Google Analytics cookies like _ga, _gid, and _gat aren't GDPR-compliant by default.They count as personal data because the identifiers can single out users, and sincethey're not strictly necessary, GA needs opt-in consent before the script fires. A propersetup has three pieces: a consent tool that blocks GA until the visitor accepts, a DataProcessing Amendment signed with Google, and reliance on the EU-US Data PrivacyFramework for transfers to US servers. Google Consent Mode v2 helps by adjustingGA's behaviour when consent is denied, but it doesn't replace any of those threepieces.‍

‍