Google Analytics 4 setup: how to set it up for your website, consent first

How do you set up Google Analytics 4? In five parts: create a property with a web data stream, install the tag with consent mode wired to your cookie banner, set retention and privacy settings, mark your enquiries as key events, and link Search Console and Google Ads. Pasting the tag onto your site without asking consent breaks the cookie rules in the EU and the UK, and gives you numbers that do not add up anyway.

GA4 has been the only version since 1 July 2023, when Universal Analytics stopped processing data. It measures events rather than sessions and pageviews, so setting it up differs from what users of the old Analytics are used to. This guide walks through each step with the choices that matter for a business site serving European visitors, and ends honestly with the alternative: measuring without cookies, as we do on this site.

Step 1: create a Google Analytics 4 property

Go to analytics.google.com, create an account for your company and a property for your website. Pick the time zone and currency of your main market: they decide how days and revenue count in your reports, and a wrong time zone shifts your daily figures. A UK company selling into the eurozone usually keeps its home time zone and reports revenue in the currency it invoices in.

Step 2: a web data stream and enhanced measurement

Add a web data stream with your site's address. You get a measurement ID starting with G-. Leave enhanced measurement on: without extra work it counts pageviews, scrolls, outbound clicks, site search, video, downloads and form interactions. Switch off what you will not use; every metric you ignore is noise.

Step 3: install the tag, directly or through Tag Manager

Two routes. The Google tag placed directly in your site's code is the lightest, if Analytics is all you use. Google Tag Manager is handier if you also track Google Ads, Meta or LinkedIn. Pick one; doing both counts every visitor twice. On WordPress a plugin will do, but check your theme does not load a tag already.

Step 4: consent mode and your cookie banner

Analytics sets cookies and processes personal data, so in the EU and the UK it waits for consent; when you need a banner is explained in do I need a cookie banner. Consent mode is the bridge between your banner and Google: the banner passes four signals per visitor (analytics_storage, ad_storage, ad_user_data and ad_personalization), and the tags behave accordingly.

Since 15 June 2026 Google Ads takes its data from GA4 through consent mode only, no longer through Google signals. A banner passing the wrong signals either stalls your remarketing or sends too much; the detail is in the consent mode change in Google Analytics.

Step 5: retention, Google signals and internal traffic

Three settings almost nobody changes. Data retention defaults to 2 months; set it to 14, or your explorations cannot compare a year with the year before. Standard reports are not affected either way. Google signals ties visitors to signed-in Google accounts; switch it on only if you need it and your privacy policy says so. And exclude your own visits with a filter on your office IP address, or colleagues count as customers.

On IP addresses: GA4 neither logs nor stores them, so the old setting to anonymise them no longer exists. Google acts as a processor for you; you accept its terms in the admin, and what such an agreement covers is under data processing agreement.

Step 6: how to set up conversions in Google Analytics 4

What GA4 used to call conversions has been called key events since March 2024. Choose them from the numbers that actually steer your business, your KPIs. For a business site there are usually three or four: a submitted form, a click on your phone number, a click on your email address, and for a store a purchase.

To know which campaign brought those enquiries, add a UTM code to every link in your newsletter and your ads.

Step 7: link Search Console and Google Ads

Link your Search Console property in the admin, and Analytics shows which search terms brought people in and what they did next; how to use Google Search Console covers Search Console itself. If you advertise, link Google Ads too and import your key events as conversions, so campaigns optimise for enquiries rather than clicks.

Step 8: test before you trust it

Open DebugView or the Realtime report, visit your site in a private window, reject and then accept cookies, and send a test form with an obvious name. If full data still arrives after rejecting, your consent mode is wrong. Only once that is right do you read your first reports.

What to look at in your first reports

GA4 shows a lot, and you need little of it. For a business site four questions are enough, each with its own report. Where do visitors come from: Traffic acquisition, per channel (organic search, direct, referral, paid, social). Which pages do they read: Pages and screens, sorted by views and by average engagement time. Who sends an enquiry: your key events, per source. And what works in my campaigns: the same events filtered by UTM campaign.

Read them per month, not per day. A site with a few hundred visitors a week swings from day to day with nothing going on. Put two months side by side, see which source brought more enquiries, and then decide where your time or budget goes. Reports nobody opens can be hidden in the library, so colleagues do not get lost.

The alternative: measuring without cookies

For many small businesses, Google Analytics is more than they need. If you want to know how many visitors come, from where, and how many send an enquiry, you can measure that without cookies. On vbsmarketing.eu and the Business Centrum site our own function on AWS counts visits, sources and enquiries, storing nothing on the visitor's device and sharing nothing with third parties. How that compares with Google's server-side route is under server side tracking. If you spend serious money on Google Ads, Analytics with consent mode remains the better choice, because your campaigns steer on it directly.