Google Analytics is an opt-in tool and 2026 hasn't changed that

In 16 years, I've yet to work on a website that doesn't use Google Analytics (GA).

GA is everywhere, but our industry still doesn't talk openly enough about a basic fact: if you follow the rules, Google Analytics is an opt-in-only tool.

And if a website follows cookie law properly (many still don't), GA is far less useful than it used to be.

You may have heard that in 2026 things changed, but it's not as clear cut as you might hope.

The UK now has an exemption for analytics cookies. But for most brands running a standard GA4 set-up, it doesn't change things, and here's why.

The opt-in world of analytics

In (very) simple terms, data protection rules say you need clear consent from your audience before you use non-essential cookie-based tracking on your website. Google Analytics has always sat in that bucket.

That makes tracking opt-in, not opt-out like it used to be. If a user opts in, you can track them, but if they do nothing or say no, you can't.

For brands that follow the guidelines to the letter, the result is that GA data becomes significantly less reliable, sometimes to the tune of 80% of visitor data missing.

It's still a massive challenge, and I'm still yet to find many people putting it plainly: web analytics is an opt-in game.

What changed in 2026 (and what didn't)

The UK's new analytics exemption

The Data (Use and Access) Act 2025 amended PECR, the UK's cookie rules. Since 5 February 2026, cookies used purely to collect statistics about how your website is used, so you can improve it, no longer need prior consent. The ICO published its final guidance on the new exceptions on 29 April 2026.

At first glance, this seems to clear the path for GA4, but not so fast:

• You still need to tell people clearly what you're doing and give them a simple, free way to object.

• If the same technology also feeds advertising, audience building or profiling, you need consent.

• Google uses data collected through GA for its own purposes, and most GA4 accounts are linked to Google Ads, have Google Signals switched on, or both. The usage isn't covered.

You can strip GA4 back far enough to have a credible argument, but in the process you'll lose much of what it's used for.

In addition to this, the fines went up at the same time. PECR fines used to go up to a maximum of £500,000; now (in alignment with UK GDPR), they can go up to £17.5 million or 4% of global turnover.

The problems with opt-in analytics

So for most brands, GA is still opt-in, and opt-in data is unreliable for a few reasons:

1. You're working with a smaller sample. The smaller the sample, the harder it is to find real insight.

2. The people who opt in may not represent your audience. There's a possibility that the 'opted-in' portion of your audience skews heavily in favour of one segment over another. Therefore, you're tracking perhaps a high share of one segment and a low share of another.

3. Summary metrics like conversion rate become inconsistent. It's hard to calculate an average when you can't see the total.

If you're serious about accurate data and honest about the decisions you make with it, opt-in GA4 can't be your single source of truth.

What's the solution?

The first step is to implement the correct policy, making sure your website complies with the correct guidelines based on the audience it serves.

The second step is that your marketing and leadership teams still need reliable data on performance. There are a few options.

Consent Mode (via GA4)

Google's answer is Consent Mode. Since March 2024, it's been mandatory for anyone using Google's advertising tools with UK and EEA audiences. In theory, it uses 'modelled' data to fill the gaps left by visitors who don't consent.

It sounds plausible, but in practice, I've still not seen it working well for the brands we work with.

GA4's behavioural modelling only switches on once a property has enough data: roughly 1,000 events a day from users who declined, and 1,000 daily users who accepted, sustained over several weeks.

Most specialist financial services websites don't come close and so the gap never gets filled.

Server logs

A few years ago, I had a sneaky suspicion that server logs would make a comeback. I'm more convinced now.

Before GA, server logs paired with simple dashboards let website owners track 'hits' and see which pages were being viewed. Configured to anonymise visitor information such as IP addresses, they still offer a compelling answer to the consent problem.

There's a new reason to care about them, too. Server logs are one of the few places you can see AI crawlers (the bots behind ChatGPT, Perplexity, Google's AI features and others) visiting your site. As more of your audience discovers you through AI tools, that's useful insight GA will never give you.

They still aren't user-friendly, though.

Privacy-compliant analytics

This is where we've put our faith; analytics platforms that don't use cookies and don't collect personal information.

Since first writing about this, we've rolled out an Indulge-hosted, EU-based analytics platform built on Plausible across our client websites.

Plausible gives you most of the insight GA4 is used for, with a few privacy-related differences:

• It uses a small script to count visits, rather than placing cookies on the visitor's device

• It doesn't store IP addresses, so individual users aren't tracked over time

• It doesn't build persistent user profiles, so each visit is treated independently; that means you can't track repeat visits, but that's the trade-off for protecting user privacy

• It uses referrer URLs and UTM parameters to understand where visitors come from, rather than third-party trackers

• Data is aggregated into broad statistics, not individual user statistics

Because nothing is stored on the visitor's device, there's nothing to opt in to. You see (close to) every visit, not just the ones who clicked 'accept'.

The only flaw is that it's prone to being skewed by bot traffic (a growing problem and one we've addressed on the Fin the Week podcast). The answer here is better filtering.

GA is still opt-in

The 2026 changes are a step in the right direction, but they haven't rescued Google Analytics. For most brands, especially in financial services and the Channel Islands, GA remains an opt-in technology.

Use it for what it's good at: understanding the behaviour of people who've said yes, just don't mistake it for the full picture.

This article is general information, not legal advice. If you're unsure whether your analytics set-up qualifies for an exemption, speak to your data protection officer or legal adviser.