Back to DigiConsent

Analytics Cookies Configuration – Setting Up Google Analytics, GTM, and Tracking

Analytics cookies help you understand how visitors use your website—which pages they visit, how long they stay, where they come from, and how they navigate through your content. This data is invaluable for improving user experience, identifying popular content, and making data-driven decisions. However, analytics cookies track user behavior and require explicit consent under GDPR and similar privacy regulations.

This comprehensive guide covers how to configure the analytics cookies category in DigiConsent, integrate popular analytics services like Google Analytics and Hotjar, and ensure your tracking implementation respects user consent choices.

Understanding Analytics Cookies

Analytics cookies collect data about website usage to help you understand visitor behavior and improve your site.

What Analytics Cookies Do

Analytics cookies typically collect:

  • Page views: Which pages users visit and how often
  • User paths: The sequence of pages visited during a session
  • Session duration: How long users spend on your site
  • Bounce rate: Percentage of users who leave after viewing only one page
  • Traffic sources: Where visitors come from (search, social, direct, referral)
  • Geographic data: Visitor location (country, city, region)
  • Device information: Browser, operating system, screen size, device type
  • Engagement metrics: Scroll depth, clicks, interactions

This information helps you answer questions like: “Which blog posts are most popular?” “Where do users drop off in our checkout process?” “What percentage of visitors are on mobile devices?”

Why Analytics Cookies Require Consent

Under GDPR and ePrivacy regulations, analytics cookies require consent because they:

  • Track behavior: Follow users across multiple pages and sessions
  • Create profiles: Build patterns of user behavior over time
  • Process personal data: IP addresses, browser fingerprints, and behavioral data are personal data
  • Aren’t strictly necessary: Your website functions without them

Even though analytics help you improve your site, they’re not essential for the site to function, so explicit opt-in consent is required in jurisdictions with strong privacy laws.

Analytics vs. Marketing Cookies

It’s important to distinguish analytics from marketing:

Analytics cookies:

  • Help you understand how your site is used
  • Primary purpose is site improvement, not advertising
  • Data typically used internally
  • Examples: Google Analytics, Hotjar, Matomo

Marketing cookies:

  • Track users for advertising and remarketing
  • Build profiles for targeted ads
  • Data shared with advertising networks
  • Examples: Facebook Pixel, Google Ads remarketing, LinkedIn Insight Tag

Some tools blur the line (Google Analytics can feed Google Ads), but generally, if the primary purpose is understanding usage rather than showing ads, it belongs in analytics.

Configuring the Analytics Category in DigiConsent

Set up the analytics cookies category to properly manage consent for all analytics tools.

Category Settings

  1. Navigate to DigiConsent > Settings > Cookie Categories
  2. Find the Analytics Cookies category
  3. Ensure Always Enabled is OFF (users must be able to decline)
  4. Configure the Category Name (“Analytics Cookies” or “Performance Cookies”)
  5. Write a clear Category Description
  6. Set the Default State (denied for GDPR compliance)

Writing the Analytics Category Description

Your description should explain what analytics cookies do in plain language. Example:

“Analytics cookies help us understand how visitors interact with our website by collecting and reporting information anonymously. These cookies help us improve the site by identifying popular content, understanding navigation patterns, and measuring site performance. We use services like Google Analytics to collect this data. You can decline these cookies, and the website will function normally, but we won’t be able to improve your experience based on usage data.”

Key elements to include:

  • What data is collected
  • Why you collect it (improvement, understanding users)
  • Which services you use (Google Analytics, Hotjar, etc.)
  • That declining won’t affect site functionality
  • That data is typically anonymous or pseudonymous

Setting Up Google Analytics with DigiConsent

Google Analytics is the most popular analytics platform. DigiConsent provides multiple ways to integrate it properly.

Google Analytics 4 (GA4)

GA4 is the current version of Google Analytics. Here’s how to integrate it with DigiConsent:

Method 1: Through Google Tag Manager (Recommended)

  1. Install Google Tag Manager on your site (if not already installed)
  2. Create a GA4 Configuration tag in GTM
  3. Enable Google Consent Mode in DigiConsent (see Google Consent Mode setup guide)
  4. GTM will automatically respect consent signals from DigiConsent
  5. When users accept analytics cookies, GA4 begins tracking in full mode
  6. When users decline, GA4 operates in limited mode (if Consent Mode is enabled) or doesn’t load at all

Method 2: Direct gtag.js Integration

  1. Navigate to DigiConsent > Settings > Analytics Cookies
  2. Click Add Script
  3. Paste your GA4 gtag.js code:
<!-- Google tag (gtag.js) -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"></script>
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('js', new Date());
  gtag('config', 'G-XXXXXXXXXX');
</script>
  1. Save the script
  2. This script will only execute when users accept analytics cookies
  3. If you’re using Google Consent Mode, add it before this script in the necessary cookies category

Universal Analytics (Deprecated)

Universal Analytics stopped processing data in July 2023, but if you’re still transitioning:

<script async src="https://www.googletagmanager.com/gtag/js?id=UA-XXXXXXXXX"></script>
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('js', new Date());
  gtag('config', 'UA-XXXXXXXXX', { 'anonymize_ip': true });
</script>

Note the 'anonymize_ip': true parameter, which anonymizes IP addresses for better privacy compliance.

WordPress Plugin Method

If you’re using a WordPress analytics plugin:

  1. Install your preferred GA plugin (MonsterInsights, GA Google Analytics, Site Kit, etc.)
  2. Configure the plugin with your GA4 Measurement ID
  3. In the plugin settings, look for “Consent Management” or “Cookie Consent” options
  4. Disable automatic loading (you want DigiConsent to control when it loads)
  5. Alternatively, add the plugin’s script tag to DigiConsent’s analytics category

Some analytics plugins have built-in consent management that may conflict with DigiConsent. Disable the plugin’s consent features and let DigiConsent handle it.

Setting Up Google Tag Manager

Google Tag Manager (GTM) is a tag management system that makes it easier to manage multiple analytics and marketing scripts.

Installing GTM with DigiConsent

Step 1: Install GTM Container

GTM itself is typically installed as a necessary script since it’s a container that loads other scripts based on consent:

  1. Go to DigiConsent > Settings > Necessary Cookies
  2. Add the GTM container snippet:
<!-- Google Tag Manager -->
<script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
})(window,document,'script','dataLayer','GTM-XXXXXX');</script>
<!-- End Google Tag Manager -->
  1. Also add the noscript portion to your site’s body (theme header.php or via a code snippet plugin)

Step 2: Configure Consent in GTM

  1. In GTM, enable built-in consent variables
  2. Create triggers based on consent state
  3. Set analytics tags to fire only when analytics_storage is granted
  4. DigiConsent sends consent signals via dataLayer that GTM reads automatically

Step 3: Link Analytics Tags to Consent

In GTM, configure your GA4 tag:

  • Trigger: All Pages (or your preferred trigger)
  • Additional Settings → Consent Settings: Require analytics_storage = granted
  • This ensures GA4 only fires when users accept analytics cookies

Setting Up Hotjar

Hotjar provides heatmaps, session recordings, and user feedback tools. It requires analytics consent.

Adding Hotjar to Analytics Category

  1. Navigate to DigiConsent > Settings > Analytics Cookies
  2. Click Add Script
  3. Paste your Hotjar tracking code:
<script>
  (function(h,o,t,j,a,r){
    h.hj=h.hj||function(){(h.hj.q=h.hj.q||[]).push(arguments)};
    h._hjSettings={hjid:YOUR_HOTJAR_ID,hjsv:6};
    a=o.getElementsByTagName('head')[0];
    r=o.createElement('script');r.async=1;
    r.src=t+h._hjSettings.hjid+j+h._hjSettings.hjsv;
    a.appendChild(r);
  })(window,document,'https://static.hotjar.com/c/hotjar-','.js?sv=');
</script>
  1. Save the script
  2. Hotjar will only load when users accept analytics cookies

Hotjar also has consent API support. You can manually call hj('consent', 'allow') when consent is granted, but DigiConsent’s script blocking approach handles this automatically.

Setting Up Other Analytics Tools

DigiConsent works with any analytics platform. Here are integration approaches for popular tools:

Matomo (Self-Hosted Analytics)

Matomo is a privacy-focused, self-hosted analytics alternative:

  1. Add to Analytics Cookies category
  2. Include your Matomo tracking code
  3. Matomo has consent management features; configure it to wait for DigiConsent signals
<script>
  var _paq = window._paq = window._paq || [];
  _paq.push(['requireConsent']);
  _paq.push(['trackPageView']);
  _paq.push(['enableLinkTracking']);
  (function() {
    var u="//your-matomo-instance.com/";
    _paq.push(['setTrackerUrl', u+'matomo.php']);
    _paq.push(['setSiteId', 'YOUR_SITE_ID']);
    var d=document, g=d.createElement('script'), s=d.getElementsByTagName('script')[0];
    g.async=true; g.src=u+'matomo.js'; s.parentNode.insertBefore(g,s);
  })();
</script>

The requireConsent call ensures Matomo waits for explicit consent before tracking.

Plausible Analytics

Plausible is a lightweight, privacy-focused analytics tool:

<script defer data-domain="yourdomain.com" src="https://plausible.io/js/script.js"></script>

Add this to the analytics category. Plausible doesn’t use cookies by default, but it’s still good practice to request consent for behavioral tracking.

Microsoft Clarity

Microsoft Clarity provides heatmaps and session recordings:

<script type="text/javascript">
  (function(c,l,a,r,i,t,y){
    c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)};
    t=l.createElement(r);t.async=1;t.src="https://www.clarity.ms/tag/"+i;
    y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y);
  })(window, document, "clarity", "script", "YOUR_CLARITY_ID");
</script>

Add to analytics category in DigiConsent.

Advanced Configuration Options

Partial Anonymization

Some analytics tools offer anonymization features that may allow you to classify them differently:

IP Anonymization:

  • Google Analytics: 'anonymize_ip': true
  • Removes last octet of IP address
  • Still requires consent under GDPR (anonymization alone isn’t sufficient)

Cookieless Tracking:

  • Some tools offer cookieless modes
  • Uses server-side tracking or sessionStorage instead of cookies
  • May still require consent depending on implementation

Server-Side Analytics

Server-side analytics track page requests on your server rather than in the user’s browser:

  • No cookies or JavaScript in browser
  • Can’t track client-side interactions (clicks, scrolls)
  • Privacy-friendly but limited data
  • May not require consent (consult legal counsel)

Examples include server log analysis, server-side GTM, or privacy-first tools like Fathom Analytics.

Consent Mode Integration for Analytics

When Google Consent Mode is enabled, analytics behavior changes based on consent:

Analytics consent granted:

  • Full Google Analytics tracking with cookies
  • User-level data and sessions tracked normally
  • All reports fully populated

Analytics consent denied (with Consent Mode):

  • Cookieless pings sent to Google
  • No user identification or session tracking
  • Google uses modeling to estimate metrics
  • Aggregated data only, no individual user paths

This allows you to maintain some analytics visibility even when users decline, while fully respecting their privacy.

Testing Analytics Cookie Implementation

Thoroughly test your analytics setup to ensure it respects consent:

  1. Clear all cookies and cache
  2. Visit your site without accepting cookies
  3. Open browser DevTools → Application → Cookies
  4. Verify no analytics cookies are set (no _ga, _gid, _gat, etc.)
  5. Check Network tab for analytics requests—should be none or cookieless Consent Mode pings
  6. Accept analytics cookies in the banner
  7. Verify analytics cookies now appear
  8. Check Google Analytics Real-Time to confirm tracking is active
  9. Test reject and customize flows to ensure correct behavior

Common Issues and Solutions

Issue: Analytics tracking before consent

  • Check for duplicate analytics scripts outside DigiConsent control
  • Ensure plugins aren’t loading analytics independently
  • Verify script is in analytics category, not necessary category

Issue: Analytics not working after consent

  • Check browser console for JavaScript errors
  • Verify analytics script code is correct
  • Ensure consent update event is firing (check dataLayer)
  • Try refreshing page after giving consent

Issue: Partial data in Google Analytics

  • Expected if many users decline analytics cookies
  • Enable Google Consent Mode for modeled data recovery
  • Accept that some data loss is the cost of privacy compliance

Analytics Cookies Best Practices

  • Be transparent: Clearly list all analytics tools you use in your cookie policy
  • Use Google Consent Mode: Recover data from declining users while staying compliant
  • Minimize tools: Each analytics tool adds consent complexity; use only what you need
  • Consider privacy-first alternatives: Tools like Plausible, Fathom, or Simple Analytics don’t require consent in some jurisdictions
  • Anonymize where possible: Enable IP anonymization and other privacy features
  • Regular audits: Check quarterly to ensure all analytics scripts are properly controlled
  • Document everything: Maintain records of which analytics tools require consent and why
  • Test frequently: After WordPress updates or plugin changes, retest consent behavior

Analytics Configuration Checklist

  • Analytics cookies category is enabled and consent-required
  • Clear description explains what analytics cookies do
  • Google Analytics (GA4) added to category with correct Measurement ID
  • Google Tag Manager properly configured with consent triggers
  • Google Consent Mode enabled and mapped to analytics category
  • All analytics tools (Hotjar, Clarity, etc.) added to category
  • No analytics scripts loading outside DigiConsent control
  • Tested with cookies declined—no analytics cookies present
  • Tested with cookies accepted—analytics tracking works normally
  • Google Analytics Real-Time shows data after consent
  • Documentation maintained for all analytics tools and purposes

Analytics cookies provide invaluable insights into how users interact with your website, but they must be implemented with respect for user privacy. By properly configuring the analytics category in DigiConsent, ensuring all tracking scripts are consent-gated, and leveraging technologies like Google Consent Mode, you can maintain useful analytics capabilities while fully complying with privacy regulations and honoring user choices.

Similar Articles

Back to DigiConsent