Is GA4 Really a Necessary Cookie? What the KVKK Approach Says

Updated: 3 September 2026 · Category: KVKK and Digital Compliance

Is GA4 Really a Necessary Cookie? What the KVKK Approach Says

There is no new Personal Data Protection Board decision specific to GA4. However, the Board’s cookie decisions and Guidelines on Cookie Practices show that performance/analytics cookies must be assessed separately from strictly necessary cookies. If no other lawful processing condition applies, they must operate on explicit opt-in consent reflecting the user’s active choice. GA4 implementations must also be assessed for purpose, data minimisation and cross-border transfers.

Contents

Short answer
Why does it matter?
What should companies do?
How should it be measured?
Sources
Frequently asked questions

Short Answer

GA4 should not automatically be classified by product name as a necessary cookie or as a cookie requiring explicit consent in every circumstance. Under KVKK, assess the actual implementation: cookies used, measurement purposes, Google features, personal data flows and whether another lawful processing condition applies. In Decision 2024/1361, explicit opt-in consent was required for the non-essential analytics cookie in that case because no other lawful processing condition applied.

Why Does It Matter?

A common website mistake is substituting a technology name for a legal category. Both “we use Google Analytics, so it is a necessary cookie” and “all analytics use falls under exactly the same legal regime” ignore the actual data-processing architecture. KVKK assessment must examine which data is processed, for what purpose, which cookies or identifiers are used and which third parties receive the data.

In Decision 2024/1361, the Board found operation of the non-essential analytics cookie on the website unlawful without active opt-in: it was not necessary for the service expressly requested by the user and no other lawful processing condition applied. This was not a GA4-specific decision; it shows the need to audit the actual behaviour of web analytics implementations.

Why is GA4 Configuration Important?

Two companies may both use GA4 while having different data flows. One may measure only basic traffic, while the other enables advertising features, cross-domain measurement, User-ID, advanced signals, CRM matching or other integrations. The category name on the cookie banner is therefore insufficient.

Checks must cover both browser cookies and transmitted events and parameters. Prevent unnecessary personal data from being sent through URLs, form fields, query strings or custom events. Server-side tagging does not remove the need for legal assessment; it changes only the technical architecture of the data flow.

What Should Companies Do? Eight-Step KVKK Check for GA4

Perform an actual cookie scan. Examine cookies actually set in production rather than relying on documentation.
Inventory GA4 features. Record advertising features, Google Signals, User-ID, cross-domain measurement and custom integrations separately.
Separate purposes. Do not treat basic measurement, performance analysis, remarketing and advertising optimisation as a single purpose.
Test consent before tags fire. Where explicit consent is required, technically verify that the relevant tags and cookies do not run before the user accepts.
Test the rejection path. Refusal must be as easy as acceptance and effective in practice.
Check event payloads. Prevent unnecessary personal data from being sent in URLs, forms, custom dimensions and event parameters.
Assess cross-border transfers separately. Do not treat cookie consent and the data-transfer mechanism as the same legal act.
Keep version records. Rescan whenever the GTM container, consent settings or analytics configuration change.

How Should a Consent Banner Be Tested?

Displaying the banner is not enough. In a new browser session, observe the network requests sent and cookies set before any preference is selected. Retest analytics and advertising technologies after the user chooses “reject”.

Repeat this test after every major GTM or CMP change. Even if the legal text is unchanged, a technical container update may allow a previously blocked tag to run outside consent controls.

Proposed Measurement Model for B10

Control	KPI	Risk Signal
Before consent	Pre-consent analytics hit count	Unexpected request
Cookie	Unclassified cookie count	Cookie absent from inventory
Rejection	Reject-path technical success	Tags running after rejection
Payload	Unexpected PII parameter count	Unnecessary personal data
Configuration	GA4 feature inventory coverage	Undocumented feature
Transfer	Transfer assessment coverage	Unreviewed data stream

These metrics assess more than the consent banner’s design: they measure whether it actually changes data-processing behaviour.

Expert Assessment

GA4 compliance should classify the processing rather than the product. The same analytics product can create different data, purpose and transfer risks under different configurations. Match the legal team’s cookie table with the technical team’s GTM/GA4 configuration in a shared inventory.

Technical solutions such as Consent Mode or server-side tagging do not by themselves certify legal compliance. Verify on actual traffic which data signals are processed under each consent preference.

Digital Risk and Compliance Analysis

B10 can report actual website cookie/tag scans, GTM and GA4 feature inventories, consent-before-tag tests, event-payload reviews and cross-border data-flow maps in one Web Analytics Compliance Audit.