Consent Mode in Europe, the US and Asia: Privacy Laws, Metrics and GA4 Modeling

⏱ Reading time: 14 minutes · Updated: October 31, 2026 · For information only: this is not legal advice.

The short answer: Consent Mode is how Google receives each visitor’s cookie choice. It matters for three reasons.

In Europe you need prior consent to measure and personalize ads, and Google requires consent signals for users in the EEA and the UK.^[1]
If a visitor declines, your GA4 reports lose that part of your audience, unless you use the advanced implementation and your volume allows modeling.^[2]
The law changes by country: Europe requires consent before measuring, California relies mostly on the right to opt out, and Asia mixes very different models.

At the end you’ll find every source, split between official sources and third-party analysis.

Almost every European website has a cookie banner. Far fewer have it properly connected to Google Analytics 4 and Google Ads. And that difference shows in your numbers: users that vanish, conversions that don’t match real sales and campaigns that optimize with less information.

In this article I explain what Consent Mode is, why it matters so much in Europe, how it affects your metrics, what GA4 data modeling is, and how privacy laws differ in Europe, the United States and Asia. Everything comes with sources so you can check it yourself.

Part 1: What Consent Mode is and why it matters in Europe

Consent Mode in one sentence

Consent Mode lets Google’s tags (GA4, Google Ads…) change their behavior depending on what the visitor chose in your cookie banner. Google describes it as a way to control advertising and analytics data collection based on consent.^[3] It is neither a banner nor a law: it is the “cable” that connects your banner to your tags.

It works with four signals:^[3]

Signal	What it controls	Example
analytics_storage	Storage for analytics (for example, GA4 cookies)	The visitor accepts only the “Statistics” category
ad_storage	Storage for advertising	The visitor declines advertising
ad_user_data	Sending user data to Google for advertising purposes (new in v2)	Google Ads conversions and audiences
ad_personalization	Personalized advertising, such as remarketing (new in v2)	The visitor declines personalized ads

Why it is not really optional in Europe

No law says “install Consent Mode.” What exists are three layers that, together, make it almost essential if your site gets European visitors:

The law. The ePrivacy Directive (Art. 5(3)) requires prior consent to store or read information on a user’s device, unless it is strictly necessary.^[4] The GDPR defines what that consent must look like: freely given, specific, informed and unambiguous (Art. 4(11)).^[5] In Spain, the LSSI (Art. 22(2)) sets it out^[6] and the AEPD develops it in its cookie guide.^[7]
Google’s policy. Its EU user consent policy applies to visitors in the European Economic Area and the United Kingdom: if you use its measurement or advertising tags, you must obtain that consent.^[1] Consent Mode v2 is how you communicate those choices, using the ad_user_data and ad_personalization signals.^[3]
The Digital Markets Act (DMA). It binds “gatekeepers” such as Alphabet directly, not your company.^[8] But, according to industry analysis, Google passes that requirement on to the businesses that use its services.^[9]

💡 Understand: Consent Mode doesn’t make you compliant on its own. If your banner has pre-ticked boxes, doesn’t offer a way to decline or makes it hard to withdraw consent, Consent Mode will simply pass along a consent that isn’t valid. Get the banner right first; then connect it to Google.

Part 2: How it affects your metrics

What happens to your data when someone declines cookies

There are three possible scenarios. What changes between them is what GA4 receives from someone who declines:

Scenario	If the visitor declines…	GA4 modeling?
Tags blocked, no Consent Mode	The tag doesn’t load: GA4 receives nothing from that visit.	No
Basic Consent Mode	Google tags don’t load until the visitor accepts, so no data is sent.^[9]	No: Google requires tags to load in all cases.^[2]
Advanced Consent Mode	Tags load with consent denied and send cookieless signals, which Google uses to estimate.^[2]	Yes, if the requirements are met.^[2]

Choosing between basic and advanced is both a technical and a legal decision: advanced collects more signals, but your legal advisor should confirm it fits your cookie policy.

How it shows up in your reports

Fewer users and sessions in GA4 than the real ones, especially in European countries.
Fewer conversions attributed to Google Ads campaigns and, with them, less signal to optimize.
Smaller or empty remarketing audiences.
Sudden data changes on the same day a banner is installed or modified.

The size of the gap depends on the share of visitors who decline, and that share varies a lot by industry, country and banner design. There is no universal figure, which is why it’s worth measuring on your own site.

🔍 Detect: compare the real orders or form submissions in your store or CRM with GA4 conversions over the same period. If GA4 records noticeably fewer and the gap grew when you added the banner, you have a consent or configuration problem. Also have someone check that the visitor’s choice isn’t lost when changing pages.

Part 3: GA4 data modeling

What behavioral modeling is

When a visitor declines analytics cookies, GA4 can’t recognize them across visits. Behavioral modeling uses machine learning to estimate those users’ activity from the ones who did accept, using the data of your own property.^[2]

What you need for it to activate

Consent Mode active on every page, with Google tags always loading and before the consent dialog appears (advanced implementation).^[2]
At least 1,000 daily events with analytics_storage denied for a minimum of 7 days.^[2]
At least 1,000 daily users with analytics_storage granted for at least 7 of the last 28 days.^[2]
The “Blended” reporting identity in Admin > Reporting identity.^[2]

Meeting the thresholds doesn’t guarantee Google will activate modeling: factors such as the ratio of new to returning users also matter.^[2]

What is modeled… and what isn’t

Modeled	Not modeled
Users, sessions and new users in reports	Event counts such as page_view, first_visit or session_start
A data quality icon flags that estimates are included	Audiences, user explorations and cohorts
—	Retention reports and predictive metrics
—	Data export, for example to BigQuery

Source for this whole block: Google Analytics’ official help.^[2]

✅ Decide: if your site is small and doesn’t reach the thresholds, don’t expect modeling to fill the gap. With low volumes it is more useful to rely on your own reliable data (forms, CRM, orders) and use GA4 as a trend, not an exact number. If you exceed the thresholds, the advanced implementation is worth it.

Part 4: Privacy laws: Europe, the United States and Asia

Europe: prior consent (opt-in)

The European model is opt-in: non-essential cookies are neither stored nor read until the visitor agrees.^[4]^[5] Some key points:

Valid consent. It must be freely given, specific, informed and unambiguous, and withdrawing it must be as easy as giving it (GDPR, Arts. 4(11) and 7).^[5] The European Data Protection Board clarifies that continuing to browse or scrolling is not valid consent.^[10]
Spain. The LSSI (Art. 22(2)) requires giving information and obtaining consent.^[6] According to law-firm analyses of the AEPD’s 2023 guide update, the reject button must be on the first layer with the same visual prominence as accept.^[11] In January 2024 the AEPD also published a guide on audience measurement that allows certain analytics cookies to be exempt under strict conditions.^[12]
United Kingdom. It has its own rules (PECR and UK GDPR). The Data (Use and Access) Act 2025 added exceptions to consent, including one for statistical purposes.^[13] The ICO reads it strictly and published updated guidance in 2026, so don’t assume GA4 is exempt: check the current guidance.^[14]

United States: the right to opt out

There is no general federal cookie law. The main reference is California’s law (the CCPA, amended by the CPRA), which relies on informing people and letting them opt out:

Businesses that sell or share data must offer a “Do Not Sell or Share My Personal Information” link.^[15]
They must honor browser signals such as Global Privacy Control as a valid opt-out request.^[15]
Selling the data of anyone under 16 requires prior authorization (opt-in).^[15]
Other states have their own laws with different nuances: check which ones apply based on where your customers are.

Consent Mode lets you set different defaults per region, using ISO 3166-2 codes such as ES or US-CA,^[3] so each visitor gets the behavior that matches their location. Which value to apply in each region should be validated by your legal advisor.

Asia: three very different models

Asia isn’t a single bloc. These three examples show how much it varies:

Japan (APPI). Since the 2022 amendment, cookies and other identifiers are treated as “personally referable information.” The law doesn’t expressly say whether cookies need opt-in or opt-out; consent centers on disclosure to third parties who could identify the person, and some analyses recommend opt-in for third-party advertising cookies.^[16]^[17] This summary relies on third-party analysis: verify it with Japan’s authority (PPC).
China (PIPL). In force since November 1, 2021. Consent must be voluntary, explicit and fully informed (Art. 14), the text doesn’t list legitimate interest among its processing bases (Art. 13) and, for sensitive information, it requires separate consent (Art. 29).^[18]
India (DPDP). The 2023 law is built on consent. Its rules were notified in November 2025 and apply in phases: some at 12 months and the substantive obligations at 18 (around May 2027; sources differ on the exact day).^[19] Check the official timeline before acting.

Quick comparison

Region	Model	What is expected before measuring	What it means for Consent Mode
EU and EEA	Opt-in	Prior consent for non-essential cookies	Defaults set to “denied” and an update after the choice
United Kingdom	Opt-in with recent exceptions	Consent, except for strictly interpreted exceptions	Treat like Europe unless advised otherwise
California (US)	Opt-out	Notice and a way to opt out; honor Global Privacy Control	Regional defaults and handling of the opt-out signal
Japan	Consent tied to disclosure to third parties	Consent if the recipient can identify the person	Review which tags share data with third parties
China	Strict opt-in	Explicit consent (separate for sensitive data)	Maximum caution: consult a local specialist
India	Purpose-based consent, being phased in	Specific consent once the obligations take effect	Follow the official timeline

✅ Decide: if you only sell in Spain, your priority is the European standard. If you also sell to the US or Asia, don’t copy the European banner: define regions and consult a local specialist. As a rule of thumb, apply the strictest standard among the markets where you actually operate.

Part 5: Checklist for your website

☐ My banner has a reject button on the first layer and no pre-ticked boxes.
☐ The default consent state is set before any Google tag loads.
☐ I send all four version 2 signals, including ad_user_data and ad_personalization.
☐ The visitor’s choice is stored and applied on every page.
☐ I have regional defaults if I operate outside Europe.
☐ I know whether I’m in basic or advanced mode, and why.
☐ I’ve checked with Tag Assistant what is sent when visitors accept and decline.
☐ My cookie policy reflects what is actually measured.

Prefer to have it working for you?

If you want me to review or implement this setup on your site, we work together step by step: audit, implementation and verification.

Frequently asked questions

Is it mandatory to use Consent Mode?
It isn’t a law: it is Google’s tool for receiving the visitor’s choice. But if you have visitors from the EEA or the UK and use Google’s measurement or advertising tags, Google requires consent and Consent Mode v2 is how you send those signals.

Does Consent Mode make me GDPR compliant?
Not by itself. It passes the visitor’s choice to Google; whether your banner and cookie policy are valid is a legal matter to confirm with your advisor.

Does it recover all the data I lose?
No. Modeling is an estimate, covers only certain metrics (users, sessions and new users) and requires meeting Google’s thresholds.

What if I have visitors outside Europe?
You can set different defaults per region. Which value to apply in each should be validated by your legal advisor under each country’s law.

Sources and references

Official sources and Google documentation

Third-party analysis (check against the official source)

Accessed on October 31, 2026. Regulations change often: check the current version before making decisions.

This article is for information only and is not legal advice. It doesn’t cover every country (for example, South Korea, Brazil or Canada have their own laws). Before making decisions about your banner or cookie policy, consult a privacy law professional.