Cookie consent and privacy information for accommodation sites | How to check before introducing GA4

If I install Google Analytics 4 (GA4), do I also need a cookie consent banner? What should I write in my WordPress privacy policy? What should we think about when staying at an inn that receives reservations from overseas? This is a difficult subject for the host to judge.

In short, putting the same banner and the same wording on every inn’s website does not resolve the issue. The measures needed depend on the analytics, advertising, booking, maps, videos, contact forms and spam prevention services used, and on where visitors are located.

In this article, rather than making individual legal decisions, we will explain how the host can take inventory of your current site and create a situation where you can accurately consult production companies, service providers, and experts if necessary.

Bottom line: List external sending before choosing a banner

The safe order is:

List external services used on the site
Check what to send, why, and where to send it.
Classify into essential functions, access analysis, advertisements, etc.
Check the target area and the contract/policy of each service.
Design necessary guidance, selection screens, and tag control
Actual test of consent, refusal, and withdrawal states
Update your privacy policy and confirmation date

Even if you add one “Cookie Consent Plugin” from the beginning, it will not serve the purpose if GA4 or advertising tags are activated before consent. Conversely, if you turn off functions necessary for reservations and fraud prevention, customers may not be able to make reservations.

What are cookies?

Cookies are small pieces of information that websites store in your browser. It is used for login status, display language, consent selection, access analysis, etc.

Cookies are not the only things we check. Current sites may also store and transmit information through the following mechanisms:

Browser local storage
IP address and device information at the time of access
Embedded videos and maps
Advertising/SNS tags and pixels
Reservation service iframe and external link
Inquiry/spam mail countermeasures
CDN, font, image distribution service

Therefore, look beyond just the sentence “We use cookies” to check which external services the site actually uses.

Cookies are not all the same

Inn sites are easier to understand if they are divided by purpose.

Classification	Example	What the host confirms
Necessary functions	Security, login, consent record	What stops working if you stop it
Setting retention	Language, display, input assistance	Storage period and purpose
Access analysis	GA4, etc.	Destination, consent status, advertising function
Advertising	Remarketing, etc.	Advertising identifier, target area, contract terms
External content	Maps, videos, SNS embedding	External communication before display
Reservations/Inquiries	Reservation engine, forms, fraud prevention	Personal information, subcontractor, time of submission

The classification name varies depending on the consent management service you use. It’s not the name that matters, but how each feature actually works.

Relationship with personal information protection in Japan

Personal Information Protection Commission Q&A explains that even if device identifiers such as cookies do not fall under personal information, they are usually considered to fall under personal information. Additionally, if a specific individual can be easily identified by comparing the information with other information, the information as a whole may fall under personal information.

However, it cannot be simplified to “using cookies = requiring the same consent banner in all cases.”It is necessary to individually check the content of the information, purpose of use, provision to third parties, whether it will be acquired as personal data by the other party, regulations as a communication service, contract terms of advertising services, etc.

This article is not legal advice. Please check with the latest documents from the service provider and, if necessary, with experts such as lawyers, to make legal decisions based on your own business, users, overseas customer attraction, and advertising functions.

When receiving reservations from overseas

If you actively provide services to users outside of Japan, such as the EU or the UK, local privacy rules may come into play. Just because the server is in Japan, it doesn’t necessarily mean that you only need to consider Japan.

Organize the following situations and report them to the specialist.

Supported languages and regions
Presence of overseas advertising
Reservation results from overseas
Storage location of payment/reservation data
Analysis, advertising, and reservation companies used
Countries and regions where information is handled
Contact point for inquiries regarding deletion and disclosure

The required design is different for a small inn that mainly caters to domestic customers and an inn that distributes advertisements aimed at the EU and receives direct reservations.

External service ledger created first

See not just the name of your theme or plugin, but who you want to communicate with when you open the page.

Services	Place of publication	Purpose	Information that may be sent	Point of action	Administrator	Confirmation date
GA4	All pages	Access analysis	URL, terminal, etc.	Depending on settings	Inn	Date
Reservation service	Reservation page	Room vacancies/reservations	Input information at the time of reservation	Movement/input	Inn/Business operator	Date
Map	Access	Location information	Connection information, etc.	Embedded display	Operator	Date
Video	Introduction article	Video playback	Connection information, etc.	Display/playback	Operator	Date
Form countermeasures	Inquiries	Spam transmission prevention	Input/device information, etc.	Display/send	Inn/Business operator	Date

Don’t make guesses about the exact content to be sent; instead, check the official documents, contracts, and current settings of each service. The tags introduced by the production company are also recorded in a ledger that can be continuously managed by the inn.

Just looking at WordPress doesn’t tell you everything

External services may be located in the following locations:

WordPress plugin
Theme settings
Child themes and theme files
Google Tag Manager
Insertion function on the server or CDN side
Reservation service embed code
Widgets, blocks, shortcodes
Advertising company tag

The same GA4 tag may be installed twice in themes and plugins. Don’t draw any conclusions just from the plugin list; examine the public page’s communication, HTML, and tag management screen in read-only mode.

WordPress privacy features

You can select and create a privacy policy page in “Settings → Privacy” on the WordPress management screen.WordPress official privacy explanation explains that while there is a function to collect templates of guidance text from themes and plugins, it is ultimately the administrator’s responsibility to adapt it to the actual site conditions and applicable requirements.

The template is the starting point. Discrepancies may occur, such as the description of a deleted plug-in remaining, the current reservation service not being listed, or outdated contact information. Check with the actual ledger.

Items to check in the privacy policy

Depending on the actual situation at your facility, check at least the following:

Operator and contact point
Information to obtain
Purpose of use
Information handled for reservations and inquiries
Access analysis service
Purpose of use of cookies, etc.
External reservations, maps, videos, SNS, advertising services
Information regarding consignment, provision to third parties, and handling overseas
Retention period or criteria
Concept of safety management
Contact point for disclosure, correction, deletion, etc.
Policy changes and updated dates

Do not copy text from other sites. If you write about an advertising service that you don’t use, or declare that you don’t actually send information at all, there will be a discrepancy between the appearance and the reality.

Ideas needed for consent banners

When installing banners, it is important that visitors understand the meaning and can choose from them.

I understand what the selection is for.
You can find “Allow” and “Deny”
Proceed to detailed settings
Separate necessary and optional functions
Determine the default state before selection
Can be changed or withdrawn later
Proceed to privacy policy
Do not hide the reservation button on your smartphone
Can also be used with keyboard operations or reading aloud

Avoid designs that blend the deny button with the background, make only the permission button larger, or treat close operations as permissions. We think of this as a guide that provides information for customers to make decisions.

Banner display and tag control are different things

Even if the banner shown above is displayed, if the GA4 or advertising tag in the background is triggered first, the selection will not be reflected. On the other hand, even if you stop tagging, the selection state cannot be saved and the same question may be asked on every page.

There are three layers to check.

Banner: Display options
Consent management: Record selection status and communicate to each category
Tags/embedding: Change loading and behavior depending on selection

Just installing a WordPress plugin does not necessarily mean that all three will work together correctly. Check each tag separately: GA4, GTM, ads, video, and maps.

Differences with Google’s consent mode

According to Google’s consent mode explanation, consent mode is a mechanism that adjusts the behavior of Google tags according to the user’s choices. However, consent mode itself does not provide a banner or consent text.

Google describes basic consent mode and advanced consent mode. Advanced methods may allow cookie-free communication even if consent is not obtained, so do not assume that nothing will be sent to Google if consent is not obtained, but check the operation of the method you have selected.

Google and AI will not automatically decide which is legally appropriate. We make selections based on geography, advertising usage, internal policies, and expert advice.

Do not stop necessary functions

It has functions necessary for inn business and safety, such as links to reservation sites, inquiries, security, prevention of unauthorized use, and storage of consent selections. However, rather than deciding that a service is required just based on its name, check its specific role.

For example, a map may be useful, but you can avoid designs that make it impossible to read the textual information of an address unless the map is displayed. There is also a way to prevent videos from loading external services until they are clicked. Even if you turn off any external content, you will still be able to access basic information such as inn name, address, reservations, and inquiries.

Read-only inventory taken by AI

Cookies, external sending, and embedding services are available on the inn's public WordPress site.
Please inventory as read-only.

Target:
- WordPress themes and enabled plugins
- External domain communication for public pages
- GA4, Google Tag Manager, advertising tags
- Reservations, payments, maps, videos, SNS, forms, anti-spam measures

Service name, published page, purpose, destination domain, loading time,
Please list the current consent controls, official document URLs, and unconfirmed items.
Please do not add plugins, change tags, install banners, or update policies yet.
Please do not output confidential information, reservation information, or cookie values on the management screen.
Please do not make any definitive legal conclusions, but separate questions to ask the experts.

Request text to create differences in privacy information

Compare your current privacy policy and external service ledger.
[Current published text]
[Verified ledger]

Services that don't have explanations even when you actually use them, explanations that remain even though you don't use them,
Please make a list of old contacts and unclear usage purposes.
Please do not copy text from other companies' sites, and separate the proposed amendments and the rationale for the published text.
Please do not make any definitive decisions about the area of use or any points that require legal judgment, but instead ask questions to experts.
Please do not change the live page yet.

Testing after implementation

Use your browser’s private window, etc. to check your previous selections.

Before selection

Banner can be read
Are GA4, advertisements, and optional embedding as designed?
Is the inn name, price, address, and reservation entrance available?

If allowed

Is only the selected classification valid?
Are GA4 etc. loaded twice?
Will the selection be maintained on the next page?

If you decline

Will the rejection be saved?
Does the arbitrary tag stop as designed?
Can I use the necessary functions for reservations and inquiries?
Will alternative directions for maps and videos be displayed?

If you want to change it later

Can you reopen the settings from the footer etc.
Is it possible to change from permit to deny, and from deny to permit?
Is the selection validity period as designed?

Smartphone

Does the banner cover the entire screen?
Is it possible to control the refusal/detailed settings?
Don’t hide the reservation button or inquiries?
Are there any horizontal scrolling or overlapping buttons?

Request text asking AI to test

Please create a post-launch test plan for the cookie consent feature.
Pre-selection, permission, denial, and setting changes are separated by PC width and smartphone width.

In each state, GA4, advertisements, maps, videos, reservations, and inquiries are available.
Please check if it works as designed. Form submission, reservation confirmation, and payment are
Do not run it unless you have a formal test method.
Please do not include cookie values, identifiers, or personal information in your report.
Please separate confirmed, problem, unconfirmed, and items that require human inspection.

Common mistakes

Just displays the banner and does not control the tag.
I can only find the allow button
If you refuse, you will not be able to use the reservation.
GA4 is sent twice from theme and GTM
Privacy policy remains with old service name
Maps and videos are loaded before selection
Settings cannot be changed later
Cover the reservation button on your smartphone
Cookies remain only for administrators, and it is not possible to check the first display
No review of design even after starting overseas advertising

Periodic review

We will review the ledger, banner, and privacy policy at the following timing.

Added/changed GA4 and advertising functions
Changed reservation/payment service
Added map, video, SNS, and form countermeasures
Changed WordPress theme and major plugins
Started overseas pages and advertisements
Production company and person in charge have changed
The terms and specifications of the service provider have changed.
Regular check at least once a year

To introduce GA4 itself, please refer to Introduction to Google Analytics 4 for the host, and to measure reservation buttons, etc., please refer to How to measure reservation buttons on inn sites with GA4.If you wish to add spam email protection to your inquiry, please also check the privacy information in Inn inquiry form spam email prevention.

Checklist

[ ] Created an external service ledger
[ ] External communications other than cookies were also confirmed.
[ ] Separate necessary functions, analysis, advertisements, and embedding
[ ] Organized target areas and advertising usage.
[ ] Confirmed banner display and tag control separately.
[ ] Tried all permissions, denials, and changes.
[ ] Even if you refuse, you can still use the basic line for reservations and inquiries.
[ ] Banner does not hide reservation button on smartphone
[ ] Privacy policy matches current ledger
[ ] Do not copy text from other sites
[ ] Legal judgments were confirmed with experts as necessary.
[ ] Recorded update date and confirmation person

Summary

Cookie consent support is not just a matter of putting up a conspicuous banner. The main thing is to understand what the accommodation site is sending, for what purpose, and to which business operator, and to create a situation where customers can understand and choose.

AI can help take inventory of external services, compare them to current policies, and organize test items. On the other hand, the host will check with service providers and experts to determine applicable laws, international compatibility, advertising usage, and required functions. First, create a ledger and compile the actual situation and information one by one.