Google Analytics 4 cookie consent comes down to one setting: analytics_storage. When a visitor accepts, it is granted and GA4 works as usual. When they decline, it is denied, and what GA4 does next depends on how your site is set up. Some setups send nothing at all, others send limited signals without cookies, and your reports change accordingly.

Getting this right protects you and keeps your data useful. This guide explains what GA4 does in each case, what changes in your numbers, and how to check your own setup, as part of a wider approach to consent management across countries.

GA4 learns the visitor's choice through Google's consent signals. The one that controls analytics is analytics_storage. Google describes it as enabling storage, such as cookies, related to analytics, for example visit duration. If it is denied, GA4 should not write or read analytics cookies for that visitor.

What happens to the measurement itself depends on the mode you use, and our Google Consent Mode guide covers both in depth. In short:

• Basic mode: Google tags stay blocked until the visitor consents, so nothing is sent before a choice.
• Advanced mode: Google tags load before the banner and send cookieless pings when consent is declined. Google Analytics can use those pings for modeling.

Neither mode makes a "no" disappear. The question is whether you lose that visitor completely or get a modeled estimate.

Google defines four consent types in total: ad_storage, analytics_storage, ad_user_data and ad_personalization. The last three matter if you link GA4 to Google's advertising products. Google's GA4 help says ad_user_data and ad_personalization need to be granted for visitors in the European Economic Area to be included in audiences used by linked ad products. If you only measure, analytics_storage is the one to watch.

With consent in place, your reports lose some precision, because declined visitors no longer appear as individual users. This is normal and a sign the setup works. Three things change:

• Some visitors vanish from the user counts, especially in markets where many people decline.
• Metrics that depend on cookies, such as returning users, are based on the visitors who accepted.
• In advanced mode, Google can model part of the gap, if the property qualifies.

Google's documentation says behavioral modeling is switched on automatically once a property is eligible. The requirements, listed in Google's modeling help, include consent mode on all pages, at least 1,000 events per day with analytics_storage denied for at least 7 days, and at least 1,000 daily users sending events with consent granted for at least 7 of the previous 28 days. Smaller sites may never qualify, so do not count on modeling to fill the gap.

Google also notes that when a consent solution that uses the TCF reports a decline, GA4 properties are not able to model data. Check the page above for the current wording before you plan around modeling.

See how AdOpt connects consent to GA4 to keep this part consistent across your tags.

It is easy to mix three topics that Google treats separately.

Google says GA4 does not log or store individual IP addresses from users in the EU, Switzerland and the United Kingdom, and uses the address only to derive coarse location. That is a statement about how GA4 handles IPs, set out in Google's GA4 IP help page. It does not tell you whether you need consent. That depends on the law that applies to your visitors, and our guide to GDPR and cookies covers the European rules.

Google's data retention help page says retention applies to user-level and event-level data tied to cookies, user identifiers and advertising identifiers. Standard GA4 properties can choose 2 months or 14 months, and the longer options are for GA4 360. Retention controls how long data is kept, not what is collected, so it is a tuning option and not a replacement for consent.

Google says Google signals features do not accumulate data for traffic where ad_storage is denied. If you use remarketing or audience features, this is another reason to make sure the advertising signals are set correctly.

The setup is the same in outline for any CMP and any tag manager. Follow these steps:

1. Choose basic or advanced mode, and note why.
2. Set a default consent state before any Google tag runs. In Google Tag Manager, use the Consent Initialization trigger so consent settings are honored before other triggers fire.
3. Let your CMP update consent after the visitor chooses.
4. Use region-specific defaults only where your legal review calls for them. Google's default command accepts a region parameter and the most specific region wins.
5. Turn on the consent overview in Tag Manager to see which tags have built-in consent checks.
6. Remove any GA4 snippet that sits outside Tag Manager. It will ignore the CMP.

The consent overview in Google Tag Manager shows these settings across your container.

See how AdOpt works with Google Tag Manager before you configure the defaults.

The first weeks after you connect consent to GA4 can look alarming. Users and sessions usually drop, and that is the setup working, not your traffic falling. Keep the comparison fair:

1. Write down the date you switched consent on.
2. Compare periods of the same length and the same days of the week, before and after.
3. Look at each market separately. Markets where more visitors decline will drop more.
4. If your CMP shows acceptance rates, put them next to the GA4 numbers, so you can tell a traffic change from a consent change.
5. Do not try to win the numbers back by loading GA4 before the choice. That removes the protection you set up.

Whichever CMP you use, you want clear answers to these:

• Does it set the default consent state before any Google tag runs?
• Does it send an update right after the visitor chooses, and on later pages?
• Can it set different defaults for different regions?
• Does it block tags it does not control, such as scripts pasted into templates?

Our guide on how to choose a CMP goes further into these points.

Test from a clean browser window rather than reading the configuration. Run these checks:

1. Open the site and reject everything in the banner.
2. In the browser's developer tools, open the network tab and look for requests to Google Analytics.
3. In basic mode, nothing should be sent. In advanced mode, you may see cookieless pings and no analytics cookies.
4. Check the stored cookies: there should be no analytics cookies after a rejection.
5. Repeat after accepting. Measurement should start only from that moment.
6. Save a screenshot and the date as evidence.

If requests carry on as usual after a rejection, the tag is not reading consent. The most common cause is a GA4 snippet pasted into the site code. Our guide to tag categorization helps you find tags that sit outside your tag manager.

• How to choose a CMP
• Global Privacy Control, explained

The answer comes from the law that applies to your visitors, not from GA4 itself. Google's statement that GA4 does not store EU users' IP addresses does not settle it. Check which rules cover your audience, including the European rules in our GDPR and cookies guide, and use consent signals so GA4 follows the visitor's choice.

It depends on the mode. In basic mode, Google tags stay blocked until consent, so nothing is sent. In advanced mode, tags send cookieless pings that Google Analytics can use for modeling, if your property meets the requirements. Either way, the visitor does not appear as an identified user.

It can, in advanced mode, but only when the property meets Google's requirements, which include thresholds of daily events and users over several days. Google also says properties cannot model data when the consent solution uses the TCF and the visitor declines. Small sites should plan as if no modeling will happen.

No. Consent Mode only passes the visitor's choice to Google tags. A CMP shows the banner, collects the choice, blocks other scripts and keeps the record. You need both: the CMP gathers a valid choice, and Consent Mode makes your Google tags follow it.