# How to set up Google Analytics 4 with Cookiequiet

> Keep the Google tag loading, but make sure the Cookiequiet snippet with data-consent-mode="1" sits above it and that Google's default consent block runs before the tag: Google Analytics 4 then receives analytics_storage denied until the visitor accepts and sets no _ga cookie before that. If you prefer not to load GA4 at all before consent, mark its two script tags with type="text/plain" and data-cq-category="analytics".

Source: https://cookiequiet.com/platforms/google-analytics-4
Published: 2026-10-20
Publisher: Cookiequiet

## Steps

1. **Get the Google tag** In Google Analytics, open Admin, then Data streams, click your web stream, then View tag instructions and Install manually. Copy the snippet, which starts with the Google tag comment.
2. **Choose between Consent Mode and marking** Consent Mode loads the tag with analytics_storage denied and lets Google model the missing data; marking keeps the tag from loading at all until consent. Pick one for the site.
3. **Consent Mode: order the head** Paste the Cookiequiet snippet first, then Google's default consent block (every type denied except security_storage, wait_for_update 500), then the Google tag, immediately after the opening head tag as Google recommends.
4. **Marking: change the two script tags** Give both the external gtag.js script and the inline configuration script type="text/plain" and data-cq-category="analytics". Cookiequiet runs them when analytics is granted.
5. **Remove the tag from CMS fields** If your platform prints the Google tag from a settings field (Shopify, Squarespace, Wix, Webflow, HubSpot), remove the ID there so the tag is only printed where you control it, as described in each platform guide.
6. **Verify in Tag Assistant** Open the site in Tag Assistant: the Consent tab must show analytics_storage denied on the first event and granted after Accept all. Google Analytics also lists the consent status of your streams under its consent settings.
7. **Test with Reject all** In a private window, click Reject all and check that no _ga or _ga_ cookie is set. Accept all, reload, and confirm the cookies and the Realtime report. Both choices appear in the consent log.

## Two ways to run GA4 behind a banner

**Consent Mode (advanced implementation).** The Google tag loads on every page with `analytics_storage` set to denied. In that state GA4 does not read or write its first-party cookies and sends cookieless pings, coarse events without identifiers, which Google uses for behavioural modelling to fill the gap in your reports. When the visitor accepts analytics, Cookiequiet sends the update, GA4 sets `_ga` and `_ga_XXXXXXX` and measures normally. Head order:

```html
<script src="https://cookiequiet.com/cq.js" data-site="YOUR_SITE_KEY" data-consent-mode="1" data-auto-block="1" defer></script>
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('consent', 'default', {
    ad_storage: 'denied',
    ad_user_data: 'denied',
    ad_personalization: 'denied',
    analytics_storage: 'denied',
    functionality_storage: 'denied',
    personalization_storage: 'denied',
    security_storage: 'granted',
    wait_for_update: 500
  });
</script>
<!-- Google tag (gtag.js) -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX"></script>
<script>
  gtag('js', new Date());
  gtag('config', 'G-XXXXXXX');
</script>
```

Cookiequiet pushes the same denied defaults the moment it runs; the inline block is there so that the default is in the data layer even on a long page where the asynchronous Google tag could run before the deferred snippet. Google says the defaults do not work when called after the tag.

**Marking (basic implementation).** Nothing of GA4 loads before consent. Change the two script tags and leave the rest untouched:

```html
<script type="text/plain" data-cq-category="analytics" src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX"></script>
<script type="text/plain" data-cq-category="analytics">
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('js', new Date());
  gtag('config', 'G-XXXXXXX');
</script>
```

Cookiequiet activates them when analytics is granted, at once on later visits where the stored choice includes it. No pings, no modelling: the reports only contain consenting visitors. Google warns that blocking the tag until consent means it cannot model the missing data, which is the trade-off.

Which one? Consent Mode gives Google more data about visitors who refused (cookieless pings still reach Google's servers), and gives you modelled numbers. Marking sends nothing before consent. Some supervisory authorities read the analytics exemption narrowly; the article on [analytics without consent](/blog/analytics-without-consent) walks through the positions.

## What Cookiequiet sends to the Google tag

| Category in the banner | Consent Mode types |
| --- | --- |
| analytics | analytics_storage |
| marketing | ad_storage, ad_user_data, ad_personalization |
| functional | functionality_storage, personalization_storage |

The update is sent after each choice and on every page load where a choice is stored. Where the banner is not shown because of geo-targeting (for example US visitors on a site that shows the banner in regulated countries only), every category is granted at once, so GA4 measures those visitors as before.

## Where the tag comes from

GA4's own instructions say to paste the Google tag immediately after the opening head tag; with Cookiequiet, "immediately after" becomes "right after the snippet and the default block". If a platform prints the tag for you from a settings field, that copy is outside your control: remove the ID there and paste the tag yourself. The platform guides give the field for [Shopify](/platforms/shopify), [Squarespace](/platforms/squarespace), [Wix](/platforms/wix), [Webflow](/platforms/webflow) and [HubSpot](/platforms/hubspot-cms). With Google Tag Manager, the GA4 tag uses its built-in consent checks; see the [Tag Manager guide](/platforms/google-tag-manager).

## How to verify and test

1. Open the site in Tag Assistant (Google's Tag Manager preview tool works for gtag too). On the first event, the **Consent** tab shows `analytics_storage` denied, from the default. After **Accept all**, an update row shows it granted.
2. In Google Analytics, the consent settings page in Admin lists whether your streams receive consent signals; Google's "Verify and update consent settings" article explains the statuses.
3. In a private window, click **Reject all**: no `_ga` cookie. Clear, click **Accept all**, reload: `_ga` and `_ga_XXXXXXX` are set and the Realtime report shows the visit within a few minutes.
4. The Cookiequiet dashboard shows the consent rate, which tells you how much of your traffic GA4 now measures with consent; the article on [consent rates](/blog/cookie-consent-rates-what-to-expect) gives benchmarks.

## Details that trip people up

- **Google Signals and Ads features** in GA4 also depend on `ad_storage`, `ad_user_data` and `ad_personalization`, which Cookiequiet grants with the marketing category. A visitor who accepts analytics but refuses marketing is measured without advertising features.
- **Both script tags** must be marked, not only the external one; an unmarked inline `gtag('config')` would queue a hit that fires as soon as the library loads.
- **Cookie lifetime.** `_ga` lasts two years by default; the cookie table in the banner lists it, and the scanner names it when it finds the tag.
- **Server-side tagging** changes where the data goes, not whether the visitor consented: the same signals apply.

## Questions

### Is analytics_storage the only signal GA4 needs?

For measurement, yes. Google Signals, audiences and the advertising features of GA4 also read ad_storage, ad_user_data and ad_personalization, which Cookiequiet grants with the marketing category.

### Will my GA4 traffic drop after installing the banner?

Measured sessions drop to the share of visitors who accept analytics, typically well above half with an honest banner. With Consent Mode, Google adds modelled data for the rest once the property reaches its data threshold; with marking, it does not.

### Does Reject all stop every request to Google?

With the marked setup, yes: the tag never loads. With Consent Mode, the tag loads and sends cookieless pings without cookies or identifiers, as Google documents; choose marking if you want nothing sent before consent.

### My CMS prints the Google tag from a settings field. What do I do?

Remove the ID from that field and paste the tag yourself below the Cookiequiet snippet, marked or with the default consent block. The platform guides give the exact field for Shopify, Squarespace, Wix, Webflow and HubSpot.

## Sources

- [Google Analytics Help: Consent mode in Google Analytics](https://support.google.com/analytics/answer/9976101)
- [Google Analytics Help: Set up Google Analytics for a website and/or app](https://support.google.com/analytics/answer/9304153)
- [Google: Set up consent mode on websites](https://developers.google.com/tag-platform/security/guides/consent)
- [Google Analytics Help: Verify and update consent settings](https://support.google.com/analytics/answer/14275483)