Trust and report

Analytics Consent and Privacy for Startups

Analytics and ad tags collect data that privacy laws regulate. A consent banner, Google’s consent mode and a clear privacy policy let you measure while respecting people’s choices. The rules differ by region, so set up for the strictest place you sell.

ShoutEx Team · Data checked October 3, 2026
Guides / Website Analytics / Consent and Privacy
Measure what people allow you to measure.Website Analytics for founders · Data checked October 3, 2026
4
Consent types in Google consent mode
Off
Default for identifying trackers under Quebec’s Law 25
1
Banner that controls every tag

Do you need consent for analytics?

It depends on where your visitors are. In the EU and UK, non-essential cookies need consent first. Quebec’s Law 25 requires technology that can identify, locate or profile people to be off by default; see selling in Quebec. US state laws focus more on opt-out of sale and sharing. Many startups set one banner that meets the strictest rule they face. This is general information, not legal advice.

Example · Consent banner
Cookie banner

We use cookies for analytics and ads. You can accept all, reject non-essential, or choose.

Accept allReject non-essentialChoose
Illustrative example for a fictional SaaS company.

What is Google consent mode?

A way for Google tags to adjust to the visitor’s choice. Google Tag Manager supports four consent types: ad_storage, analytics_storage, ad_user_data and ad_personalization (Tag Manager Help). Your banner sets them; Google tags then store cookies or not and send limited signals. Setup is in Google Tag Manager setup.

// Defaults before the banner loads (strict regions)
gtag('consent', 'default', {
  ad_storage: 'denied', analytics_storage: 'denied',
  ad_user_data: 'denied', ad_personalization: 'denied' });

What about non-Google tags?

Meta, LinkedIn, TikTok and product analytics tools also need to respect consent. Fire them only when the right category is granted, using GTM triggers or your consent platform’s integration. PostHog can run cookieless or wait for consent before recording sessions.

What data should you avoid sending?

  • Emails, names or phone numbers in event properties or URLs.
  • Form field contents in session replays; mask them.
  • Health, financial or other sensitive details in any analytics tool.
  • Unhashed personal data to ad platforms; hash it or use server-side tools. See server-side tracking.
Founder rule

Set up for the strictest market.

One consent setup that meets the toughest rule you face is simpler than a patchwork.

How do you set it up?

  1. List every tag and tool that collects data.
  2. Choose a consent management platform that supports Google consent mode.
  3. Set defaults by region and map each tag to a consent category.
  4. Test with consent granted and denied.
  5. Update your privacy policy and review it yearly.

Frequently asked questions

Do I need a cookie banner?

If you have visitors from the EU, UK or Quebec, or use identifying trackers, usually yes. Check the rules for your markets.

What is Google consent mode?

A way for Google tags to adjust behaviour based on the visitor’s consent choices.

What are the four Google consent types?

ad_storage, analytics_storage, ad_user_data and ad_personalization.

Does Quebec’s Law 25 affect analytics?

Yes. Technology that can identify, locate or profile people must be off by default.

Do Meta and TikTok pixels need consent?

In regions that require consent for advertising cookies, yes. Fire them only when consent is granted.

Can I use analytics without cookies?

Yes. Privacy-first tools and cookieless modes count visits without storing cookies, with less detail.

Sources & further reading

Analytics tools change quickly. These sources let you check the dated facts directly. Screens shown are mock-ups for a fictional SaaS company.

Tag Manager Help: Consent mode in Google Tag ManagerVisit →