# Consent Mode v2: Basic Blocks, Advanced Sends, and the Four Signals That Decide

Source: https://consentfence.com/blog/2026-11-10-consent-mode-v2-basic-advanced-four-signals.html

A visitor rejects analytics, and your GA4 still records the visit. Or it does not. The answer depends on which Consent Mode you installed, and most sites cannot tell you which one they run, because the CMP chose it and nobody asked. Basic and Advanced do opposite things when the visitor says no, and picking the wrong one is a compliance decision made by accident.

## Four signals, two modes

Consent Mode v2 runs on four signals. ad\_storage governs advertising cookies like \_gcl\_au. analytics\_storage governs analytics cookies like \_ga and \_gid. ad\_user\_data governs whether user data is sent to Google for ad attribution. ad\_personalization governs whether collected data serves personalized remarketing. All four default to denied until the visitor grants them, and the CMP updates them when the visitor chooses. The four signals are the whole interface between your banner and Google, and everything else in the setup is plumbing around them. In Basic mode, Google tags stay blocked until the visitor grants consent. If the visitor denies, no tags run and no requests leave the browser. The data is clean and the reports are incomplete, and that is the honest trade. In Advanced mode, tags load immediately with defaults denied, and when consent is rejected they send cookieless pings carrying metadata parameters, gcs, gcd, and npa, which Google uses for behavioural modelling to recover an estimated 65 to 70 percent of lost conversion volume. The pings carry no identifiers and no cookies, which is the argument for them. The counterargument is that a ping is still a network request to Google carrying the fact of the visit, and a data protection officer who has read the Austrian DSB and French CNIL rulings on transatlantic telemetry will want to know where it lands and what it carries.

The modelling threshold is the detail that decides which mode a small site should run. Google needs at least 1,000 daily users with analytics\_storage granted before it will model the behaviour of the users who denied. Below that threshold the modelled data does not appear, and the reports show only the consented users. A site with 200 visitors a day gets no modelling at all in Advanced mode, which means it pays the compliance risk of sending pings and receives nothing in return. That site should run Basic. A site with 50,000 visitors a day gets real modelled data, and Advanced is a genuine trade. The threshold is not in the CMP marketing. It is in the Google documentation, and it is the first thing to check.

## The default has to exist before any tag fires

Most broken setups fail at the consent default in the browser, not at the server. The CMP template has to fire on the Consent Initialization trigger and set every consent type to denied before any other tag loads. If the default is set late, or on the wrong trigger, the first page view runs without a consent state, and the tags fire as if consent were granted, because no signal told them otherwise. The failure is invisible in the reports: the data looks normal, the consent rate looks normal, and the first page view of every session was collected without a lawful basis. Test it the way a visitor experiences it: clear cookies, load the page, reject everything, and watch the network tab. In Basic mode you should see no Google requests. In Advanced mode you should see pings with gcs and gcd parameters and nothing else. If you see a \_ga cookie or a full g/collect hit after a rejection, the default is late or missing, and the banner is decoration.

The consent state has to travel, and it travels as URL parameters on every Google hit: gcs encodes the state, gcd encodes the defaults and the journey each signal took. Those parameters are the subject of the server side post, because they are what the server container reads. The browser is where consent is decided. The server only ever receives what the browser already sent.

## Which mode, for whom

Run Basic if your traffic is small, your legal exposure is European, or your CMP cannot prove its defaults fire first. Run Advanced if your traffic clears the 1,000 granted users a day threshold, your counsel has accepted the ping, and you have tested the rejection path as hard as the acceptance path. France's CNIL fined Google 325 million euros and SHEIN 150 million euros in September 2025 for placing cookies before consent, and that fine is the reason the refusal path deserves as much testing as the acceptance path. The mode is not a preference. It is a risk decision, and it should be made by the person who owns the risk, not the person who installed the plugin.

Keep reading: [Article 7(1): The Proof Burden Is the Whole Game](2026-11-08-consent-records-proof-burden-article-7.md), [How Much Does Your Consent Banner Weigh? Script Cost in Milliseconds](2026-11-07-consent-banner-script-weight-page-speed.md), [Consent banners on subdomains: one banner or one per subdomain](2026-11-06-consent-banners-subdomains-one-or-many.md).

## Frequently asked questions

### What are the four Consent Mode v2 signals?

ad\_storage controls advertising cookies, analytics\_storage controls analytics cookies, ad\_user\_data controls whether user data is sent to Google for ad attribution, and ad\_personalization controls whether collected data serves personalized remarketing. All four default to denied until the visitor grants them.

### What is the difference between Basic and Advanced Consent Mode?

In Basic mode, Google tags stay blocked until the visitor grants consent. If the visitor denies, no tags run and no requests leave the browser. In Advanced mode, tags load immediately with defaults denied, and when consent is rejected they send cookieless pings carrying metadata, which Google uses for behavioural modelling.

### How many granted users does GA4 modelling need?

Google needs at least 1,000 daily users with analytics\_storage granted before it will model the behaviour of the users who denied. Below that threshold, the modelled data does not appear, and the reports show only the consented users. Small sites get no modelling at all, which is a fact the Advanced mode sales pitch usually skips.

### When did Consent Mode v2 become mandatory?

Since March 2024, Google EU user consent policy has required Consent Mode v2 signals, including ad\_user\_data and ad\_personalization, for ad personalisation and measurement aimed at visitors in the EEA and the UK. Defaults have to be set before any tag fires, on the Consent Initialization trigger, or the first page view runs without a consent state.