GA4 uses cookies by default, specifically first-party cookies set on your domain. The primary cookie is _ga with a two-year expiration, which stores a client ID to distinguish unique users. You'll also see _ga_XXXXXXXXXX cookies (where X is your measurement ID) that store session and campaign data. Unlike Universal Analytics, GA4 can function in a cookieless mode when users decline consent or use cookie-blocking browsers. It shifts to modeled data and uses Google signals (from signed-in Google users who've enabled ad personalization) to fill attribution gaps. This makes GA4 more compliant with privacy regulations like GDPR and PIPEDA in Canada, though you still need proper consent management for cookie deployment in most jurisdictions. The consent mode v2 API lets GA4 adjust behavior based on user consent status, sending cookieless pings when consent is denied while still providing aggregated insights. For clients in our portfolio, we configure GA4 with a consent banner that blocks cookie-setting until users opt in, then fires the full tracking. This keeps us compliant with Canadian privacy laws while maximizing data when consent is granted. One practical issue: GA4's cookieless fallback produces less granular user-level data, so conversion attribution gets fuzzier and session counts can be less accurate. If you're running ecommerce or lead-gen campaigns, you want those cookies firing to get clean funnel data. Server-side tagging through Google Tag Manager can extend cookie lifespan and improve accuracy by setting cookies from your own server rather than Google's domain, which browsers treat more favorably. Bottom line is GA4 uses cookies when it can, degrades gracefully when it can't, but you get the best data quality when users accept them.