Google Consent Mode, explained: what is settled and what is not

If you have a cookie banner and Google Analytics, you will sooner or later be told to "turn on Consent Mode", often with a promise that it gets back the data you lose when people click no. Some of that is true. Some of it rests on a legal question nobody in the UK has answered yet.

This piece separates the two. Everything is taken from Google's documentation, the Information Commissioner's Office and the law itself, as they read on 28 September 2026. It is not legal advice, and for your own site you should ask whoever advises you on data protection.

What Consent Mode actually is

Google describes Consent Mode as a way to "communicate your users' cookie or app identifier consent status to Google" so that "tags adjust their behavior" (Google, consent mode on websites and mobile apps). Your banner asks the question; Consent Mode passes the answer on to Google Analytics, Google Ads and similar tags. It does not show a banner of its own.

It passes it as a few separate signals. Google lists them in its consent mode overview, and the four that matter to most small businesses are:

• analytics_storage: storage such as cookies used for analytics.
• ad_storage: storage such as cookies used for advertising.
• ad_user_data: whether user data may be sent to Google for advertising.
• ad_personalization: whether it may be used for personalised advertising.

Each one is either granted or denied, and the tags behave accordingly.

Basic and advanced: the difference that matters

Google offers two ways to set it up, and they are very different.

Basic. Google's tags do not load at all until the visitor makes a choice. In Google's words, "when the user doesn't consent, no data is transferred to Google at all – not even the consent status." Someone who clicks no is simply not measured.

Advanced. Google's tags load for everyone as the page opens, with consent set to denied by default. While it stays denied, "the Google tags send measurements without cookies", and full measurement starts only if the visitor agrees. Google's analytics help is explicit about what advanced means: "Load Google tags in all cases, not only if the user consents" (Google, consent mode on websites and mobile apps).

Those cookieless measurements, which Google calls pings, still carry information. Google says they "may include the following information: user agent, screen resolution, IP address", and that "Google Analytics does not store or log IP addresses." Google uses them to model, statistically, the behaviour of the visitors who said no.

What is settled

Google's own policy requires consent. If you use Google's advertising or measurement products, its EU user consent policy applies to visitors in "the European Economic Area, the UK and Switzerland", and says you "must obtain end users' legally valid consent to: the use of cookies or other local storage where legally required; and the collection, sharing, and use of personal data for personalization of ads." Consent Mode is how Google's tags learn whether you have it.

The UK rule is consent first, unless an exception applies. The ICO's guidance on storage and access technologies says you "must obtain prior consent to the UK GDPR standard for their use, unless an exception applies" (ICO, what are the PECR rules?).

Going cookieless does not take you outside the rules. Since the Data (Use and Access) Act 2025, the rule also covers "collecting or monitoring information automatically emitted by the terminal equipment" (Data (Use and Access) Act 2025, section 112). A tag that runs in someone's browser and sends details about their device looks like what that wording is aimed at, cookie or no cookie, though no regulator has yet said so about Consent Mode itself.

Basic mode, done properly, measures nobody who has refused. That is the conservative position, and it is what Google itself describes.

What is not settled

Whether advanced mode is lawful for visitors who refused. We searched six pages of the ICO's guidance on storage and access technologies on 28 September 2026, including its pages on exceptions and on managing consent, and none mentions Consent Mode, or Google at all. There is no regulator view, and we found no UK court ruling, on whether sending cookieless measurements about someone who has clicked no is allowed.

Whether the new statistics exception covers it. Since February 2026, UK law has let some analytics run without consent, where the only purpose is aggregate statistics to improve your own site and the provider acts only for you. Whether Google Analytics meets those conditions is itself unsettled, which we explain in do you need a cookie banner for analytics? A visitor who has actively refused is a harder case still.

What we would do

For a small business in the UK, on what is known today:

1. Use basic mode, or its equivalent. Load Google Analytics and Google Ads only after a visitor agrees. Nothing that is settled requires more, and it avoids the unsettled question entirely.
2. Do not set any consent signal to granted by default for UK visitors. A default of granted switches measurement on for people who have not agreed, which is the opposite of what the rules ask.
3. Treat advanced mode as a legal decision, not a technical one. If you are considering it, take advice first and record why you decided it was allowed.
4. Check what you actually have. Many banners and plug-ins set Consent Mode up for you. Ask whoever built the site which version it uses, or check whether Google's tags load before anyone has clicked the banner. If they do, you are on advanced mode, or on no Consent Mode at all.

The modelling may not reach you anyway

The usual reason given for advanced mode is that Google's modelling fills in the visitors you lose. For a small site, check first whether you would ever qualify. Google says a property is only eligible for behavioural modelling if it "collects at least 1,000 events per day with analytics_storage='denied' for at least 7 days" and "has at least 1,000 daily users sending events with analytics_storage='granted' for at least 7 of the previous 28 days" (Google, behavioural modelling).

A thousand consenting users a day is far more than most small business websites see, so for many the gaps would stay gaps. Your own enquiry records, not modelled figures, are the reliable measure, and setting up proper key events in GA4 makes the consented data you do have far more useful; the five GA4 reports you need shows where to read it.

Where the evidence is thin

• The regulator has not spoken. The ICO's guidance does not mention Consent Mode. Until it does, or a court rules, nobody can tell you with authority that advanced mode is allowed in the UK for visitors who refused.
• What the pings are used for. Google describes what the cookieless measurements may contain and says they are used for modelling. We have no independent way to check what happens to them beyond Google's own description.
• How much modelling helps. Google does not publish how accurate its modelling is for properties near the eligibility threshold, and says meeting the thresholds "doesn't guarantee eligibility".
• Change is coming. The ICO says its enforcement approach under the new Act is still being put in place. This piece reflects the position on 28 September 2026.

If you would like your analytics and consent set-up checked by someone who will tell you what it actually does, our GA4 and tracking fix is a fixed £2,500 and takes about two weeks.