diff --git a/v3/src/components/CookieConsent.astro b/v3/src/components/CookieConsent.astro
index 912e8920..7e1b145e 100644
--- a/v3/src/components/CookieConsent.astro
+++ b/v3/src/components/CookieConsent.astro
@@ -3,21 +3,27 @@ import 'vanilla-cookieconsent/dist/cookieconsent.css';
 import '../assets/styles/ccElegantBlack.css';
 ---
 
-<!--<button type="button" class="cc-button">Show preferences modal</button>-->
 <script>
-  import { run } from 'vanilla-cookieconsent';
+  import { run, showPreferences } from 'vanilla-cookieconsent';
   import { config } from './CookieConsentConfig';
 
   // toggle custom black theme
   document.body.classList.add('cc--elegant-black');
 
-  function checkCookieConsent() {
-    const consentStatus = localStorage.getItem('cookie-accepted');
-    return consentStatus === 'true';
-  }
+  // run() has to be called on every page load, not only before the banner is first
+  // answered: re-applying a stored consent is what calls the analytics service's
+  // onAccept, and that is now the only thing that loads Google Analytics. The library
+  // keeps its own record of whether the banner was answered and decides on its own
+  // whether to show it again.
+  run(config);
 
-  // If consent is not given, run the cookie consent config
-  if (!checkCookieConsent()) {
-    run(config);
-  }
+  // Consent can only be withdrawn if there is a way back into the preferences modal.
+  // The footer links to this anchor.
+  document.addEventListener('click', (event) => {
+    const target = event.target as HTMLElement | null;
+    if (target?.closest('a[href="#cookie-settings"]')) {
+      event.preventDefault();
+      showPreferences();
+    }
+  });
 </script>
diff --git a/v3/src/components/CookieConsentConfig.ts b/v3/src/components/CookieConsentConfig.ts
index 41fe8335..a73c21bb 100644
--- a/v3/src/components/CookieConsentConfig.ts
+++ b/v3/src/components/CookieConsentConfig.ts
@@ -11,6 +11,12 @@ import ko from './cookie/ko.json';
 import zhCN from './cookie/zh-CN.json';
 import zhTW from './cookie/zh-TW.json';
 
+declare global {
+  interface Window {
+    loadGoogleAnalytics?: () => void;
+  }
+}
+
 export const config: CookieConsentConfig = {
   guiOptions: {
     consentModal: {
@@ -37,12 +43,14 @@ export const config: CookieConsentConfig = {
         ga4: {
           label:
             '<a href="https://marketingplatform.google.com/about/analytics/terms/us/" target="_blank">Google Analytics 4</a>',
+          // Defined by Analytics.astro, which only declares the loader and never calls
+          // it, so Google is contacted for the first time here -- after consent.
           onAccept: () => {
-            // TODO: load ga4
-          },
-          onReject: () => {
-            console.log('ga4 rejected');
+            window.loadGoogleAnalytics?.();
           },
+          // Nothing to undo: rejecting means the loader was never called, and the
+          // cookies matched below are erased by the library itself.
+          onReject: () => {},
           cookies: [
             {
               name: /^_ga/,
diff --git a/v3/src/components/common/Analytics.astro b/v3/src/components/common/Analytics.astro
index a1a553dd..c4d8ba02 100644
--- a/v3/src/components/common/Analytics.astro
+++ b/v3/src/components/common/Analytics.astro
@@ -1,13 +1,29 @@
 ---
-import { GoogleAnalytics } from '@astrolib/analytics';
 import { ANALYTICS } from 'astrowind:config';
+
+const gaId = ANALYTICS?.vendors?.googleAnalytics?.id ? String(ANALYTICS.vendors.googleAnalytics.id) : '';
+
+// Nothing is loaded here. This only defines the loader; the analytics service in
+// CookieConsentConfig calls it once the visitor accepts that category, so no Google
+// script runs and no _ga cookie is set before consent is given.
+const loader = `
+window.loadGoogleAnalytics = function () {
+  if (window.__gaLoaded) return;
+  window.__gaLoaded = true;
+
+  var s = document.createElement('script');
+  s.async = true;
+  s.src = 'https://www.googletagmanager.com/gtag/js?id=${gaId}';
+  document.head.appendChild(s);
+
+  window.dataLayer = window.dataLayer || [];
+  window.gtag = function () {
+    window.dataLayer.push(arguments);
+  };
+  window.gtag('js', new Date());
+  window.gtag('config', '${gaId}');
+};
+`;
 ---
 
-{
-  ANALYTICS?.vendors?.googleAnalytics?.id ? (
-    <GoogleAnalytics
-      id={String(ANALYTICS.vendors.googleAnalytics.id)}
-      partytown={ANALYTICS?.vendors?.googleAnalytics?.partytown}
-    />
-  ) : null
-}
+{gaId ? <script is:inline set:html={loader} /> : null}
diff --git a/v3/src/navigation.ts b/v3/src/navigation.ts
index 454bf972..49faf331 100644
--- a/v3/src/navigation.ts
+++ b/v3/src/navigation.ts
@@ -255,6 +255,22 @@ export const footerData = (locale?: Lang) => {
         })
         , href: getPermalink('/privacy')
       },
+      {
+        text: t({
+          en: 'Cookie settings',
+          de: 'Cookie-Einstellungen',
+          es: 'Configuración de cookies',
+          fr: 'Paramètres des cookies',
+          it: 'Impostazioni cookie',
+          ja: 'Cookie設定',
+          pt: 'Configurações de cookies',
+          'zh-cn': 'Cookie 设置',
+          'zh-tw': 'Cookie 設定',
+          ar: 'إعدادات ملفات تعريف الارتباط',
+          ko: '쿠키 설정',
+        })
+        , href: '#cookie-settings'
+      },
     ],
     socialLinks: [
       { ariaLabel: 'X', icon: 'tabler:brand-x', href: 'https://twitter.com/rustdesk' },
diff --git a/v3/src/pages/privacy.md b/v3/src/pages/privacy.md
index 218cf97a..35946af6 100644
--- a/v3/src/pages/privacy.md
+++ b/v3/src/pages/privacy.md
@@ -54,7 +54,7 @@ If you publish any personal data on our Websites, we may process such personal d
 For these purposes of personal data processing, we process the above mentioned personal data under lawful ground of negotiation and performance of a contract (customer and technical support under the RustDesk software license agreement concluded between us and yourself) and legitimate interest (general communication between us and yourself).
 
 ### c. Cookies
-We use various cookie files, which may contain your personal data (e.g. your IP address or the configuration of your browser and computer). We use cookies on the basis of your consent that you express via the cookies settings displayed to you in a banner during your first visit to our Websites. This consent can be subsequently amended / withdrawn via your web browser settings (to the extended allowed by the respective browser).
+We use various cookie files, which may contain your personal data (e.g. your IP address or the configuration of your browser and computer). We use cookies on the basis of your consent that you express via the cookies settings displayed to you in a banner during your first visit to our Websites. No cookie other than those strictly necessary to operate the Websites is set before you give that consent. You can change or withdraw your consent at any time through the “Cookie settings” link in the footer of our Websites.
 
 ### d. RustDesk
 To provide you with the RustDesk software application and to constantly improve our services including customer support, we process following personal data about you and your device: start of the RustDesk software application, IP-address of the device, statistical information about your computer (e.g. CPU-type, screen resolution), time and duration of RustDesk software sessions and RustDesk-IDs of the RustDesk’s session participants.