Most teams install Consent Mode v2 the way you'd renew a licence — a compliance box to tick, handed to whoever manages the tags, done and forgotten. That's exactly the mindset that quietly throws away most of your recoverable data. Because buried inside this "compliance chore" is a single configuration choice that decides whether you recover the majority of the conversions you lose to consent declines, or precisely none of them. Same tool, same compliance status, wildly different outcomes — and most teams never realise there was a decision to make.
Consent Mode v2 is genuinely a compliance requirement, and a non-negotiable one for anyone with European traffic. But it's also a measurement-recovery mechanism, and treating it only as the former is how you end up compliant and blind at the same time. This is what v2 actually is, why it became mandatory, the four signals it runs on, and — above all — the Basic-versus-Advanced decision that determines how much of your lost measurement you get back.
This is general guidance for marketers, not legal advice. The right Consent Mode configuration — especially the Basic-versus-Advanced choice and how you handle cookieless pings — depends on your jurisdiction and risk posture, so confirm your setup with a qualified privacy professional.
What Consent Mode v2 actually is — and why it's mandatory
Consent Mode is Google's mechanism for letting your Google tags — GA4, Google Ads, Floodlight — adjust their behaviour based on the choices a visitor makes in your cookie banner. Rather than a tag either firing fully or being blocked outright, Consent Mode lets it respond to granular signals: send full data, send limited cookieless data, or send nothing, depending on what the person allowed. It's the bridge between the consent your banner collects and the way your measurement tools behave.
The "v2" part matters because, since March 2024, it has been effectively mandatory for any site that uses Google's advertising and measurement products and serves users in the EEA or UK — driven by the EU's Digital Markets Act rather than GDPR directly. The consequence of skipping it is blunt: without valid v2 signals, Google can no longer use data from those visitors for measurement, remarketing, or ad personalization at all. Remarketing audiences stop growing, conversion reporting degrades, and you're quietly losing capability every day you delay. If you run Google tags and have any European traffic, this isn't a "nice to have" — and it sits alongside your other core compliance obligations as table stakes now.
The four signals it runs on
Consent Mode v2 works through four consent parameters your consent management platform must send — two inherited from the original Consent Mode, and two added in v2. Understanding what each controls is what lets you diagnose problems later.
| Signal | Controls | When denied |
|---|---|---|
| ad_storage (v1) | Advertising cookies & identifiers | No ad cookies; conversion pings go cookieless |
| analytics_storage (v1) | Analytics cookies & identifiers | GA4 sends cookieless pings, no client ID |
| ad_user_data (new in v2) | Sending user data to Google for ads | Enhanced conversions disabled |
| ad_personalization (new in v2) | Personalized ads & remarketing | Personalized targeting switched off for the user |
The two original signals govern storage: ad_storage for advertising cookies and analytics_storage for analytics cookies. The two additions are what make it "v2": ad_user_data controls whether user data can be sent to Google for advertising (denying it disables features like enhanced conversions), and ad_personalization controls whether data can fuel personalized ads and remarketing. All four must be sent correctly for v2 to work — and one of the most common failures is a banner that still only sends the two original signals and silently omits the two new ones, leaving you technically broken while appearing fine. This is exactly the sort of thing worth verifying as part of a genuine consent collection flow, not just assumed.
GreenGeeks
Best for: Eco-friendly hosting for beginners & small sites
The decision that actually matters: Basic vs Advanced
Here is the choice almost everyone under-thinks, and the entire reason this post exists. Consent Mode v2 can be implemented in two modes, and they produce dramatically different amounts of recovered data.
Basic mode: Google tags are blocked from loading until the visitor chooses. If they deny consent, nothing is sent to Google — and so there's nothing to model. Recovery on declined traffic: essentially zero.
Advanced mode: tags load immediately in a restricted state. If consent is denied, they send anonymized cookieless pings — no identifiers, just the signal that something happened — which feed Google's conversion modeling. Recovery: a substantial share of the lost journeys back-filled.
The consequence: two sites can both be "Consent Mode v2 compliant" while one recovers most of its lost conversions and the other recovers none. The difference is entirely this setting.
The rule: run Advanced unless your legal or privacy team has a specific, documented objection to cookieless pings. The measurement recovery is too large to leave on the table.
That's the whole game. Basic mode is the more conservative compliance posture — nothing whatsoever is sent before consent — but it recovers nothing, because you can't model data you never collected. Advanced mode sends privacy-safe, identifier-free pings that give Google's models something to work with, and it's what turns Consent Mode from a pure loss-prevention checkbox into an actual data-recovery engine. For most businesses running meaningful Google Ads spend, Advanced is the clear choice; the main reason to choose Basic is a legal team that specifically objects to any pre-consent pings, which is a legitimate but comparatively rare position worth documenting if you take it.
The reframe Consent Mode v2 isn't a box to tick — it's a decision to make. Two sites can both be "compliant" while one recovers most of its lost conversions and the other recovers none. Getting it installed is table stakes; getting the mode right is where the measurement lives.
How conversion modeling fills the gap
The magic of Advanced mode is conversion modeling, and it's worth understanding rather than treating as a black box. When a visitor declines consent, your tags send those anonymized cookieless pings — evidence that an event occurred, stripped of who it belonged to. Google's machine learning then uses the fully-observable patterns from your consented traffic to statistically estimate the likely conversions hidden in the unconsented traffic, back-filling the gap that declines create. Your reports then show an estimate of total conversions rather than only the shrunken, observed subset.
Google has reported that this modeling recovers, on average, a large majority of the ad-click-to-conversion journeys otherwise lost to consent declines — a genuinely material amount. But there's a catch that trips up smaller sites, and it's essential to know before you assume modeling will save you.
Modeling only switches on above certain data thresholds, and this is the trap smaller sites fall into. It requires Advanced mode implemented in the first place (Basic models nothing), a meaningful ad-click volume — commonly cited as around 700 clicks over seven days per country and domain for Google Ads — a full seven-day collection window, and a reasonable consent rate to give the model accuracy. Miss those, and the recovery you were counting on simply doesn't materialise.
The practical implication: modeling is powerful but not magic. High-volume sites clear these thresholds easily and recover a lot; lower-volume sites may fall below them and recover far less, which is exactly why smaller businesses shouldn't assume Consent Mode alone rebuilds their measurement. For them, the answer leans even harder on owned first-party data and on getting more people to consent in the first place, since a higher consent rate both feeds the model and reduces how much you need it.
Getting the setup right
A correct implementation comes down to a handful of essentials that are easy to state and easy to get subtly wrong. Your consent management platform must send all four signals — not just the two originals. You must set a default consent state of "denied" for EEA visitors that fires before any Google tag loads, then update the signals the moment the visitor interacts with the banner — and keep the underlying data clean, since modeling built on messy data inherits the mess. Choosing between Basic and Advanced should be a deliberate decision made with your legal team, not a default someone left unchanged. And enabling URL passthrough helps preserve click attribution even when ad_storage consent is absent, plugging one of the sneakier leaks.
Because so much of this lives in tag configuration wired across several tools, it's a natural fit for the kind of careful, documented setup that a well-integrated martech stack and disciplined no-code tag management make far less error-prone. If your banner recently went live and your analytics cratered, the diagnostic and recovery playbook in our guide to setting up cookie consent without killing your analytics is the companion to this deeper look at the mechanism itself.
What this means for how you read your data
One honest consequence deserves stating plainly: once modeling is in play, a meaningful portion of your reported conversions are estimated, not directly observed. That's not a flaw — it's a far better picture than the alternative of counting only consented users and pretending the rest didn't convert — but it does change how you should interpret the numbers. Modeled data is an informed statistical estimate, so treat it as directionally reliable for decisions rather than as precise, transaction-level truth, and be cautious comparing modeled periods against older fully-observed ones.
This is really one more facet of the broader reality that attribution is getting genuinely harder in a privacy-first world, and the mature response is the same everywhere: hold your platform numbers a little more loosely, triangulate against your own end-to-end funnel data, and remember that this whole shift is a permanent feature of the post-cookie landscape, not a temporary glitch to wait out. It's the same reason a strong consent rate matters so much that it's worth protecting against the fines that come from getting consent wrong, as covered in our look at rising data-privacy fines.
The short version
Consent Mode v2 is both a mandatory compliance requirement and a measurement-recovery mechanism, and treating it only as the first is how teams end up compliant and blind. It's been effectively required since March 2024 for any site using Google tags with EEA or UK traffic, and without it Google can't use those visitors' data for measurement, remarketing, or personalization at all. It runs on four signals — the original ad_storage and analytics_storage plus the v2 additions ad_user_data and ad_personalization — all of which your banner must send. The decision that actually determines your outcome is Basic versus Advanced mode: Basic blocks tags on denial and recovers nothing, while Advanced sends anonymized cookieless pings that let Google's conversion modeling back-fill a large share of the journeys lost to declines. Run Advanced unless your legal team documents a specific objection. Understand that modeling only activates above data thresholds many small sites miss, so lower-volume businesses should lean harder on first-party data and higher consent rates. Set it up carefully — all four signals, default-denied before tags fire, URL passthrough on — and read the resulting numbers as informed estimates rather than exact truth. Get the mode right, and you respect people's choices while keeping the measurement you need to run the business.
Want measurement that survives the privacy era?
We help brands configure consent, tracking, and modeling so the data stays accurate and compliant.
Explore Performance Marketing →Frequently asked questions
What is Consent Mode v2 and is it mandatory?
Consent Mode v2 is Google's mechanism for letting your Google tags — GA4, Google Ads, Floodlight — adjust their behaviour based on the consent choices a visitor makes in your cookie banner. Instead of a tag either firing fully or being blocked outright, Consent Mode lets it respond to granular consent signals, sending full data, limited cookieless data, or nothing, depending on what the user allowed. It has been effectively mandatory since March 2024 for any website that uses Google advertising and measurement products and serves users in the EEA or the UK, driven by the EU's Digital Markets Act rather than GDPR directly. The practical consequence of not implementing it is severe: without valid Consent Mode v2 signals, Google can no longer use data from those visitors for measurement, remarketing, or ad personalization at all — so remarketing audiences stop growing and conversion reporting degrades. If you run Google tags and have any European traffic, it isn't optional, and "we'll get to it" quietly costs you data every day.
What is the difference between Basic and Advanced Consent Mode?
The difference is when your Google tags load and what happens when a visitor denies consent, and it's the single most consequential choice in the whole setup. In Basic mode, Google tags are blocked from loading until the visitor makes a choice, and if they deny consent, nothing is sent to Google at all. In Advanced mode, the tags load immediately in a restricted state and, when consent is denied, send anonymized "cookieless pings" — data with no identifiers — that feed Google's conversion modeling. That distinction has enormous consequences: Basic mode blocks tags entirely on denial, so it models nothing and you recover none of the lost data, while Advanced mode gives Google's machine learning the signal it needs to back-fill a substantial share of the conversions lost to declines. The practical recommendation across the industry is to run Advanced mode unless your legal or privacy team has a specific documented objection to cookieless pings, because the measurement recovery is too significant to leave on the table.
How does conversion modeling recover lost data?
When a visitor declines consent under Advanced Consent Mode, your tags still send anonymized, cookieless pings — signals that an event happened without any identifying information about who it happened to. Google's machine learning uses the patterns from your consented traffic, where the full journey is observable, to model the likely conversions among the unconsented traffic where only these anonymous pings exist. In effect, it statistically back-fills the gap that consent declines create, so your reporting reflects an estimate of total conversions rather than only the shrunken observed subset. Google has reported that this modeling recovers, on average, a large majority of the ad-click-to-conversion journeys otherwise lost to consent declines. There's an important catch, though: modeling only activates above certain data thresholds — commonly cited as around 700 ad clicks over seven days per country and domain for Google Ads, plus minimum volumes for GA4 behavioural modeling. Sites below those thresholds get far less recovery, which is a key thing to understand before you assume modeling will fully solve the gap.
What are the four Consent Mode v2 signals?
There are four consent parameters your consent management platform must send, two inherited from the original Consent Mode and two added in v2. The two original signals are ad_storage, which governs whether advertising cookies and identifiers can be stored, and analytics_storage, which governs analytics cookies and identifiers; when analytics_storage is denied under Advanced mode, GA4 sends cookieless measurement pings instead of writing a client identifier. The two new v2 signals are ad_user_data, which controls whether user data can be sent to Google for advertising purposes (denying it disables features like enhanced conversions), and ad_personalization, which controls whether data can be used for personalized advertising and remarketing (denying it switches off personalized targeting for that user). All four must be sent correctly by your banner for Consent Mode v2 to work and for you to retain Google advertising and measurement capabilities for European visitors. A common failure is a cookie banner that only sends the two original signals and silently omits the two new ones.
