Yes, Google Analytics 4 (GA4) uses cookies: _ga and _ga_<container-id>, both first-party and both kept for 2 years by default. In the EU and the UK, setting them needs the visitor's consent first, so a GA4 cookie consent setup holds the tag, or runs it with storage denied, until the visitor chooses. When a visitor rejects, GA4 loses the identifier that links their pageviews. Basic consent mode then sends nothing at all. Advanced mode sends cookieless pings that standard reports do not count, but that can feed modelled estimates once your property is large enough.
What happens inside GA4 the moment a visitor rejects cookies
GA4 relies on two cookies to stitch pageviews and events into a coherent user journey. Google's list of GA4 cookies names only these two for a gtag.js or Google Tag Manager setup:
| Cookie | Default lifetime | What it does |
|---|---|---|
_ga | 2 years | Identifies the browser as one user |
_ga_<container-id> | 2 years | Keeps the session state |
The _gid cookie that older cookie policies list belonged to Universal Analytics, which stopped processing data on 1 July 2023. The second a visitor clicks "Reject" on your cookie banner, the GA4 identifiers stop being set.
GA4 still receives hits if you run Google Consent Mode in advanced mode. Tags fire on every page, but with analytics_storage='denied', GA4 sends cookieless pings instead of full measurement hits. These pings carry no client ID, no session ID, and no user-scoped dimensions. Google's help page on behavioural modelling is plain about what that means for reporting: unless your reporting identity is Blended, "your reports only include data available from users who consented to the use of identifiers".
Without advanced consent mode, the situation is worse. Basic mode prevents tags from firing at all when consent is withheld, meaning GA4 records nothing for those visitors.
The rules behind this sit in Article 5(3) of the ePrivacy Directive, which asks for consent before anything is stored on or read from a visitor's device. The UK has carved out an exception since 5 February 2026: Schedule 12 of the Data (Use and Access) Act 2025 exempts storage whose sole purpose is statistics to improve your own site, if the data is not shared beyond helping with that, visitors get clear information and they have a free way to object. Whether a GA4 property fits depends on how Google may use the data under your settings, so read the UK cookie exemptions before relying on it.
One rejected visit in basic and advanced mode
Which GA4 reports break first
Not every report suffers equally. User-level and session-level metrics take the hardest hit, because every one of them is built from the identifier the visitor refused.
| Report or metric | Impact when cookies are rejected | Severity |
|---|---|---|
| Active users | Counts consenting visitors only, unless Blended modelling adds an estimate | High |
| Sessions | Rejected visits do not appear as sessions in standard reports | High |
| Returning and new users | Visible for consenting visitors only | High |
| User explorer | No individual journey data for opted-out visitors | Critical |
| Conversion attribution | A conversion cannot be linked to the visitor's earlier ad click | High |
| Engagement rate | Calculated from consenting visitors only, who may behave differently | Medium |
| Event and pageview counts | Observed counts cover consenting visitors, and advanced mode pings feed modelling only | Medium |
Attribution is where the pain concentrates. A visitor who arrives via a paid Google Ads click, browses three pages, leaves, and converts the following day would normally generate a clear multi-touch path. Without cookies, that returning visit cannot be linked to the first one, so the conversion either goes missing from observed reports or reaches them only as a modelled estimate.
What GA4 still measures without cookies
GA4 has no cookieless tracking mode of its own. With analytics_storage denied, the tag sets no _ga cookies and sends pings without a client ID, so GA4 cannot tell whether 10 page views came from 10 visitors or from 1. Those pings are not reported as users or sessions. They exist to train behavioural modelling, and modelled numbers appear only when the property qualifies and reporting identity is Blended.
As of October 2026, that is the whole of what "cookieless GA4" means: a smaller observed dataset, plus an estimate for properties large enough to earn one. A site that needs a full count of visits without consent needs a different tool alongside GA4, covered further down.
How consent mode behavioural modelling works
Google's response to these data gaps is behavioural modelling in GA4 and conversion modelling in Google Ads. When enough data exists, GA4 applies machine learning to estimate what opted-out visitors likely did, based on the observed behaviour of similar visitors who accepted cookies.
The modelling process relies on cookieless pings sent under advanced consent mode. These pings include a timestamp, the page URL, user agent information, and a referrer, enough for Google's algorithms to infer patterns without identifying individuals. GA4 then compares these signals against consented user journeys to fill in the blanks.
GA4 marks reports that include modelled data with its data-quality icon, so you can tell estimates from observed numbers.
Thresholds you must meet
Behavioural modelling does not activate automatically. Google's behavioural modelling requirements set minimums before the model is used:
- At least 1,000 users per day with
analytics_storage='granted'for a minimum of 7 out of the previous 28 days - At least 1,000 events per day with
analytics_storage='denied'for a minimum of 7 days - Reporting Identity set to "Blended" in your GA4 property settings
Google adds that meeting the thresholds does not guarantee eligibility, and that training can take more than 7 days. These thresholds exclude a large number of small and mid-sized websites. If your site receives fewer than 1,000 daily consented users, the model never activates, and your reports show only consenting visitors, with no estimate for the rest.
The accuracy problem with modelled data
Even when modelling does activate, it has structural limitations. Google uses holdback validation, withholding a portion of observed data from model training, then comparing model predictions against that held-back data. This maintains a baseline of accuracy, but it does not guarantee precision for every segment.
The model learns from the visitors who consented. If they differ from the visitors who refused (more loyal, more likely to buy, from different countries), the estimate inherits that bias. Google publishes no accuracy figure by consent rate, so treat modelled totals as an estimate with an unknown error, not as recovered data.
Modelling also cannot recover every conversion. Where a refusing visitor's conversion cannot be tied to an ad interaction with reasonable confidence, it stays out of the totals, so modelled conversion figures tend to be conservative.
Consent rates set the size of the gap
The percentage of visitors who reject analytics cookies varies by country, industry, and banner design. The higher that share, the larger the part of your traffic that GA4 sees only as pings or not at all.
Sites running basic consent mode lose everything from opted-out visitors. No pings, no modelling, no recovery.
Sites running advanced mode lose the same visitors from observed reports, and get an estimate back only above the thresholds. No published source turns a consent rate into a reliable "percentage recovered", so be wary of any tool or article that quotes one.
Practical strategies to reduce data loss
You cannot eliminate the consent gap entirely, but you can narrow it significantly.
Decide between basic and advanced consent mode
Advanced mode loads Google tags on every page and sends cookieless pings when consent is denied, which is what makes modelling possible. Basic mode sends nothing until the visitor agrees, so GA4 has no information about opted-out visitors. The trade-off is legal as well as technical: the European Data Protection Board's Guidelines 2/2023 on Article 5(3) read the rule broadly enough to cover information a script makes the browser send, so pre-consent pings are debated. If you use Google Tag Manager, the Consent Initialisation trigger type handles either configuration.
Improve consent rates without dark patterns
Higher consent rates mean smaller data gaps. Improving consent rates through clear banner copy, logical banner placement, and transparent category descriptions is legitimate. Using dark patterns, such as hidden reject buttons, confusing toggles and pre-ticked boxes, is not. Regulators across Europe have issued significant fines for manipulative banner designs.
Consider server-side tagging
Server-side tagging moves data collection from the browser to your own server. This reduces reliance on client-side cookies and can improve data quality by setting first-party cookies from your own domain. It does not bypass consent requirements: you still need permission to process personal data under GDPR and the ePrivacy Directive. But it gives you more control over how data flows.
Complement GA4 with privacy-focused analytics
Running a privacy-focused analytics tool alongside GA4 gives you a baseline of traffic data that does not depend on cookie consent. Tools operating in cookieless mode can provide pageview and referrer data for all visitors, filling in the aggregate picture that GA4 misses.
Set reporting identity to Blended
In GA4 property settings, the Reporting Identity option determines whether modelled data appears in reports. Set this to "Blended" to incorporate behavioural modelling estimates alongside observed data. The "Observed" setting excludes all modelled data, which defeats the purpose of running advanced consent mode.
What this means for Google Ads attribution
GA4 data loss ripples directly into Google Ads reporting. Conversion imports from GA4 to Google Ads carry the same consent-driven gaps. If GA4 cannot attribute a conversion to an ad click because the user rejected cookies, that conversion is missing from your Google Ads reports too.
Google Ads has its own conversion modelling layer that operates independently of GA4 modelling. For this to activate, you need at least 700 ad clicks over a 7-day period per country and domain grouping. Smaller advertisers often fall below this threshold.
The combined effect of GA4 and Google Ads modelling gaps can lead to underreported ROAS, which in turn may cause you to underinvest in channels that are actually performing. If your paid campaigns seem to be declining in efficiency, check whether the drop correlates with a change in consent rates rather than a genuine decline in performance.
GA4 and consent: short answers
Does GA4 collect any data when users reject cookies?
With advanced consent mode enabled, GA4 receives cookieless pings containing the page URL, timestamp, user agent, and referrer. These pings carry no client identifier and are not counted as users or sessions in standard reports. With basic consent mode, GA4 collects nothing from users who reject cookies.
Can GA4 track visitors without cookies?
Not in a way that shows up as users or sessions. Without consent, GA4 receives only identifier-free pings, which feed behavioural modelling once a property meets Google's thresholds and uses Blended reporting identity.
How accurate is GA4 behavioural modelling for consent mode?
Google uses holdback validation to maintain model quality, but publishes no accuracy figure by consent rate. The model learns from consenting visitors, so if refusing visitors behave differently, the estimate inherits that difference.
What are the minimum traffic requirements for GA4 consent mode modelling?
Your GA4 property needs at least 1,000 daily users with analytics_storage granted for 7 of the previous 28 days, plus at least 1,000 daily events with analytics_storage denied for 7 days. Your Reporting Identity must be set to Blended.
Can server-side tagging replace the need for cookie consent?
No. Server-side tagging changes where data is processed, not whether consent is required. Article 5(3) of the ePrivacy Directive requires consent for storing or accessing information on a user's device, regardless of whether processing happens client-side or server-side.
Why do my GA4 conversions not match Google Ads conversions?
GA4 and Google Ads apply separate modelling layers with different thresholds. GA4 needs 1,000 daily consented users, while Google Ads needs 700 ad clicks over 7 days per country and domain grouping. If one tool qualifies for modelling and the other does not, their reported conversion totals will diverge.
Should I use Basic or Advanced Consent Mode for GA4?
It is a trade-off. Basic mode sends nothing before consent, which leaves permanent gaps. Advanced mode sends identifier-free pings that make modelling possible, but sending anything before consent is debated under Article 5(3), so weigh both with your adviser.
See which cookies your GA4 setup sets before consent
If you are not sure whether _ga appears before a visitor chooses, scan the page. The Cookie scanner lists every cookie a page sets on load, so you can see whether GA4 waits for the banner.
