Cookie Consent and Google Consent Mode: A Guide for Marketers

Why your analytics numbers depend on a banner

If you market to people in Europe, the cookie banner is part of your measurement setup. Under Article 5(3) of the EU ePrivacy Directive, read together with the GDPR's standard for consent, non-essential cookies such as analytics and advertising tags need consent before they're set. The UK regulator, the ICO, puts it plainly: you can't set non-essential cookies on your homepage before the user has consented.

That has two practical consequences. Reported users and conversions fall when a compliant banner goes live, and the fall reflects measurement, not marketing performance. And the way you configure the banner and your tags decides how much of the missing data Google can model back.

This guide is written for marketers, not lawyers. Use it to understand the moving parts, then check your setup with whoever handles legal and privacy for your company.

What a valid banner looks like

European regulators have been specific about banner design. The EDPB's cookie banner taskforce, which coordinated complaints across EU data protection authorities, reported in January 2023 that a vast majority of authorities considered a banner with an accept button and no reject option on the same layer to be an infringement. It also confirmed that pre-ticked boxes don't produce valid consent, citing GDPR recital 32. The ICO says consent must be freely given, specific and informed, and must involve a clear positive action such as ticking a box or clicking a link.

So the checklist for your banner is short. Put reject on the first layer next to accept. Leave every non-essential category unticked. Describe each category in plain words. Make sure no analytics or advertising tag fires before the visitor chooses. Then add a footer link that reopens the banner, because the ICO also expects people to be able to change their settings easily.

The US works on opt-out, with one signal you must honor

US state privacy laws mostly use an opt-out model. California's CCPA gives consumers the right to tell a business to stop selling or sharing their personal information, and a covered business must act on that request within 15 business days. For marketers, the practical question is which tags on your site pass personal information to advertising partners.

The California Attorney General's office states that the Global Privacy Control, a browser signal available in browsers such as Firefox, DuckDuckGo and Brave, must be honored by covered businesses as a valid request to stop the sale or sharing of personal information. The CCPA applies to for-profit businesses that meet any one of its thresholds. One of them is buying, selling or sharing the personal information of 100,000 or more California residents or households; the others are based on revenue.

If you're covered, your consent tool should detect GPC and switch off sale-or-share tags for that visitor automatically. Ask every vendor on your shortlist whether it does.

Consent Mode: basic versus advanced

Google Consent Mode is how Google's tags learn what the visitor chose. It does not collect consent itself: Google's documentation says you are responsible for obtaining consent, through your own banner or a consent management platform. Consent Mode then passes the result along using four main consent types. The analytics_storage and ad_storage types enable storage such as cookies related to analytics and advertising. The two added in version 2, ad_user_data and ad_personalization, set consent for sending user data to Google for advertising and for personalized advertising. Google's guide stresses that the default state must be set before any command that sends measurement data.

There are two ways to implement it. In basic consent mode, Google tags don't load until the visitor interacts with the banner, and nothing is sent before consent, not even the default consent status. In advanced consent mode, tags load when the page opens with consent denied by default, and they send cookieless measurements when the visitor declines. Google says basic mode supports a general model, while advanced mode supports an advertiser-specific model with more detailed modeling.

Which one you use is partly a legal judgment about cookieless pings, so involve whoever owns privacy. From a pure measurement point of view, advanced mode recovers more.

What GA4 modeling needs before it switches on

Behavioral modeling in GA4 estimates the activity of visitors who decline analytics cookies, but only on properties with enough data. Google lists the prerequisites: Consent Mode enabled on all pages, at least 1,000 events a day with analytics_storage denied for at least seven days, and at least 1,000 daily users with analytics_storage granted for at least seven of the previous 28 days. Google adds that meeting those thresholds doesn't guarantee eligibility.

For a small site, modeling may never switch on, and your reports will simply show fewer users after the banner launches. Plan for it. Annotate the launch date, judge campaigns on conversion rates more than raw counts, and use back-end numbers such as orders, sign-ups and CRM leads as your source of truth for volume.

If you mainly need simple traffic reporting, some analytics tools avoid cookies entirely. Plausible, for example, says it doesn't use cookies or persistent identifiers and that you don't need a cookie banner for its analytics. That is the vendor's own position, so run it past your legal advice, but it's one reason privacy-friendly analytics has its own subcategory in our directory. Plausible starts at $9 a month and Fathom Analytics at $15, each with a 30-day trial.

Choosing a consent management platform

A consent management platform, or CMP, shows the banner, stores each visitor's choice, blocks tags until consent and passes the choice to Google Consent Mode and other vendors. Four things separate the options.

The pricing unit comes first. Most small-business CMPs charge per site or domain. iubenda starts at $6.99 per site per month, Termly at $10 per website per month on annual billing, and CookieYes at $10 per domain per month for Basic, with Pro at $25 and Ultimate at $55. All three list free plans, so one small site can start at no cost. Osano's Plus plan is $199 a month, and OneTrust is quote-based for larger privacy programs.

Second, limits: check whether a plan caps pageviews, scanned pages or domains, and what happens when you go over. Third, Consent Mode support: confirm the tool sets all four consent types and supports the implementation you chose. Fourth, regional rules: if you have US visitors, check that it can show a different experience by region and honors Global Privacy Control.

Our privacy and compliance category is ordered by our Overall Score, half Editor Rating and half Market Signal, the 0-100 score we build from Ahrefs and Semrush data. On the data through September 2026, Termly has the highest Market Signal there, followed by OneTrust, Usercentrics and iubenda.

Test it the way a regulator would

After launch, check the banner from a clean browser profile with no saved cookies. Open your browser's developer tools on the Network tab, load the site and confirm that no analytics or advertising requests go out before you click anything. Click reject, browse three pages and confirm the same. Then accept and confirm that your tags fire.

Use Google Tag Assistant to confirm that the consent default is set before the first tag and that it updates when you choose. Repeat the whole check after every change in your tag manager. A single new tag added without consent settings can undo a clean setup, and nobody notices until a complaint arrives.