Google Consent Mode, explained: what is settled and what is not

Sooner or later someone will tell you to "turn on Consent Mode", usually with a promise that it gets back the data you lose when visitors say no to cookies. Be careful. Consent Mode's basic setting is fine: it meets Google's own rules and UK law. The promise rests on the advanced setting, which still measures the people who said no, only without cookies, and nobody has yet settled whether that's lawful in the UK.

This isn't legal advice, so for your own site, ask whoever advises you on data protection.

What Consent Mode actually is

In its help page on consent mode on websites and mobile apps, Google describes Consent Mode as a way to "communicate your users' cookie or app identifier consent status to Google" so that "tags adjust their behavior". Your banner asks the question, and Consent Mode passes the answer on to Google Analytics, Google Ads and similar tags. It doesn't show a banner of its own.

It passes the answer on as separate signals. Google lists them in its consent mode overview, and these are the four that matter to most small and medium businesses:

• analytics_storage: storage such as cookies used for analytics.
• ad_storage: storage such as cookies used for advertising.
• ad_user_data: whether user data may be sent to Google for advertising.
• ad_personalization: whether it may be used for personalised advertising.

Each signal is either granted or denied, and the tags behave accordingly.

Basic and advanced: the difference that matters

Google offers two ways to set it up, and they're very different.

Basic. Google's tags don't load at all until the visitor makes a choice. Google's consent mode overview says that "when the user doesn't consent, no data is transferred to Google at all", and adds: "not even the consent status." Someone who clicks no simply isn't measured.

Advanced. Google's tags load for everyone as the page opens, with consent set to denied by default. While it stays denied, "the Google tags send measurements without cookies", and full measurement starts only if the visitor agrees. Google's analytics help is explicit about what advanced means: "Load Google tags in all cases, not only if the user consents".

Those cookieless measurements, which Google calls pings, still carry information. Google says they "may include the following information: user agent, screen resolution, IP address", and that "Google Analytics does not store or log IP addresses." Google uses them to model, statistically, how the visitors who said no behave.

What's settled

Google's own policy requires consent. If you use Google's advertising or measurement products, its EU user consent policy applies to visitors in "the European Economic Area, the UK and Switzerland", and says you "must obtain end users' legally valid consent to: the use of cookies or other local storage where legally required; and the collection, sharing, and use of personal data for personalization of ads." Consent Mode is how Google's tags find out whether you have that consent.

The UK rule is consent first, unless an exception applies. The ICO's guidance on storage and access technologies sets out the PECR rules on cookies and similar technologies, and says you "must obtain prior consent to the UK GDPR standard for their use, unless an exception applies".

Going cookieless doesn't take you outside the rules. Since the Data (Use and Access) Act 2025, the rule also covers "collecting or monitoring information automatically emitted by the terminal equipment", in the words of section 112 of the Act. A tag that runs in someone's browser and sends details about their device looks to us like what that wording is aimed at, cookie or no cookie. No regulator has yet said so about Consent Mode itself.

Basic mode, done properly, measures nobody who has refused. That's the cautious position, and it's what Google itself describes.

What isn't settled

Whether advanced mode is lawful for visitors who refused. We read six pages of the ICO's guidance on storage and access technologies, including its pages on exceptions and on managing consent, and none of them mentions Consent Mode, or Google at all. There's no regulator view, and we found no UK court ruling, on whether sending cookieless measurements about someone who has clicked no is allowed.

Whether the new statistics exception covers it. Since February 2026, UK law has let some analytics run without consent, where the only purpose is aggregate statistics to improve your own site and the provider acts only for you. Whether Google Analytics meets those conditions is itself unsettled, as our piece on cookie banners for analytics explains, and a visitor who has actively refused is a harder case still.

What we'd do

For a UK business, on what's known today:

1. Use basic mode, or its equivalent. Load Google Analytics and Google Ads only after a visitor agrees. Nothing that's settled requires more, and it avoids the unsettled question entirely.
2. Don't set any consent signal to granted by default for UK visitors. A default of granted switches measurement on for people who haven't agreed, which is the opposite of what the rules ask.
3. Treat advanced mode as a legal decision, not a technical one. If you're considering it, take advice first and write down why you decided it was allowed.
4. Check what you actually have. Many banners and plug-ins set Consent Mode up for you. Ask whoever built the site which version it uses, or check whether Google's tags load before anyone has clicked the banner. If they do, you're on advanced mode, or on no Consent Mode at all.

The modelling may not reach you anyway

The usual reason given for advanced mode is that Google's modelling fills in the visitors you lose. On a small site, check first whether you'd ever qualify. In its help page on behavioural modelling, Google says a property is only eligible if it "collects at least 1,000 events per day with analytics_storage='denied' for at least 7 days" and "has at least 1,000 daily users sending events with analytics_storage='granted' for at least 7 of the previous 28 days".

A thousand consenting visitors a day is a lot for a small or medium business's website, so for many the gaps would simply stay gaps. Your own enquiry records, not modelled figures, are the measure to trust. Setting up proper key events in GA4 makes the consented data you do have far more useful, and the five GA4 reports you need show you where to read it.

What nobody can tell you yet

• The regulator hasn't spoken. Until the ICO addresses Consent Mode, or a court rules, nobody can tell you with authority that advanced mode is allowed in the UK for visitors who refused.
• What the pings are used for. Google describes what the cookieless measurements may contain and says they're used for modelling. We have no independent way to check what happens to them beyond Google's own description.
• How much the modelling helps. Google doesn't publish how accurate its modelling is for properties near the eligibility threshold, and says meeting the thresholds "doesn't guarantee eligibility".
• Change is coming. The ICO says its enforcement approach under the new Act is still being put in place. This piece reflects the position on 28 September 2026.

If you'd like to know what your own set-up really does, our GA4 and tracking fix checks your analytics and consent for a fixed £2,500, over about two weeks.