When a visitor declines analytics or advertising cookies, Google Analytics 4 and Google Ads do not see that visit the normal way, so your counts drop. With Consent Mode in advanced mode, Google can estimate part of the gap, but only above published traffic thresholds: for GA4, at least 1,000 events a day from visitors who declined and at least 1,000 daily users who accepted, sustained for at least 7 days; for Google Ads, 700 ad clicks over 7 days per country and domain grouping. Below those, the gap stays a gap. Report it honestly: measured numbers, the modelled share where it exists, and the trend from your own enquiry inbox.
General information, not legal advice. Consent rules differ by country and province and change often; confirm your position with a qualified advisor.
Key takeaways
- Consent is decided by law and your policy, not by your analytics needs. The measurement question is how to read the data you are allowed to collect.
- GA4 behavioural modelling needs Consent Mode on every page, tags that load before the banner, 1,000 denied events a day for 7 days and 1,000 consenting daily users on 7 of the previous 28 days. Google says meeting the thresholds "doesn't guarantee eligibility".
- Modelled data appears in GA4 only with the Blended reporting identity, and covers users and sessions, not event counts such as page views.
- Google Ads conversion modelling needs 700 ad clicks over 7 days per country and domain grouping; modelled conversions then appear in the Conversions column and feed automated bidding.
- Your CRM or inbox is the only lead count that consent does not touch. Use it as the reference line.
Why do my numbers drop when a consent banner goes live?
Because a visitor who declines is no longer measured with cookies, and in some setups is not measured at all. Google describes two ways to implement Consent Mode. In basic mode tags stay blocked until the visitor chooses, and if they decline "no data is transferred to Google at all, not even the consent status". In advanced mode tags load straight away and, while consent is denied, "the Google tags send cookieless pings"; full measurement starts only when the visitor accepts.
The drop you see is therefore real, not a bug, and its size depends on three things: how many of your visitors see a banner at all (on our own site the banner shows only in the EEA, UK and Switzerland, which our GTM and Consent Mode write-up explains), how many of those decline, and whether you run basic or advanced mode. That article covers how to build the setup. This one is about reading the numbers afterwards.
What does GA4 estimate, and when?
GA4 can fill part of the gap with behavioural modelling, which estimates the behaviour of visitors who declined from the behaviour of similar visitors who accepted. Google's prerequisites:
| Requirement | Google's wording or number |
|---|---|
| Consent Mode | Enabled across all pages of the site |
| Tag loading | Tags must load before the consent dialog, and Google tags must load in all cases, not only after consent (in practice, advanced mode) |
| Declined traffic | "At least 1,000 events per day with analytics_storage='denied' for at least 7 days" |
| Consenting traffic | At least 1,000 daily users sending events with analytics_storage='granted' on at least 7 of the previous 28 days |
| Training | "It may take more than 7 days of meeting the data threshold within those 28 days to train the model successfully" |
Google adds that meeting the thresholds "doesn't guarantee eligibility". Once modelling is running, modelled data is included only when the property uses the Blended reporting identity (Admin, Data display, Reporting identity), and it applies to metrics such as users, sessions and new users, not to event counts like page_view. A data-quality icon on each report says whether estimated data is included.
The thresholds matter more than any setting. Many small and mid-size business sites never reach 1,000 consenting daily users, so they will not get behavioural modelling at all. For them, the declined visits are simply missing from GA4, and the honest response is to say so in the report rather than pretend the numbers are complete.
Do not confuse modelling with data thresholds, a separate GA4 behaviour. Thresholds withhold rows from a report, for example demographics or search terms, when too few users are involved, to prevent anyone working out "the identity or sensitive information of individual users". They are "system defined. You can't adjust them." Widening the date range is the usual way to see more.
What does Google Ads estimate, and when?
Google Ads models conversions it cannot observe when Consent Mode (or the IAB framework) is implemented and the account has "700 ad clicks over a 7 day period, per country and domain grouping". Modelled conversions then appear "in the 'Conversions' column" and in all downstream reports, and they are used by automated bidding. Advanced mode gives what Google calls "an advertiser-specific model as opposed to a general model".
Google also reports the uplift from Consent Mode after at least 7 full days, but only where a slice "meets the minimum data threshold". If your account is below the click threshold in a country, expect the conversions you see there to be observed conversions only.
How should I report numbers that are partly estimated?
Report three lines, not one, and label each:
- Measured in GA4 or Google Ads. What the tags observed. In GA4, note whether the report used Blended identity and whether the data-quality icon shows estimated data.
- Modelled share, where it exists. In GA4, compare the same report under Blended and Observed identity; in Google Ads, use the consent mode impact figures when Google shows them. If neither is available, write "not modelled (below thresholds)".
- The business record. Enquiries received in your inbox or CRM, by week. Consent does not affect this line, so it is the reference for whether a fall in GA4 leads is a fall in real leads.
Then report ratios that survive consent better than totals: the key-event rate per consenting session, cost per enquiry using the CRM count, and the share of enquiries that say which channel found you (a "how did you hear about us" field is old-fashioned and still useful). Our GA4 event plan for lead-generation sites includes a monthly check that compares GA4 leads with the inbox.
Two things not to do. Do not quietly change the consent setup to recover numbers; collecting data without a valid basis is a legal problem, not a measurement trick. And do not compare a period before the banner with a period after it without a note on the chart; the change is in the measurement, not necessarily in the business.
Which rules apply to my visitors?
That depends on where your visitors are, and the following is a summary of official guidance, not legal advice.
- EU and EEA. Article 5(3) of the ePrivacy Directive covers storing or accessing information on a visitor's device; the European Data Protection Board's Guidelines 2/2023 (version 2.0, October 2024) explain that it reaches tracking techniques beyond cookies, including pixels and URL-based tracking. Google's EU user consent policy separately requires consent for advertising uses for EEA and UK visitors.
- United Kingdom. After the Data (Use and Access) Act 2025, the ICO's guidance describes a "statistical purposes" exception: analytics whose sole purpose is aggregated statistics to improve your site may run without prior consent if you give "clear and comprehensive information" and "a 'simple and free' means to object", and any third-party provider is a processor. The ICO is explicit that the exception "does not apply to purposes related to online advertising".
- Canada. Under PIPEDA the Office of the Privacy Commissioner says express consent is generally needed when information is sensitive, outside reasonable expectations, or creates a meaningful risk of significant harm. For online behavioural advertising it accepts opt-out consent only under conditions, including that people are told the purposes "at or before the time of collection" and can "easily opt-out", with the opt-out taking effect immediately and persisting. Quebec's Law 25 adds its own requirements for tracking technologies; take advice if you have Quebec visitors.
- India. The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025, with most business obligations, including notice and consent mechanics, applying from May 2027. Plan consent and notices now if your site serves Indian visitors.
Whatever applies, your privacy policy should say what you measure and how people can object, and the consent setup should match it. Our article on privacy for AI features in Canada and India covers the wider data-protection picture for those two countries.
Impinge Solutions sets up GA4, Consent Mode and the reporting around them as part of its digital marketing and analytics work. Run our free website audit to see whether a consent banner and your analytics tags are detected.
FAQ
Why did my GA4 users drop after adding a cookie banner?
Because visitors who decline analytics cookies are no longer measured normally. In basic Consent Mode nothing is sent for them; in advanced mode only cookieless pings are sent. GA4 can estimate part of the gap with behavioural modelling, but only on properties above Google's thresholds and only in the Blended reporting identity.
Will GA4 model my missing data automatically?
Only if the property qualifies: Consent Mode on every page, tags loading before the banner, at least 1,000 events a day from visitors who declined for at least 7 days, and at least 1,000 consenting daily users on 7 of the previous 28 days. Google says even then eligibility is not guaranteed. Many small business sites never qualify.
Are modelled conversions in Google Ads real?
They are estimates of conversions that happened but could not be observed, and Google uses them in the Conversions column and for bidding. They require Consent Mode and 700 ad clicks over 7 days per country and domain grouping. Treat them as an estimate and keep your CRM count as the reference.
Can I use analytics without consent in the UK now?
For narrowly defined analytics, possibly. The ICO's guidance on the statistical purposes exception allows aggregated analytics for improving your site without prior consent if you explain it clearly and offer a simple, free way to object, and any provider acts as your processor. It does not cover advertising. Take advice on your own setup.
What is the most reliable number to report?
Your own record of enquiries, from the inbox or CRM, because it does not depend on cookies. Report it next to the GA4 and Google Ads figures, with a note on which of those include modelled data.
Sources
- Google Analytics Help, "[GA4] Behavioral modeling for consent mode" (prerequisites, thresholds, Blended identity): https://support.google.com/analytics/answer/11161109
- Google Analytics Help, "[GA4] Data thresholds": https://support.google.com/analytics/answer/9383630
- Google Ads Help, "About consent mode" (basic vs advanced, cookieless pings, uplift reporting): https://support.google.com/google-ads/answer/10000067
- Google Ads Help, "About consent mode modeling" (700 ad clicks over 7 days, Conversions column, bidding): https://support.google.com/google-ads/answer/10548233
- Google Analytics Help, "[GA4] Monitor events in DebugView" (events hidden without analytics consent): https://support.google.com/analytics/answer/7201382
- European Data Protection Board, "Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive", version 2.0 (7 October 2024): https://www.edpb.europa.eu/system/files/2024-10/edpb_guidelines_202302_technical_scope_art_53_eprivacydirective_v2_en_0.pdf
- Google, "EU user consent policy": https://www.google.com/about/company/user-consent-policy/
- ICO, "Guidance on the use of storage and access technologies: What are the exceptions?" (statistical purposes exception): https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/
- Office of the Privacy Commissioner of Canada, "Guidelines for obtaining meaningful consent": https://www.priv.gc.ca/en/privacy-topics/collecting-personal-information/consent/gl_omc_201805/
- Office of the Privacy Commissioner of Canada, "Policy position on online behavioural advertising": https://www.priv.gc.ca/en/privacy-topics/technology/online-privacy-tracking-cookies/tracking-and-ads/gl_ba_1112/
- SCC Online, "MeitY notifies Digital Personal Data Protection Rules, 2025" (notification date and commencement schedule, secondary): https://www.scconline.com/blog/post/2025/11/14/meity-notified-digital-personal-data-protection-rules-2025/
- McCarthy Tétrault, "Quebec's Law 25 and cookies: not so cookie cutter" (secondary): https://mccarthy.ca/en/insights/blogs/techlex/quebecs-law-25-and-cookies-not-so-cookie-cutter