visitor forced to make a legal decision before they’ve even seen the page they came for.
Your job is to educate, not to obey
Here’s the part agencies avoid saying out loud: when a client asks for “Google Analytics,” they are not actually asking for Google Analytics. They’re asking for answers — which channel worked, whether the campaign paid off, whether the new page converts. GA4 is just the only brand name they’ve heard, because it’s the only one anyone ever pitched them.
Taking that request literally and installing GA4 because that’s what was said is not client service. It’s order-taking. And order-taking is how a client ends up with a banner blocking their homepage, a US-transfer disclosure in their privacy policy, and a consent-management subscription — to answer a question that Matomo or Plausible would have answered just as well, for the two-thirds of visitors GA4 was modeling blindly anyway.
A client asking for GA doesn’t know what they’re trading away. They don’t know the opt-in math. They don’t know remarketing is the only piece that actually needs a Google pixel. They don’t know “cookieless” doesn’t mean “consent-free.” That’s not a knowledge gap they should be expected to close — it’s the reason they hired someone in the first place.
If you know the tool they asked for creates a worse outcome than the tool they need, and you build it anyway because it’s what was requested, you didn’t serve the client. You served the path of least resistance. The banner on their site tomorrow is the receipt for that choice, and it’s the visitor who pays it — one blocked page load at a time.
Recommending the boring, correct, banner-free stack takes one more conversation than just saying yes. Have that conversation. Every time.
The provocation
Agencies sell banners because banners are billable, defensible, and nobody gets fired for installing one. “Everyone does it” has become its own compliance strategy. But a banner that blocks every visitor to protect a feature two-thirds of them opt out of anyway isn’t due diligence — it’s theater, and the audience has stopped clapping.
If your site doesn’t need Google’s tracking infrastructure, it doesn’t need Google’s consent infrastructure either. Most sites don’t need either. Build for the visitor who just wants the page. The banner was never for them.
Sources
[^1]: Searchlab, Privacy & GDPR Statistics 2026 (citing EDPB, Eurobarometer, IAB Europe, BCG): searchlab.nl/en/statistics/privacy-gdpr-statistics-2026
[^2]: Ignite Video, 29 Studies on Cookie Banners, Consent Rates, Compliance (2026 update): ignite.video/en/articles/basics/cookie-consent-studies
[^3]: Ignite Video, 29 Studien zu Cookie-Bannern, Consent-Raten, Compliance: ignite.video/de/artikel/basics/cookie-studien
[^4]: eRecht24, Ist Google Consent Mode DSGVO-konform?: e-recht24.de/datenschutz/13274-google-consent-mode-dsgvo.html
[^5]: mohrstade, Richtiger Einsatz der Google Consent Mode API: mohrstade.de/whitepaper/richtiger-einsatz-der-google-consent-mode-api
[^6]: MJM Ads, Google Ads Conversion Tracking einrichten: Der komplette Guide (updated July 2026): mjmads.com/de/blog/google-ads-conversion-tracking-einrichten
LittleBig.Co builds infrastructure people actually own — self-hosted, privacy-first, and free of the friction that “best practice” quietly assumes you need.