Category Manipulation: How CMPs Miscategorize Google Analytics as 'Essential'

The Miscategorization Problem Is Systematic, Not Accidental

Across thousands of audited websites, a persistent pattern emerges: Google Analytics — a third-party behavioral analytics service operated from US infrastructure — appears under the "Essential" or "Strictly Necessary" category in consent management platforms (CMPs). This is not a configuration accident. It is a deliberate circumvention of the consent requirement established by §25(2) TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz), Germany's implementation of Art. 5(3) ePrivacy Directive. The legal and technical arguments against this practice are unambiguous — yet enforcement remains patchy, creating competitive pressure on compliant operators to follow suit.

What §25(2) TDDDG Actually Requires

§25(2) TDDDG exempts storage of or access to information on end-user devices from consent only where two cumulative conditions are met: (1) the sole purpose is to carry out the transmission of a communication over a public network, or (2) the storage or access is strictly necessary to provide a telemedia service explicitly requested by the user. This mirrors the CJEU's interpretation in Case C-673/17 (Planet49), which confirmed that the ePrivacy Directive's necessity exception must be read narrowly. The EDPB's Guidelines 05/2020 on consent (v1.1, adopted 04 May 2020) further specify that analytics cookies "are not strictly necessary" because the service can be delivered without them.

Key test: Would the service requested by the user cease to function if this cookie/storage access were absent? For Google Analytics: no. Session integrity, authentication, and shopping carts pass this test. Behavioral analytics do not.

The EDPB's Opinion 5/2019 on the interplay between the ePrivacy Directive and GDPR reinforces that the legal basis for analytics trackers must be consent under Art. 6(1)(a) GDPR, not legitimate interest, and certainly not the ePrivacy necessity exemption. Classifying _ga, _gid, or _ga_XXXXXXXX cookies as essential is therefore a double violation: it bypasses §25(2) TDDDG and Clarify that supervisory authorities and EDPB strongly indicate consent is required; avoid stating legitimate interest is categorically invalid as a legal matter without qualification.

How CMPs Technically Implement the Manipulation

The miscategorization typically manifests in one of three technical patterns:

1. Static category assignment in CMP configuration: The CMP vendor's tag (e.g., Cookiebot, OneTrust, Usercentrics) stores cookie definitions in a JSON configuration payload. An operator or agency simply moves the _ga cookie entry from "statistics" to "necessary" in the CMP dashboard. The consent layer then never fires a consent signal for this cookie, and the analytics script loads unconditionally.
2. Script injection before consent resolution: The Google Analytics gtag.js or analytics.js snippet is placed directly in <head> outside of any CMP-gated tag manager container, causing it to execute before the CMP's consent callback resolves. The CMP's UI still shows GA as "essential" to justify the pre-consent load.
3. Tag Manager trigger manipulation: In Google Tag Manager, the GA4 configuration tag's firing trigger is set to All Pages rather than a consent-gated custom event trigger. The CMP integration exists on the consent layer UI level only, with no actual blocking signal reaching GTM.

Automated Detection: A Technical Playbook

Manual auditing does not scale. The following automated approach reliably detects GA miscategorization in production:

1. Headless Browser Consent Interception

Using Playwright or Puppeteer, load the page without interacting with the CMP (simulating a user who has not yet consented). Intercept all outbound network requests via the browser's page.on('request') API. Flag any request to *.google-analytics.com, analytics.google.com, or containing the path /g/collect (GA4 measurement protocol endpoint) that fires before any consent interaction. A positive hit is strong evidence of pre-consent tracking.

2. Cookie Jar Analysis Post-Rejection

Simulate an explicit consent rejection (click "Reject All") using automated CMP button detection, then dump the browser's cookie store. Presence of _ga, _gid, or _ga_* cookies after rejection — or their absence from the CMP's declared cookie list — indicates miscategorization. Cross-reference the detected cookies against the CMP's published cookie declaration endpoint (e.g., Cookiebot exposes this at https://consent.cookiebot.com/{CBID}/cc.js).

3. HTTP Response Header Inspection

Parse Set-Cookie response headers during the initial page load (before consent interaction). Analytics cookies set via HTTP response (server-side GA or server-side tagging implementations) bypass client-side CMP blocking entirely. Check for SameSite and Secure flags as secondary signals of third-party tracking intent. A Set-Cookie: _ga=...; domain=.example.com; expires=... header on initial load, before consent resolution, is a clear §25(2) violation.

4. DNS-Level Tracker Fingerprinting

Capture all DNS queries during page load (using a local DNS proxy or browser DNS-over-HTTPS logging). Resolve queried hostnames against a blocklist derived from EasyPrivacy and Disconnect.me's tracking protection list. Map DNS queries to their CMP-declared category. Queries to www.google-analytics.com (CNAME: analytics.google.com, A record resolving to Google's ASN 15169) before consent constitute consent-free tracking regardless of CMP UI state.

Evidentiary Standards for Enforcement Complaints

German DPAs (particularly the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) and Datenschutzkonferenz (DSK)) have published structured enforcement guidance on cookie violations. For a complaint to succeed, document the following as a minimum evidentiary package:

• HAR file (HTTP Archive) capturing the full request sequence with timestamps, proving GA requests preceded consent resolution
• Screenshot or video recording of the CMP UI showing the "Essential" categorization
• The CMP's JavaScript configuration payload (extractable from browser DevTools Network tab, filtering for the CMP vendor's config endpoint) showing the category assignment
• WHOIS/ASN data confirming the analytics endpoint is operated by Google LLC (a third party), defeating any "first-party" exception argument

Liability Exposure and Operator Risk

Under §25 TDDDG in conjunction with §28 TDDDG, violations are classified as administrative offences (Ordnungswidrigkeit) punishable by fines up to €300,000 per violation. Simultaneously, the GDPR Art. 83(5) track applies to the underlying data processing, with fines up to €20M or 4% of global annual turnover. The DSK's "Handreichung Telemedien" (January 2022) explicitly names analytics as a consent-dependent use case, leaving operators no credible legal defense for essential-category misclassification.

CMP vendors who offer pre-configured templates that miscategorize analytics bear joint exposure as joint controllers or processors, depending on their contractual role — a liability angle increasingly pursued by privacy-focused law firms filing coordinated complaints.

Actionable Recommendations

• Audit your CMP configuration quarterly using the headless browser method above; export and diff configuration JSON payloads between audits to detect silent re-categorizations by CMP vendors or agencies.
• Implement Content Security Policy (CSP) headers with a connect-src directive that blocks *.google-analytics.com by default, releasing the restriction only after a confirmed consent signal — this provides a technical enforcement layer independent of the CMP.
• Separate GTM containers into a consent-gated container (analytics, marketing) and a functional container (error tracking, performance monitoring genuinely necessary for service delivery), loaded via distinct script tags with different firing conditions.
• Document your necessity assessment per cookie in a Data Protection Impact Assessment annex, applying the two-prong §25(2) test explicitly. This documentation is your primary defense in DPA audits.
• If using server-side tagging (sGTM), ensure your server-side GA4 client checks for a valid consent signal in the incoming request before forwarding to the GA4 collection endpoint — the server-side architecture does not exempt you from the consent requirement.

This article was produced with AI assistance and fact-checked against verified GDPR case law (GDPRhub). For legal advice, consult a qualified data protection expert.