GA4 and GDPR: Consent Mode done right
TL;DR
- Running GA4 on EU traffic legally means consent first, tags second - not the other way around.
- Google Consent Mode v2 sets storage to denied by default and updates only when the visitor consents.
- With conditional tags and consent modeling, you stay compliant and recover much of the lost data statistically.
- Get it wrong and you either breach GDPR or lose most of your analytics to blocked tags.
If any of your traffic is in the EU or UK, GA4 is not plug-and-play. You need consent before you set cookies or send identifiers - and you need it wired so that respecting the law doesn't blind your analytics. Google Consent Mode v2 is how you square that circle.
How it works
Consent Mode changes the order of operations. Before anything loads, storage is denied by default. A consent banner asks the visitor. Only when they accept does Consent Mode "update" to granted, and the tags behave fully. If they decline, tags still fire in a cookieless, privacy-preserving way that sends no identifiers.
- Set defaults to denied (analytics_storage and ad_storage) before the tag manager or gtag loads.
- Show a real consent banner - accept, reject and manage, with reject as easy as accept.
- On the user's choice, call a consent update (granted or denied) for each storage type.
- Fire GA4 and ads tags conditionally, respecting that state.
- Enable consent modeling in GA4 to statistically recover conversions lost to declines.
Why "reject as easy as accept" matters
EU regulators have been explicit: a banner with a bright Accept button and a buried Reject is not valid consent. Beyond the legal risk, dark-pattern banners erode trust. A clean, symmetric choice is both compliant and better for the brand - and, done well, acceptance rates are healthier than teams fear.
Consent modeling: getting data back
When visitors decline, you lose their events - but not necessarily the insight. With Consent Mode v2 and enough traffic, Google uses the consented data to model the behaviour of the non-consented, filling the gap in your conversion reporting. It's not a licence to ignore consent; it's what makes compliant measurement viable at scale.
This is core to how I set up analytics for international clients - the same principles apply across the EU, UK and other consent regimes, with local nuances.
Key data
| Consent Mode v2 required | Mar 6 2024 |
|---|---|
| New required parameters | ad_user_data, ad_personalization |
| Largest GDPR fine (Meta, 2023) | €1,2B |
| Cumulative GDPR fines | ~€5,65B |
Sources: Statista — GDPR fines · CMS GDPR Enforcement Tracker
Common mistakes and how to do it right
I've cleaned up a lot of GA4 setups that were quietly illegal or quietly empty. The usual culprits:
| Avoid | Do |
|---|---|
| ✗ Loading GA4 before consent 'to not lose data' | ✓ Denying storage by default and updating only on consent |
| ✗ A banner where Accept is easy and Reject is hidden | ✓ A symmetric choice - reject as easy as accept (regulators require it) |
| ✗ Skipping Consent Mode and just blocking all tags | ✓ Using Consent Mode v2 so declined visits still model conversions |
| ✗ Assuming one banner fits every market | ✓ Adapting to each jurisdiction's consent rules |
Tools I use and recommend
- Google Analytics 4Behaviour and conversion measurement.
- Google Search ConsoleOrganic performance, coverage and field Core Web Vitals.
- SEO Pro ExtensionOn-page and technical checks at a glance (extension).
Sources
Frequently asked questions
Is GA4 legal under GDPR?
It can be, with valid consent, Consent Mode v2 and a proper banner. The tool isn't the issue - the configuration is. Analytics service →
Do I lose all data if people reject cookies?
No. With Consent Mode v2, declined visits fire cookielessly and GA4 can model the missing conversions from consented data. Privacy & cookies →