How to set up Google Analytics 4 with Cookiequiet

Two ways to run GA4 behind a banner

Consent Mode (advanced implementation). The Google tag loads on every page with analytics_storage set to denied. In that state GA4 does not read or write its first-party cookies and sends cookieless pings, coarse events without identifiers, which Google uses for behavioural modelling to fill the gap in your reports. When the visitor accepts analytics, Cookiequiet sends the update, GA4 sets _ga and _ga_XXXXXXX and measures normally. Head order:

html
<script src="https://cookiequiet.com/cq.js" data-site="YOUR_SITE_KEY" data-consent-mode="1" data-auto-block="1" defer></script>
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('consent', 'default', {
    ad_storage: 'denied',
    ad_user_data: 'denied',
    ad_personalization: 'denied',
    analytics_storage: 'denied',
    functionality_storage: 'denied',
    personalization_storage: 'denied',
    security_storage: 'granted',
    wait_for_update: 500
  });
</script>
<!-- Google tag (gtag.js) -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX"></script>
<script>
  gtag('js', new Date());
  gtag('config', 'G-XXXXXXX');
</script>

Cookiequiet pushes the same denied defaults the moment it runs; the inline block is there so that the default is in the data layer even on a long page where the asynchronous Google tag could run before the deferred snippet. Google says the defaults do not work when called after the tag.

Marking (basic implementation). Nothing of GA4 loads before consent. Change the two script tags and leave the rest untouched:

html
<script type="text/plain" data-cq-category="analytics" src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX"></script>
<script type="text/plain" data-cq-category="analytics">
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('js', new Date());
  gtag('config', 'G-XXXXXXX');
</script>

Cookiequiet activates them when analytics is granted, at once on later visits where the stored choice includes it. No pings, no modelling: the reports only contain consenting visitors. Google warns that blocking the tag until consent means it cannot model the missing data, which is the trade-off.

Which one? Consent Mode gives Google more data about visitors who refused (cookieless pings still reach Google's servers), and gives you modelled numbers. Marking sends nothing before consent. Some supervisory authorities read the analytics exemption narrowly; the article on analytics without consent walks through the positions.

What Cookiequiet sends to the Google tag

The update is sent after each choice and on every page load where a choice is stored. Where the banner is not shown because of geo-targeting (for example US visitors on a site that shows the banner in regulated countries only), every category is granted at once, so GA4 measures those visitors as before.

Where the tag comes from

GA4's own instructions say to paste the Google tag immediately after the opening head tag; with Cookiequiet, "immediately after" becomes "right after the snippet and the default block". If a platform prints the tag for you from a settings field, that copy is outside your control: remove the ID there and paste the tag yourself. The platform guides give the field for Shopify, Squarespace, Wix, Webflow and HubSpot. With Google Tag Manager, the GA4 tag uses its built-in consent checks; see the Tag Manager guide.

How to verify and test

1. Open the site in Tag Assistant (Google's Tag Manager preview tool works for gtag too). On the first event, the Consent tab shows analytics_storage denied, from the default. After Accept all, an update row shows it granted.
2. In Google Analytics, the consent settings page in Admin lists whether your streams receive consent signals; Google's "Verify and update consent settings" article explains the statuses.
3. In a private window, click Reject all: no _ga cookie. Clear, click Accept all, reload: _ga and _ga_XXXXXXX are set and the Realtime report shows the visit within a few minutes.
4. The Cookiequiet dashboard shows the consent rate, which tells you how much of your traffic GA4 now measures with consent; the article on consent rates gives benchmarks.

Details that trip people up

• Google Signals and Ads features in GA4 also depend on ad_storage, ad_user_data and ad_personalization, which Cookiequiet grants with the marketing category. A visitor who accepts analytics but refuses marketing is measured without advertising features.
• Both script tags must be marked, not only the external one; an unmarked inline gtag('config') would queue a hit that fires as soon as the library loads.
• Cookie lifetime. _ga lasts two years by default; the cookie table in the banner lists it, and the scanner names it when it finds the tag.
• Server-side tagging changes where the data goes, not whether the visitor consented: the same signals apply.