Consent Mode v2 is one of those topics where most explanations are either a vendor pitch or a compliance scare. Neither tells you the thing you actually need to know: what it does to your numbers. So let us do the mechanics first, then the data impact, honestly.
What Consent Mode actually is
Consent Mode is a signaling layer. Your consent banner collects a choice; Consent Mode translates that choice into flags Google's tags understand, and the tags change their behavior accordingly. It does not collect consent itself, and installing it without a proper banner does nothing for compliance. It is plumbing between the banner and Google.
The v2 part: on top of the original two signals, ad_storage (may ads-related cookies be set) and analytics_storage (may analytics cookies be set), Google added ad_user_data (may user data be sent to Google for advertising) and ad_personalization (may that data drive personalization and remarketing). Since March 2024, Google requires the two new signals for EEA traffic. Without them, audience building and personalized ads for EEA users degrade or stop, which is why your ad agency suddenly cared about consent plumbing that month.
Basic vs advanced mode, the actual difference
Basic mode: until the visitor consents, Google tags do not load at all. Decline means nothing is sent to Google. Simple to reason about, maximally conservative, and your data volume drops by roughly your decline rate.
Advanced mode: tags load before the consent choice and, when consent is declined, keep sending cookieless pings: no cookies set, no user identified, but anonymous signals still flow to Google. Google's systems then use those pings to model the conversions and behavior it could not observe directly.
That is the entire tradeoff. Basic gives you a clean, defensible "no means nothing is sent." Advanced gives you Google's statistical reconstruction of the declined segment, in exchange for still sending anonymous pings after a refusal, which some European regulators and lawyers view considerably more skeptically than Google's marketing does. I am not your lawyer; whether advanced mode fits your risk posture is a question for someone who is. What I can tell you is the data consequence of each, which is the next section.
What it does to your GA4 numbers
With basic mode, declined visitors simply do not exist in your data. Your traffic drops by the decline rate, and reported conversion rates stay roughly honest because both numerator and denominator shrink together.
With advanced mode, GA4 applies behavioral modeling: it estimates the sessions and conversions of non-consenting users from the cookieless pings plus the patterns of consenting users. Your top-line numbers refill toward reality. But be clear about what they now are: estimates. Google marks modeled data in some interfaces, blends it silently in others, and you cannot audit the model. When your GA4 purchases stop matching your shop's order count in a new way, consent modeling is on the suspect list.
My honest position: modeled data is fine for trends and ad optimization, and it is not fine as the sole basis for precise claims like "channel X produced exactly N orders." Treat modeled numbers the way you treat a weather forecast: useful, directionally right, not testimony.
What Consent Mode does not do
- It does not make your setup GDPR-compliant. The banner, the policy, and what actually fires still have to be right.
- It does not govern non-Google tags. Meta, TikTok, and the rest need their own consent wiring; Consent Mode is a Google protocol.
- It does not fix a banner that never blocked anything in the first place, which is a depressingly common finding; that failure mode has its own write-up.
How to check what mode you are actually in
Ask nobody. Look. Open the network tab, decline consent on a fresh session, and watch. No Google requests at all: basic mode, working. Requests with a gcs or gcd parameter indicating denied states: advanced mode pings. Full requests with cookies as if nothing happened: your Consent Mode is decorative, and you have a real problem.
If that last sentence just described your site, or if nobody in the company can say which mode you run and why, that is a one-week audit, not a mystery. Verifying what fires under each consent state is a standard part of every tracking review I do, and the difference between "we think we are compliant" and a network log is exactly the difference between hope and evidence.