GDPR (General Data Protection Regulation) is the European Union’s comprehensive legal framework governing the processing of personal data. Processing a user’s data generally requires explicit consent or another lawful basis.
Google Consent Mode is a technical layer that connects that consent directly to measurement tools. If a user doesn’t consent to cookies or tracking, tools like Google Ads and GA4 adjust their data collection behavior accordingly. The campaign keeps running, but measurement can end up incomplete depending on consent.
The European Commission’s GDPR page states that the regulation has been in force since May 25, 2018, and that personal data processing across the EU is bound by a shared set of rules. Google’s Consent Mode documentation explains that the system passes consent status to Google tags through parameters such as ad_storage, analytics_storage, ad_user_data, and ad_personalization.
What Is GDPR?
GDPR is an EU-wide regulation governing the processing and free movement of personal data. It covers not only companies established in the EU, but also companies serving users in the EU.
Consent isn’t the only lawful basis, but it’s the most common one in marketing
GDPR recognizes several lawful bases for processing data. But in marketing and ad measurement, the basis most often relied on is a user’s explicit consent — which is exactly why consent management is such a critical layer.
Compliance isn’t just a cookie banner
Showing a cookie notice alone doesn’t mean you’re compliant. What actually matters is how consent is collected, recorded, and withdrawn. Publishing a banner without checking the record behind it can leave you with a setup that looks compliant but is incomplete in practice.
How Does Google Consent Mode Work?
Consent Mode is a mechanism that passes a site’s consent state to Google tags (gtag, Google Tag Manager).
The default state is set first
When a page loads, the tag first receives a default consent state. Data collection doesn’t begin before the user makes a decision; this default is usually set to a conservative (restricted) value.
The user’s decision updates it afterward
When the user responds to the consent notice, the state updates, and from that point on, data can start flowing for whichever categories were allowed.
What Changed with Consent Mode v2?
In November 2023, two new parameters were added — ad_user_data and ad_personalization — on top of the existing ad_storage and analytics_storage parameters.
Ad personalization became a separate permission
The new parameters make it possible to manage “sending user data related to ads” and “showing personalized ads” as separate permissions. This split allows consent to be read with more granularity.
Setup became mandatory for some Google products
For users in the European Economic Area, certain Google Ads features can only function if Consent Mode is set up. Remarketing and conversion modeling in particular depend on this setup; skipping it can create gaps in measurement and personalization.
What Happens to Measurement When Consent Is Rejected?
When a user rejects consent, no new cookies are created for advertising purposes. That said, some platforms try to fill in the remaining signal through modeling.
Modeled data isn’t observed data
Modeling fills in missing data with a statistical estimate. This is an approach meant to preserve order of magnitude, not an exact count, and reports should be read with that caveat in mind.
For example, if 400 of 1,000 sessions on a campaign reject consent, no ad cookie is ever created for those 400 sessions. The conversion count shown on the dashboard is based on the remaining 600 sessions; the true total may be higher, but that gap isn’t directly visible. Encrypted data matching like Google Enhanced Conversions can close part of that gap — first-party data collected from consenting users comes into play here.
Pre-Launch Checklist
To confirm a Consent Mode setup is working correctly:
- Has it been tested that no data is collected before the consent notice is shown?
- Has it been verified (in network requests) that the accept/reject decision is passed to the tags correctly?
- Is the reporting gap between rejecting and accepting user groups roughly the expected size?
Common Mistake
The most common mistake is treating the cookie notice as a purely visual requirement and never actually testing whether the decision is passed to the tags. The notice may be visible while data is still being collected the same way in the background — that provides the appearance of GDPR compliance, not the substance of it.
Summary
GDPR ties personal data processing to consent and other lawful bases. Google Consent Mode technically carries that consent into tools like Google Ads and GA4. When consent is rejected, measurement narrows, and part of it relies on modeled estimates. Correct setup matters both for compliance and for interpreting measurement realistically.