Almost weekly, we at DMCC do get asked whether or not permission is required for Google Analytics cookies. So it depends: first, on whether you are using Google Universal Analytics or the newer Google Analytics 4.
With Google Universal Analytics, you may set the analytics cookie for permission only if you meet these six conditions:
Enter into a processor agreement with Google
Anonymize the IP address
Turn off data sharing with Google
Turn off data collection for ad functions
Disable User ID
Inform about use of Google Analytics and opt-out
Many websites that set Google Analytics cookies for consent do not comply with this, often still using a user ID, for example.
Google Analytics 4 (GA4) replaces the less privacy friendly Google Universal Analytics. The Google Analytics 4 cookie is set as a first-party cookie from an advertiser's site and is used for analytics. The cookie provides a unique identifier to a Web visitor. Through that ID, a site owner can distinguish different website visitors and track their activities. The ID depends on the website visitor, url and device used, among other things. This means that if there are repeat visits, or visits from a different device or visits to a different URL, Google Analytics 4 does not see that it is the same visitor. So it is not possible to track people over time, different sites and devices.
Opinions are divided as to whether Google Analytics 4 does indeed fall under an analytics cookie with minor privacy implications and therefore no consent needs to be requested. Since no repeat visits are recorded, you could argue that a "bare" Google Analytics 4 cookie could be defended as an analytics cookie with low privacy impact. But it is likely that the Autoriteit Persoonsgegevens Authority will find that you do need consent, because the cookie does use a unique identifier. So it does not collect aggregate data about website visits, with a session it is still recorded per user.
If you use other Google services such as Google Signals in addition to Google Analytics, tracking is always involved and thus requires the web visitor's consent. Google Signals makes it possible to track one user across different devices (desktop, tablet, phone) and analyze usage behavior. If you want to remarket through Google, you must enable this feature in GA4.
