Consent Mode v2 and GA4: What Changes in Your Data

Did your GA4 users and sessions fall after you added a cookie banner? Consent mode v2 is probably part of the reason. It is not a bug. Consent mode v2 GA4 setups change how Google tags behave when a visitor says no to cookies, and that changes what lands in your reports.

In this guide I explain what each consent signal does, how basic and advanced mode differ, how modelling fills some of the gap, and how I set it all up and check it. It is a practical guide, not legal advice. Your privacy duties depend on where you and your visitors are, so check them with someone qualified.

What Consent Mode v2 Actually Is

Consent mode is Google’s way of letting your cookie banner talk to Google tags. Your banner records the visitor’s choice. Consent mode passes that choice to the Google tag, GA4, Google Ads and Floodlight. Those tags then change what they store and send.

The “v2” part came from Google’s update ahead of the EU’s Digital Markets Act. Since March 2024, Google has expected two extra signals for traffic from the European Economic Area (EEA). You need them if you want to keep using features such as remarketing and personalised ads.

Consent mode does not create a banner, and it does not make you compliant on its own. It only carries the decision your banner records. I see this mixed up a lot, so it is worth saying clearly. Consent mode is also a separate topic from third-party cookies in Chrome. I cover that in my article on Chrome keeping third-party cookies.

The Four Consent Parameters

Consent mode v2 is built on four parameters. Each one is set to either granted or denied.

• ad_storage controls ad storage, such as ad cookies on the web or device IDs in apps.
• analytics_storage controls analytics storage, such as the first-party cookies GA4 uses to recognise a returning browser.
• ad_user_data controls whether user data can be sent to Google for online advertising.
• ad_personalization controls whether data can be used for personalised ads, including remarketing.

The first two are the original consent mode signals. The last two are the v2 additions. Google also supports functionality_storage, personalization_storage and security_storage. But GA4 and Google Ads behaviour depends on the four above.

What Happens When Each One Is Denied

• analytics_storage denied: GA4 does not read or write its first-party cookies. In advanced mode it still sends cookieless pings that Google can use for basic measurement and modelling.
• ad_storage denied: no new ad cookies are written and old ones are not read. IP addresses are shortened in requests.
• ad_user_data denied: personal data for ads, such as a user_id or hashed enhanced conversions data, is not sent for ads use.
• ad_personalization denied: the visitor’s data is not used for remarketing or personalised ads.

A simple example: a visitor accepts analytics cookies but rejects marketing ones. Your banner should set analytics_storage to granted and the three ad signals to denied. GA4 measures them normally. But they will not join remarketing audiences you share with Google Ads.

Basic vs Advanced Consent Mode

This is the choice that affects your GA4 numbers the most. Google describes two ways to set up consent mode, and they behave very differently for visitors who say no.

In advanced mode, the cookieless pings carry things the browser sends anyway, such as a timestamp, user agent and referrer. They also carry details that do not identify anyone, such as the consent state and whether an ad click ID was in the URL. They do not set or read cookies.

Which mode you pick is a business and legal decision, not a technical one. Some organisations decide no request should reach Google before consent. That means basic mode. Others accept cookieless pings to get better modelling. Make the decision with whoever owns privacy in your business. I never make this call alone for a site, and I don’t think you should either.

Behavioural and Conversion Modelling in GA4

When visitors decline analytics cookies, GA4 can no longer link their visits together. Behavioural modelling uses machine learning to estimate how those visitors behave, based on similar visitors who did consent.

Conversion modelling works in a similar way for key events. It estimates conversions that could not be seen directly, so your key event totals are less undercounted.

The Eligibility Thresholds

Behavioural modelling is not automatic for every property. According to Google’s GA4 behavioural modelling documentation, a property needs:

• Consent mode turned on for all pages of the site (or all app screens).
• Google tags that load before the consent dialog appears, and load every time, not only after consent. In practice this means advanced mode.
• At least 1,000 events per day with analytics_storage denied, for at least 7 days.
• At least 1,000 daily users sending events with analytics_storage granted, for at least 7 of the previous 28 days.

Meeting those numbers does not guarantee eligibility. Google also looks at other factors, and the model may need more than 7 qualifying days to train.

Two more details catch people out. Modelled data only appears from the date the property becomes eligible. Nothing is filled in for earlier dates. And if a property loses eligibility and gets it back later, modelled data restarts from the new date.

Turn on Blended Reporting Identity

Even an eligible property only shows modelled data if the reporting identity is set to Blended. Go to Admin > Data display > Reporting identity, choose Blended and save. You need Editor access or higher.

Switching identity does not change what GA4 collects. It only changes what the reports show, so you can switch back if you want to compare. This is one of the first settings I check when someone tells me modelling “isn’t working”.

Where Modelled Data Does and Does Not Appear

Modelling applies to metrics such as users, sessions and new users in standard reports. It does not apply to raw event counts like page_view, first_visit or session_start in reports.

It is not supported in audiences, the user explorer, cohort and user lifetime explorations, segments with sequences, retention reports, predictive metrics or the BigQuery export. If your BigQuery numbers never match the GA4 interface, this is one reason why.

Look for the data quality icon at the top of a report. It tells you if that view includes estimated user data, leaves it out, or has none available.

Using a CMP: Google-Certified Consent Platforms

In my view, most sites should not hand-code a consent banner. A consent management platform (CMP) runs the banner, saves each visitor’s choice, and sends the consent mode signals for you.

Google runs a CMP Partner Program and lists CMPs that work with consent mode. Some publishers show Google ads through AdSense, Ad Manager or AdMob. For them, a Google-certified CMP that works with the IAB Transparency and Consent Framework (TCF) is required for personalised ads to users in the EEA and UK since 16 January 2024, and in Switzerland since 31 July 2024.

If you only run GA4 and Google Ads as an advertiser, you are not forced to use a certified CMP. But it is the sensible route. When choosing one, check that:

• It sets all four v2 parameters, not only the original two.
• It offers a Google Tag Manager template in the Community Template Gallery, if you use GTM.
• It supports different behaviour by region, so you can treat EEA and UK visitors differently from others if your policy allows.
• It saves consent and sends it again on every page, because consent mode itself does not remember choices.

Google is clear that certification does not mean it has checked a CMP for full compliance with privacy law. The wording and design of your banner are still your job.

How to Set Up Consent Mode v2 With gtag.js

If you add the Google tag directly to your site, consent mode needs two commands: a default and an update. The order matters more than anything else.

Step 1: Set Defaults Before the Google Tag Loads

Place this in the <head> of every page, above the Google tag snippet. It tells tags what to assume before the visitor has chosen.

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}

  gtag('consent', 'default', {
    'ad_storage': 'denied',
    'ad_user_data': 'denied',
    'ad_personalization': 'denied',
    'analytics_storage': 'denied',
    'wait_for_update': 500
  });
</script>
<!-- Google tag (gtag.js) snippet goes after this -->

wait_for_update is in milliseconds. It gives a CMP that loads in the background up to half a second to send an update before tags fire.

Step 2: Send an Update When the Visitor Chooses

When the visitor clicks accept, or saves custom choices, call the update command with the matching values.

function consentGrantedAll() {
  gtag('consent', 'update', {
    'ad_storage': 'granted',
    'ad_user_data': 'granted',
    'ad_personalization': 'granted',
    'analytics_storage': 'granted'
  });
}

Your banner must also save the choice and send the update again on later pages. If it does not, each new page falls back to the denied defaults.

Optional Settings Worth Knowing

• Regional defaults: add a region array using ISO 3166-2 codes, such as 'region': ['ES', 'US-AK']. A default without a region applies everywhere else, and the more specific region wins.
• URL passthrough: gtag('set', 'url_passthrough', true); lets ad click and session details travel in URLs when cookies are denied. It must come before any config command.
• Ads data redaction: gtag('set', 'ads_data_redaction', true); hides ad click IDs in Google Ads and Floodlight requests when ad_storage is denied.

Google’s consent mode setup guide for websites has the full reference for both basic and advanced setups.

Setting Up Consent Mode v2 in Google Tag Manager

Most sites run GA4 through GTM, and here the CMP template does most of the work. The key is making sure consent is set before anything else fires.

1. Install your CMP’s consent mode template from the Community Template Gallery.
2. Set the template’s default states for all four parameters, including any regional defaults.
3. Fire the CMP tag on the Consent Initialization – All Pages trigger. This trigger always fires before every other trigger, including Initialization.
4. Keep your Google tag and GA4 event tags on their normal triggers. Google tags have built-in consent checks and adjust on their own to analytics_storage and ad_storage.
5. For non-Google tags, such as other ad pixels, use Additional consent checks in the tag’s advanced settings. Then they only fire when the right consent is granted.
6. Turn on Consent Overview in Container Settings. It lists every tag as configured or not configured, so you can spot gaps fast.

There are two mistakes I’d avoid. Do not call gtag('consent', 'update', ...) from a Custom HTML tag in GTM, because gtag commands are queued and may run too late. And do not set consent defaults in a tag that fires on a later trigger, or some tags may read cookies before consent is applied.

If you are planning a site rebuild, add the consent setup to your website migration checklist. Banners and tag containers are easy to lose when templates change.

How to Verify Consent Mode With Tag Assistant

Never assume a CMP is sending the right signals. Check it yourself in Tag Assistant, ideally in Chrome with the Tag Assistant Companion extension. I do this on every site, even when the CMP vendor says it is all set.

1. Open Tag Assistant, enter your site’s URL and connect. Your site opens in a new tab.
2. Before touching the banner, select the earliest Consent event in the summary. In the API call, check that all four parameters have a default.
3. Click a tag, open its Consent tab, and check the On-page Default column shows the values you expect.
4. Accept (or reject) on the banner. Select the latest Consent event and check that the On-page Update column changed to match.
5. Open the Tags tab and check that each tag respected the consent state.
6. If you use regional defaults, repeat the test with a simulated location in Chrome.

Common problems show up clearly here. An empty Consent tab means consent mode is not on the page at all. Defaults missing for some parameters, or set after tags have fired, mean the default code is in the wrong place or on the wrong trigger.

You can also check the network requests GA4 sends. The gcs parameter carries the ad_storage and analytics_storage state. The gcd parameter carries the detailed state of each consent type.

Check GA4’s Own Consent Settings

In GA4, go to Admin. Under Data collection and modification, open Consent settings and choose your data stream. GA4 shows if it is receiving signals for ads measurement (ad_user_data) and ads personalisation (ad_personalization).

After a fix, give it time. Google says these notices can take 48 to 72 hours to update.

Why GA4 Numbers Drop After Consent Mode v2

A drop after adding consent is expected. The real question is whether the drop comes from real consent choices or a broken setup. These are the usual causes.

• You use basic mode. Visitors who say no are never measured. If 40% of visitors reject cookies, about that share of traffic is missing from GA4.
• You use advanced mode but do not qualify for modelling. Cookieless pings arrive, but without modelling they do not rebuild users and sessions. Smaller sites often never reach the 1,000-per-day thresholds.
• Reporting identity is not Blended. Modelling may be running, but the reports are hiding it.
• Modelling has only just started. Estimates begin from the eligibility date, so earlier weeks stay lower.
• Defaults fire too late, or updates never fire. Tags may act in odd ways, and visitors who accepted may still be treated as denied on later pages.
• You compare different views. Explorations, BigQuery and standard reports treat modelled data differently, so totals will not match.

To find the cause, note the date the consent changes went live and compare traffic before and after. A sudden step on that exact day points to consent choices. A slow slide, or a drop in only some parts of the site, points somewhere else.

Cross-check with Search Console. It does not depend on cookies, so organic clicks should stay steady if only GA4 measurement changed. Its weekly and monthly views make that comparison easier. This is my usual sanity check before anyone panics about lost traffic.

Practical Tips for Cleaner Data

• Add a note, or keep a simple log, of the date you changed consent settings. You will need it every time someone asks why traffic fell.
• Report organic performance from Search Console and on-site behaviour from GA4. Don’t expect GA4 to show every visit.
• Test again with Tag Assistant after every CMP update, theme change or new tag.
• Keep your banner honest and clear. Design tricks that push people to accept may raise consent rates, but they can create legal risk. I would not use them.

Conclusion

Consent mode v2 GA4 setups trade some visibility for respecting what visitors choose. Set all four parameters, and set defaults before any tag fires. Choose between basic and advanced mode with your privacy owner. Then check the result in Tag Assistant and GA4’s consent settings.

After that, treat GA4 as a modelled view, not a perfect count. If you are planning measurement work for the year, add these checks to your 2026 SEO plan so tracking gets reviewed with everything else.