Consent Mode v2: What It Means for Your Marketing Data

If you run Google Ads or use Google Analytics, Consent Mode v2 is no longer optional. It is the mechanism that determines how much of your marketing data you actually get to keep when visitors decline tracking cookies.

Since March 2024, Consent Mode v2 has been mandatory for advertisers targeting users in the European Economic Area and the UK. But enforcement has intensified significantly through 2025 and into 2026. Reports from PPC Land documented cases where advertisers saw conversion data drop by up to 90% after enforcement tightened, because their implementations were misconfigured or incomplete.

For Australian businesses, the direct legal requirement is the Privacy Act rather than the GDPR. But if you advertise to any international audience, use Google's advertising products, or want to future-proof your measurement against Australia's own evolving privacy legislation, understanding and implementing Consent Mode v2 is essential. Here is what it does, how it affects your data, and what to prioritise.

What Consent Mode v2 Actually Does

Consent Mode is a framework that sits between your consent management platform (the cookie banner your visitors see) and Google's tags (Analytics, Ads, Floodlight). It communicates the visitor's consent choices to Google's tags in real time, adjusting their behaviour accordingly.

Version 2 introduced two new consent signals beyond the original analytics and ad storage controls:

• ad_user_data: Controls whether user data can be sent to Google for advertising purposes. When denied, Google cannot use the visitor's data for audience building or conversion measurement tied to an individual.
• ad_personalization: Controls whether the visitor's data can be used for remarketing and personalised advertising. When denied, the visitor is excluded from remarketing audiences and personalised ad targeting.

These signals are sent alongside the original two:

• analytics_storage: Controls whether GA4 can set cookies. When denied, GA4 switches to cookieless measurement pings.
• ad_storage: Controls whether advertising cookies (like the Google Ads click ID) can be set.

When a visitor declines consent, the tags do not simply stop firing. This is the key point that many implementations get wrong. In Consent Mode, the tags continue to send "cookieless pings" to Google, which include limited, non-identifying information: the page URL, a timestamp, user agent string, and an aggregate consent state. These pings are the raw material for Google's conversion and behavioural modelling.

Basic Mode vs Advanced Mode: A Critical Distinction

Consent Mode v2 can operate in two modes, and the difference has a significant impact on your data quality.

Basic Mode

Google tags are completely blocked until the visitor grants consent. If they decline, no data is sent at all. This is the simplest implementation and the one that causes the most data loss. You only measure visitors who actively accept cookies.

Given that cookie acceptance rates globally sit around 31%, Basic Mode means you are measuring less than a third of your traffic. For businesses running significant ad spend, that is a substantial blind spot.

Advanced Mode

Google tags load on every page and send cookieless pings even when consent is denied. No cookies are set for non-consenting visitors, so individual-level tracking does not occur. But the aggregate data from these pings feeds Google's machine learning models, which estimate the conversions and behaviour of non-consenting visitors based on patterns observed in consenting users.

Advanced Mode is what Google recommends, and it is the only mode that enables conversion modelling and behavioural modelling in GA4 and Google Ads. Google's conversion modelling can recover up to 70% of attribution paths that would otherwise be lost due to consent refusals. Organisations using Advanced Mode can typically recover 30 to 65% of conversion data through modelled estimates.

If you have implemented Consent Mode v2 but are running Basic Mode, you are getting almost none of the data recovery benefits. Switching to Advanced Mode should be a priority.

How Consent Mode v2 Affects Conversion Tracking

The impact depends on your consent rates and implementation mode, but the mechanics are consistent:

What You Lose

When a visitor declines consent, you lose the ability to:

• Set or read the Google Ads click ID cookie (_gcl_aw), which ties ad clicks to conversions
• Set or read the GA4 client ID cookie (_ga), which identifies returning visitors
• Build remarketing audiences that include that visitor
• Track cross-session behaviour for that individual
• Attribute conversions at the individual level

What Modelling Recovers

Conversion modelling in Google Ads uses machine learning to estimate conversions from non-consenting users. It analyses patterns in consenting user behaviour and applies those patterns probabilistically to the cookieless ping data. The modelled conversions appear in your Google Ads reports alongside observed conversions.

Behavioural modelling in GA4 does something similar for analytics data: it estimates the behaviour of non-consenting visitors based on the aggregate patterns of those who did consent.

However, modelling has minimum data thresholds. Google Ads conversion modelling requires at least 700 ad clicks over 7 days for a given domain and country combination. GA4 behavioural modelling requires at least 1,000 daily events from both consenting and non-consenting users. If your site does not meet these thresholds, modelling will not activate, and your data gaps will persist.

Impact on Audience Building and Remarketing

Consent Mode v2's ad_personalization signal has a direct impact on your remarketing audiences. When a visitor denies ad_personalization consent, they are excluded from remarketing lists entirely. There is no modelling workaround for this. You cannot remarket to someone who has explicitly declined personalised advertising.

For businesses that rely heavily on remarketing, this means audience sizes will shrink in proportion to the percentage of visitors who decline consent. In European markets where consent banners are ubiquitous and refusal rates are high, some advertisers have seen remarketing audience sizes decrease by 40 to 60%.

The practical response is twofold. First, make your consent experience clear and non-manipulative but also genuinely informative about what the visitor gains by accepting (personalised, relevant ads rather than random ones). Second, diversify your targeting beyond remarketing. First-party data audiences built from CRM data, customer match lists, and lookalike audiences based on your existing customers are not subject to the same consent constraints because the data relationship is direct.

What to Implement Before It Is Too Late

Google is consolidating all Google Ads data controls under Consent Mode, with a structural change on 15 June 2026 that removes Google Signals as a data control backstop. If your implementation is not correct by then, you will lose access to features that previously worked regardless of consent state.

Here is what to prioritise:

1. Audit Your Current Implementation

Check whether Consent Mode v2 is actually sending all four consent signals (analytics_storage, ad_storage, ad_user_data, ad_personalization) to Google's tags. Many implementations only send the original two signals, which means they are not v2-compliant. Use Google Tag Assistant or the browser's network tab to inspect the consent parameters being sent with each tag fire.

2. Switch to Advanced Mode

If you are running Basic Mode, switch to Advanced Mode. This requires configuring your tags to load with default consent states (typically "denied" for all four signals) and then updating those states when the visitor makes a choice. The technical implementation varies by consent platform, but most major CMPs (Cookiebot, OneTrust, Usercentrics, CookieYes) support Advanced Mode natively.

3. Implement Enhanced Conversions

Enhanced Conversions send hashed first-party data (email address or phone number) from your conversion forms directly to Google Ads, providing a deterministic conversion signal that does not rely on cookies. This works alongside Consent Mode and can fill gaps that modelling cannot. It requires the visitor to have submitted a form, so it does not cover all conversions, but for lead generation and e-commerce businesses, it significantly improves conversion data quality.

4. Set Up Server-Side Tagging

Server-side Google Tag Manager gives you more control over what data is sent to Google and under what conditions. Cookies set by your server (as first-party HTTP-only cookies) have longer lifetimes and are not affected by browser-side restrictions like Intelligent Tracking Prevention. Server-side tagging combined with Consent Mode provides the most robust measurement foundation currently available.

5. Test Consent Flows Thoroughly

Broken consent implementations are surprisingly common. Research from Stape found that 67% of Consent Mode v2 implementations contain technical errors. Test every consent scenario: full acceptance, full denial, partial acceptance (analytics yes, advertising no), and consent withdrawal mid-session. Verify that your tags behave correctly in each scenario using Tag Assistant's consent diagnostics.

The Australian Context

Australia's Privacy Act does not currently mandate cookie consent banners in the way the GDPR does. However, the Attorney-General's Privacy Act Review, which has been progressing since 2022, has proposed reforms that would strengthen individual consent requirements and expand the definition of personal information to include technical identifiers like cookies and device IDs.

Even without a legal mandate, implementing Consent Mode v2 in Australia makes practical sense for three reasons:

• International audience: If any portion of your website traffic comes from the EU or UK, you need Consent Mode v2 for those visitors. Running different measurement configurations for different geographies is technically possible but operationally complex.
• Platform requirements: Google is increasingly tying access to advertising features (remarketing, conversion optimisation, audience insights) to Consent Mode compliance. Regardless of local law, the platform itself is requiring it.
• Future-proofing: When Australian privacy law catches up, and the trajectory suggests it will, having Consent Mode already implemented means you will not face a scramble to comply.

Adapting Your Data Strategy

Consent Mode v2 is part of a broader shift toward privacy-first marketing measurement. The businesses that adapt their data strategy now will maintain a measurement advantage as the landscape continues to evolve.

• Invest in first-party data: CRM data, email subscribers, loyalty programme members, and direct customer relationships are not subject to cookie consent constraints. The richer your first-party data, the less dependent you are on browser-based tracking.
• Diversify measurement methods: Do not rely solely on GA4 and Google Ads reporting. Layer in marketing mix modelling for strategic budget allocation and incrementality testing for causal validation. These methods operate on aggregate data and are privacy-resilient by design.
• Accept modelled data: Modelled conversions are probabilistic estimates, not observed facts. But they are far more useful than the alternative, which is a blank space in your reports. Treat modelled data as directionally reliable for optimisation decisions while maintaining awareness of its limitations.
• Review consent UX regularly: Your consent acceptance rate directly affects your data quality. A confusing or aggressive cookie banner will drive refusals. A clear, honest banner that explains the value exchange typically achieves higher acceptance rates without resorting to dark patterns.

Moving Forward with Confidence

Consent Mode v2 is not going away. It is the foundation of how Google's advertising and analytics products will operate in a privacy-regulated world. Implementing it correctly, in Advanced Mode with Enhanced Conversions and ideally server-side tagging, gives you the best possible measurement quality within the constraints that privacy regulation imposes.

The marketers who treat privacy compliance as a measurement problem to solve, rather than a bureaucratic nuisance to minimise, will end up with better data and better campaign performance than those who delay.

If you need help auditing your Consent Mode implementation or building a privacy-resilient measurement framework, our analytics team can walk you through the process. Get in touch to discuss your setup.