What Happens Inside GA4 the Moment a Visitor Rejects Cookies
Google Analytics 4 relies on the _ga and _ga_* cookies to stitch pageviews and events into a coherent user journey. The second a visitor clicks "Reject" on your cookie banner, those identifiers disappear from the equation.
GA4 still receives hits if you run Google Consent Mode in Advanced mode. Tags fire on every page, but with analytics_storage='denied', GA4 sends cookieless pings instead of full measurement hits. These pings carry no client ID, no session ID, and no user-scoped dimensions. Each pageview arrives as if it belongs to a brand-new, anonymous visitor.
Without Advanced Consent Mode, the situation is worse. Basic mode prevents tags from firing at all when consent is withheld, meaning GA4 records nothing for those visitors.
Which GA4 Reports Break First
Not every report suffers equally. User-level and session-level metrics take the hardest hit, while raw event counts hold up better.
| Report / Metric | Impact When Cookies Rejected | Severity |
|---|---|---|
| Active Users | Undercounted - each pageview treated as a new user | High |
| Session Count | Inflated - no session cookie means every hit starts a new session | High |
| Returning vs New Users | All opted-out visitors appear as new | High |
| User Explorer | No individual journey data for opted-out visitors | Critical |
| Conversion Attribution | Conversions attributed to Direct or unassigned | High |
| Engagement Rate | Distorted - single-hit sessions inflate bounce metrics | Medium |
| Event Count | Mostly preserved with Advanced Consent Mode pings | Low |
| Pageview Totals | Mostly preserved with Advanced Consent Mode pings | Low |
Attribution is where the pain concentrates. A visitor who arrives via a paid Google Ads click, browses three pages, leaves, and converts the following day would normally generate a clear multi-touch path. Without cookies, that returning visit is invisible. The conversion either vanishes from reports or falls into Direct traffic.
How Consent Mode Behavioural Modelling Works
Google's response to these data gaps is conversion modelling. When enough data exists, GA4 applies machine learning to estimate what opted-out visitors likely did, based on the observed behaviour of similar visitors who accepted cookies.
The modelling process relies on cookieless pings sent under Advanced Consent Mode. These pings include a timestamp, the page URL, user agent information, and a referrer - enough for Google's algorithms to infer patterns without identifying individuals. GA4 then compares these anonymised signals against consented user journeys to fill in the blanks.
Modelled data appears in GA4 reports with a small triangle icon, indicating that the numbers include estimates rather than purely observed data.
Thresholds You Must Meet
Behavioural modelling does not activate automatically. Your property must satisfy specific minimum requirements before Google considers the model reliable enough to deploy.
- At least 1,000 users per day with
analytics_storage='granted'for a minimum of 7 out of the previous 28 days - At least 1,000 events per day with
analytics_storage='denied'for a minimum of 7 days - Reporting Identity set to "Blended" in your GA4 property settings
These thresholds exclude a large number of small and mid-sized websites. If your site receives fewer than 1,000 daily consented users, the model never activates, and your reports simply show the gap without any estimation.
The Accuracy Problem with Modelled Data
Even when modelling does activate, it has structural limitations. Google uses holdback validation - withholding a portion of observed data from model training, then comparing model predictions against that held-back data. This maintains a baseline of accuracy, but it does not guarantee precision for every segment.
Accuracy degrades at the extremes of consent rates. If fewer than 20% of visitors grant consent, the consented sample is too small for the model to learn meaningful patterns. Above 90% consent, there are too few denied events to justify modelling. The sweet spot sits somewhere between 30% and 70% consent rates.
Google also acknowledges that some conversions remain unrecoverable. If an opted-out user's conversion cannot be attributed to any ad interaction with reasonable confidence, the model omits it rather than risk over-counting. The practical result is that modelled conversion totals tend to be conservative.
Real-World Data Loss by Consent Rate
The percentage of visitors who reject analytics cookies varies by geography, industry, and banner design. European audiences, particularly in Germany and France, reject cookies at significantly higher rates than audiences in North America or Asia-Pacific.
A site with a 40% opt-out rate running Advanced Consent Mode can expect modelling to recover roughly 70% of the attribution paths that would otherwise be lost. That still leaves a meaningful blind spot - around 12% of total conversions may go unattributed or misattributed.
Sites running Basic Consent Mode lose everything from opted-out visitors. No pings, no modelling, no recovery.
| Consent Mode | Opt-Out Rate | Estimated Data Recovery | Remaining Gap |
|---|---|---|---|
| Advanced | 20% | ~80% via modelling | ~4% of total |
| Advanced | 40% | ~70% via modelling | ~12% of total |
| Advanced | 60% | ~55% via modelling | ~27% of total |
| Basic | Any | 0% - no pings sent | Equal to opt-out rate |
Practical Strategies to Reduce Data Loss
You cannot eliminate the consent gap entirely, but you can narrow it significantly.
1. Switch from Basic to Advanced Consent Mode
This is the single most impactful change. Advanced mode ensures Google tags load on every page and send cookieless pings when consent is denied. Without this, GA4 has zero information about opted-out visitors. If you use Google Tag Manager, the Consent Initialisation trigger type handles this configuration.
2. Improve Consent Rates Ethically
Higher consent rates mean smaller data gaps. Improving consent rates through clear banner copy, logical banner placement, and transparent category descriptions is legitimate. Using dark patterns - hidden reject buttons, confusing toggles, pre-ticked boxes - is not. Regulators across Europe have issued significant fines for manipulative banner designs.
3. Consider Server-Side Tagging
Server-side tagging moves data collection from the browser to your own server. This reduces reliance on client-side cookies and can improve data quality by setting first-party cookies from your own domain. It does not bypass consent requirements - you still need permission to process personal data under GDPR and the ePrivacy Directive. But it gives you more control over how data flows.
4. Complement GA4 with Privacy-Focused Analytics
Running a privacy-focused analytics tool alongside GA4 gives you a baseline of traffic data that does not depend on cookie consent. Tools operating in cookieless mode can provide accurate pageview and referrer data for all visitors, filling in the aggregate picture that GA4 misses.
5. Set Reporting Identity to Blended
In GA4 property settings, the Reporting Identity option determines whether modelled data appears in reports. Set this to "Blended" to incorporate behavioural modelling estimates alongside observed data. The "Observed" setting excludes all modelled data, which defeats the purpose of running Advanced Consent Mode.
What This Means for Google Ads Attribution
GA4 data loss ripples directly into Google Ads reporting. Conversion imports from GA4 to Google Ads carry the same consent-driven gaps. If GA4 cannot attribute a conversion to an ad click because the user rejected cookies, that conversion is missing from your Google Ads reports too.
Google Ads has its own conversion modelling layer that operates independently of GA4 modelling. For this to activate, you need at least 700 ad clicks over a 7-day period per country and domain grouping. Smaller advertisers often fall below this threshold.
The combined effect of GA4 and Google Ads modelling gaps can lead to underreported ROAS, which in turn may cause you to underinvest in channels that are actually performing. If your paid campaigns seem to be declining in efficiency, check whether the drop correlates with a change in consent rates rather than a genuine decline in performance.
Frequently Asked Questions
Does GA4 collect any data when users reject cookies?
With Advanced Consent Mode enabled, GA4 receives cookieless pings containing the page URL, timestamp, user agent, and referrer. These pings carry no personal identifiers. With Basic Consent Mode, GA4 collects nothing from users who reject cookies.
How accurate is GA4 behavioural modelling for consent mode?
Google uses holdback validation to maintain model quality, but accuracy varies. Modelling works best when consent rates fall between 30% and 70%. Outside that range, the model has insufficient data from either consented or denied populations to produce reliable estimates.
What are the minimum traffic requirements for GA4 consent mode modelling?
Your GA4 property needs at least 1,000 daily users with analytics_storage granted for 7 of the previous 28 days, plus at least 1,000 daily events with analytics_storage denied for 7 days. Your Reporting Identity must be set to Blended.
Can server-side tagging replace the need for cookie consent?
No. Server-side tagging changes where data is processed, not whether consent is required. Article 5(3) of the ePrivacy Directive requires consent for storing or accessing information on a user's device, regardless of whether processing happens client-side or server-side.
Why do my GA4 conversions not match Google Ads conversions?
GA4 and Google Ads apply separate modelling layers with different thresholds. GA4 needs 1,000 daily consented users; Google Ads needs 700 ad clicks per week. If one tool qualifies for modelling and the other does not, their reported conversion totals will diverge.
Should I use Basic or Advanced Consent Mode for GA4?
Advanced Consent Mode is strongly recommended. Basic mode prevents any data collection when consent is denied, leaving permanent gaps. Advanced mode sends anonymised pings that enable behavioural modelling to estimate the missing data.
Take Control of Your Cookie Compliance
If you are not sure which cookies your site sets or how your consent setup affects your analytics data, start with a free scan. Kukie.io detects, categorises, and helps you manage every cookie - so your visitors get a clear choice, and you stay on the right side of the law.
