GDPR compliance with Google Analytics 4 consent mode
Consent mode passes a visitor's consent choice to Google's tags so that Google Analytics 4 adjusts what it collects. This guide covers the consent types, the difference between basic and advanced consent mode, what is sent when consent is denied, how to set it up, and how behavioral modeling estimates the visitors you cannot observe. It is not legal advice.
Consent mode passes a visitor’s cookie choice to the Google tag, so Google Analytics 4 adjusts what it collects: with consent it sets its cookies as usual, and without consent it does not read or write analytics cookies. It does not ask for consent, and it does not make a setup compliant by being switched on.
This guide explains what consent mode does, the choice between its two versions, how to set it up, and what happens to your reports. It is based on Google’s documentation and is not legal advice. The legal background is in the guide to Google Analytics and the GDPR.
What consent mode is
Google’s description: consent mode lets website and app developers “adjust tag and app SDK behavior based on user consent choices” (Consent mode overview, checked October 2026). The same page lists what you have to do, and it is three separate jobs:
- Obtain the visitor’s choice. “You are responsible for obtaining users’ consent”, with a consent banner or a consent management platform (CMP).
- Communicate the choice to Google. Many CMPs do this for you.
- Make sure tags behave accordingly. Google’s own tags have built-in consent checks. Other tags need them added in Tag Manager.
Consent mode is job 2 and part of job 3. Job 1 is yours.
The consent types
| Consent type | What it controls |
|---|---|
ad_storage |
Storage, such as cookies, related to advertising |
ad_user_data |
Sending user data to Google for online advertising purposes |
ad_personalization |
Personalized advertising |
analytics_storage |
Storage, such as cookies, related to analytics, for example visit duration |
functionality_storage |
Storage that supports the functionality of the site, for example language settings |
personalization_storage |
Storage related to personalization, for example video recommendations |
security_storage |
Storage related to security, such as authentication and fraud prevention |
Each type is either granted or denied. For Google Analytics the one that matters is analytics_storage. ad_user_data and ad_personalization are the two added later, often called consent mode v2, and Google needs them for visitors from the European Economic Area if you use Analytics data in its advertising products.
OWOX Data Marts
See your first report built in real time. 15 minutes.
- Connect your data warehouse
- Pick your metrics
- Get a live Google Sheets report
In the time it takes to write a ticket. Then imagine never writing that ticket again.
Book a DemoWe'll use your actual use case
Basic or advanced consent mode
Basic or advanced consent mode
This is the decision with legal weight, and it is yours to make with your data protection officer.
| Basic consent mode | Advanced consent mode | |
|---|---|---|
| When Google tags load | Only after the visitor interacts with the banner | When the page opens, with consent denied by default |
| If the visitor denies consent | “No data is transferred to Google at all, not even the consent status” | Tags send measurements without cookies, known as cookieless pings |
| Modeling | Based on a general model | Based on your own data, which Google says improves it |
The quotation is Google’s. The trade-off is plain: advanced mode gives better modeled numbers because it still sends something for every visitor.
What a cookieless ping contains matters for that decision. Google states that when analytics_storage is denied, no Analytics cookies are set, accessed or read, and that the pings “may include the following information: user agent, screen resolution, IP address”, while noting that Google Analytics does not store or log IP addresses (consent mode reference). Whether sending that without consent is acceptable is a legal question that regulators in different countries may answer differently. If the answer for you is no, use basic mode.
How to set up consent mode
- Choose a consent management platform. Google runs a CMP partner program; a certified CMP sends the consent state to Google without custom code. A banner you build yourself also works if it calls the consent API.
- Set the default state before any tag fires. For visitors in the EEA the default is normally denied for every type:
gtag('consent', 'default', {
ad_storage: 'denied',
ad_user_data: 'denied',
ad_personalization: 'denied',
analytics_storage: 'denied'
});- Update the state when the visitor chooses:
gtag('consent', 'update', {
analytics_storage: 'granted'
});- Check tags without built-in consent checks. In Google Tag Manager, open the tag, go to Advanced Settings, Consent Settings, and require the consent types it needs.
- Test. In Tag Manager’s preview mode, the Consent tab shows the default and updated state for each event. Then check in GA4 under Admin that the property reports it is receiving consent signals.
Use update for the visitor’s choice, not a second default. Google lists that mistake as a cause of (not set) values, because the session start is lost. More in what (not set) means in GA4.
What happens to your reports
When visitors decline, their events are not tied to a persistent identifier. Google’s example: if Analytics collects 10 page views, “it can’t observe and report whether that’s 10 users or 1 user”.
Behavioral modeling fills that gap. Google’s definition: it “uses machine learning to model the behavior of users who decline analytics cookies based on the behavior of similar users who accept analytics cookies” (Behavioral modeling for consent mode). It estimates metrics such as daily active users and key event rate. It does not reconstruct individual people, and it is trained on the consented data of your own property.
Three things follow for anyone reading the reports:
- User counts in GA4 can be partly estimated. The reporting identity setting decides whether modeled data is included.
- Modeling has prerequisites. A property with little traffic or a low consent rate may not qualify, and then the declined visitors are simply missing.
- The BigQuery export contains observed events, not modeled ones. Numbers in the interface and in the export will differ for this reason, and the difference grows with the share of visitors who decline.
What consent mode does not do
- It does not show a banner or record consent for your own audit trail.
- It does not control tags that have no consent checks.
- It does not decide whether analytics needs consent in your country. Your regulator does.
- It does not cover the rest of the GDPR: retention, the data processing terms and your privacy notice are separate, and are covered in Google Analytics and the GDPR.
Turn your data into decisions.
Governed data marts give you the clean foundation ML needs to actually work.
- No AI hallucinations
- Analyst-governed definitions
- Every number traces to SQL
Frequently Asked Questions
Which consent types does consent mode have?
Seven: ad_storage, ad_user_data, ad_personalization, analytics_storage, functionality_storage, personalization_storage and security_storage. For Google Analytics the main one is analytics_storage.
What happens if a visitor withdraws consent?
The consent state is updated to denied and, from that point, the Google tag stops reading and writing analytics cookies. Data already collected is not removed automatically.
What is sent to Google when a visitor denies consent?
In basic consent mode, nothing. In advanced consent mode, cookieless pings: events without Analytics cookies, which Google says may include the user agent, screen resolution and IP address, and it notes that Google Analytics does not store or log IP addresses.
How does consent mode affect GA4 reports?
Events from visitors who decline are not tied to a persistent identifier. GA4 can estimate them with behavioral modeling, which models the behaviour of visitors who decline from similar visitors who accept. The BigQuery export contains only observed events, so it differs from the interface.
Does Google Analytics 4 need consent?
In most EU countries, national cookie rules require consent before analytics cookies are set, with narrow exemptions that differ by country. Google also requires consent signals for visitors from the European Economic Area if you use Analytics data in its advertising products. Check your regulator's guidance.
What is the difference between basic and advanced consent mode?
In basic consent mode Google tags do not load until the visitor interacts with the banner, and nothing is sent to Google if consent is denied. In advanced consent mode the tags load with consent denied by default and send cookieless pings until the visitor chooses, which gives Google more data for modeling.
Does consent mode obtain consent from visitors?
No. Google states that you are responsible for obtaining users' consent, with a consent banner or a consent management platform. Consent mode passes the result to the tags.
What is consent mode in Google Analytics 4?
Consent mode communicates a visitor's consent choice to Google's tags, which then adjust their behaviour. With analytics consent granted, the tag sets its cookies as usual. With it denied, no Analytics cookies are set or read.
