Decide consent before adding GA4 and AdSense

Adding Google Analytics to a static blog is technically easy. Paste a script, deploy the site, and data starts flowing.

That is not the decision that matters.

The real decision is: when should the script load, what happens when the visitor says no, and what does the privacy policy honestly describe?

Those questions become more important when AdSense enters the site. Analytics is one layer. Advertising adds ad storage, personalization, ad technology providers, regional consent requirements, and placement-policy risk.

Short answer

For a small static blog, start conservatively.

The goal is not to show a banner. The goal is to connect the visitor’s choice to the scripts that actually run.

Static sites still need consent state

A static site has no application server, but the browser still runs third-party scripts. GA4 and AdSense both operate in the visitor’s browser.

A minimal static implementation can track one local choice:

analytics_consent = granted | denied | unset

If the visitor grants consent, load the analytics script. If the visitor denies consent, do not load it. The privacy policy can describe this as storing the visitor’s analytics choice so the banner does not need to appear on every page. It does not need to lead with implementation details like localStorage.

Consent Mode is about tag behavior

Google Consent Mode lets a site communicate consent choices to Google tags. The important static-site pattern is to start with denied defaults and update only after consent.

<script>
  gtag("consent", "default", {
    analytics_storage: "denied",
    ad_storage: "denied",
  });
</script>

The exact implementation depends on the site. The operating rule is simpler: do not start analytics or advertising storage before the visitor has made the relevant choice.

AdSense changes the risk profile

GA4 is analytics. AdSense is advertising. That means placement rules, personalized ads, cookies or similar technologies, and regional consent requirements.

Google AdSense Help says that publishers using AdSense, Ad Manager, or AdMob must use a Google-certified CMP integrated with the IAB TCF when serving personalized ads to users in the EEA and UK from January 16, 2024, and in Switzerland from July 31, 2024.

For a Korean-only blog, that may not feel urgent on day one. For a blog with English posts and global traffic, it becomes part of the AdSense plan.

This is not legal advice. It is an implementation boundary: the code should not pretend consent is solved when the product plan includes advertising.

What the privacy policy should say

A small static blog should describe what actually happens.

[ ] whether the site has accounts or not
[ ] what happens when a visitor sends an email
[ ] whether GA4 is used
[ ] whether AdSense is used or planned
[ ] what technical information may be processed
[ ] whether cookies or similar technologies may be used
[ ] how the visitor can change consent
[ ] links to relevant third-party policies

Avoid saying “we collect no personal data” if the site uses analytics, ads, hosting logs, or contact email. A more careful policy says what the site itself collects and what third-party services may process.

Ad placement matters too

AdSense is not only a script integration. Google ad placement policies prohibit implementations that encourage accidental clicks, make ads look like site content, place ads under misleading headings, or draw unnatural attention to ads.

For a blog layout, that affects design.

Do not design the content list and then squeeze ads into it later. Leave clear boundaries where ads can appear without looking like posts.

Static implementation checklist

[ ] GA4 does not load before analytics consent
[ ] denied consent prevents analytics loading
[ ] the privacy policy describes analytics and advertising plans
[ ] the visitor can change the analytics choice
[ ] AdSense placement is visually separate from content
[ ] CMP requirements are checked before personalized ads target EEA, UK, or Switzerland traffic

A static blog can stay simple. It should not stay vague. The more global the audience becomes, the more explicit the consent model needs to be.

Sources

• Google Analytics Help: Consent mode on websites and mobile apps
• Google Tag Platform: Set up consent mode on websites
• Google AdSense Help: Consent management requirements for EEA, UK, and Switzerland
• Google AdSense Help: Ad placement policies