Your cookie banner is live, your tags fire, and the Google Ads diagnostics panel still says your consent setup needs attention. Somewhere in that mess sits one decision most teams never make on purpose: basic vs advanced consent mode. Short answer first. If you run paid media at any real scale, advanced is usually the better choice, because it’s the only setup that gives Google enough signal to model the conversions you lose when people decline cookies. Basic is the cleaner, more conservative option, and there are sites where that caution is the right call.
Below: what each mode sends, what you gain and give up, how to set region-specific defaults for a site with visitors from Europe, the US, the Gulf and India, and how to check the setup actually works.
What consent mode does in one paragraph
Consent mode is Google’s way of letting your tags read the visitor’s cookie choice and change their behavior. It works with four consent types. ad_storage and analytics_storage control whether cookies can be written for ads and analytics. The two added in version 2, ad_user_data and ad_personalization, control whether user data can be sent to Google for advertising and whether it can be used for personalized ads such as remarketing. Your consent management platform (CMP) sets a default state for each one when the page loads, then sends an update when the visitor clicks accept or reject.
The “basic” and “advanced” labels describe what happens before and after that click, specifically whether Google tags load at all when consent is denied.
Basic vs advanced consent mode, side by side
Google’s consent mode overview for developers spells out the mechanics. In the basic version, Google tags are blocked until the visitor interacts with the banner. If they decline, nothing is sent to Google, not even the fact that they declined. In the advanced version, tags load straight away with your default states (usually denied), and while consent stays denied they send cookieless pings instead of full hits.
| What you care about | Basic | Advanced |
|---|---|---|
| Tags load before the banner is answered | No | Yes, with default states |
| Data sent when a visitor declines | Nothing | Cookieless pings |
| Google Ads conversion modeling | General model | Advertiser-specific model |
| GA4 behavioral and conversion modeling | Not available | Available if thresholds are met |
| Legal and reputational exposure | Lower | Higher, needs a clear legal basis |
What is actually inside a cookieless ping
Most of the worry about advanced mode starts here, so it helps to be precise. According to Google’s documentation, a ping sent while storage is denied carries functional information the browser adds anyway (timestamp, user agent, referrer) plus aggregate, non-identifying signals: whether the page URL contained ad-click information, the consent state as true/false values, and a random number generated on each page load. No cookies are read or written.
That is still data leaving the browser before consent. Some privacy teams take the view that any request to a Google domain before consent is a problem. Others are comfortable with it. That’s a legal judgment for your counsel, not a tagging question, and it’s the single biggest reason a company picks basic.
What you lose with basic mode
Modeling. That’s the whole trade.
Google Ads still models some conversions under basic mode, but it uses what Google calls a general model, built on high-level variables like browser type, conversion action type and time of day. Advanced mode feeds an advertiser-specific model that learns from your own cookieless pings. The Google Ads eligibility rules for consent mode modeling ask for 700 ad clicks over a 7-day period per country and domain grouping, and modeled conversions then appear gradually as the model trains.
GA4 is stricter. Behavioral modeling only works with the advanced implementation, and the GA4 behavioral modeling requirements are specific: at least 1,000 events per day with analytics_storage denied for at least 7 days, and at least 1,000 daily users with analytics_storage granted for at least 7 of the previous 28 days. Google also warns that meeting those numbers doesn’t guarantee eligibility.
Here’s what that means in practice. A small B2B site with 300 visitors a day won’t get GA4 modeling in either mode, so the case for advanced rests mostly on Google Ads. A retailer or travel brand with steady traffic and a meaningful EEA share is exactly who the modeling was built for.
A worked example with real-looking numbers
Say you run a tour operator in Lisbon. You spend about $20,000 a month on Google Ads, split across the UK, Germany, the US and the UAE. Your banner data shows roughly 45% of European visitors reject cookies. The US and Gulf traffic mostly accepts or never sees a banner.
Under basic mode, every rejected European session is invisible. Smart Bidding sees fewer conversions in the UK and Germany than really happened, so it bids those markets down, even if they’re profitable. Your reported CPA for Europe looks worse than reality, and the budget drifts toward the US.
Under advanced mode, the rejected sessions still send pings, and the advertiser-specific model fills in part of the gap. It won’t be perfect. It will be a lot closer than zero, which is what the bidding algorithm otherwise works with.
So the basic vs advanced consent mode question comes down to how much you rely on Google’s bidding in consent-first markets. If your whole business is European and paid search drives most revenue, that gap matters a lot. If Google Ads is 5% of your marketing and your legal team is nervous, basic is a perfectly reasonable choice.
Region-specific defaults for international sites
This is the part most setup guides skip. Consent mode lets you set a different default per country, using ISO 3166-2 codes. Google’s consent mode implementation guide also says that when a region and a sub-region both have defaults, the more specific one wins, so a setting for US-CA overrides one for US.
A typical pattern for a global site looks like this:
gtag('consent', 'default', {
'ad_storage': 'denied',
'ad_user_data': 'denied',
'ad_personalization': 'denied',
'analytics_storage': 'denied',
'region': ['AT','BE','BG','HR','CY','CZ','DK','EE','FI','FR','DE','GR','HU','IE','IT','LV','LT','LU','MT','NL','PL','PT','RO','SK','SI','ES','SE','IS','LI','NO','GB','CH'],
'wait_for_update': 500
});
gtag('consent', 'default', {
'ad_storage': 'granted',
'ad_user_data': 'granted',
'ad_personalization': 'granted',
'analytics_storage': 'granted'
});The first command denies everything by default for the EEA, the UK and Switzerland, which are the regions covered by Google’s EU user consent policy. The second sets granted as the default everywhere else. The wait_for_update value gives your CMP 500 milliseconds to load and send the visitor’s saved choice before tags send data.
Don’t copy that second block blindly. How to treat each market is a legal decision, and I’d go through them one at a time:
- United States: most state privacy laws work on an opt-out basis rather than prior consent, so many sites default to granted and honor opt-outs. States with stricter rules on sensitive data can change that.
- United Kingdom: UK GDPR and PECR still require consent for non-essential cookies, so treat it like the EEA.
- India: the DPDP Rules were notified on 14 November 2025 with an 18-month phased compliance window. If India is a big market for you, plan now for a consent-first default there rather than retrofitting later.
- UAE and Saudi Arabia: both have federal data protection laws with consent requirements. Get local advice before defaulting to granted.
If your CMP supports geolocation (most of the big ones do), it’s often simpler to let the CMP handle the regional logic and push the matching defaults into Google Tag Manager, rather than hand-coding country lists.
What to switch on if you go advanced
Two optional settings from the same Google guide are worth knowing.
URL passthrough (gtag(‘set’, ‘url_passthrough’, true)) appends ad-click parameters like gclid and wbraid to internal links when ad_storage is denied, so conversion attribution survives across pages without cookies. It can break sites that are strict about query strings, so test your checkout and booking engine first.
Ads data redaction (gtag(‘set’, ‘ads_data_redaction’, true)) strips ad-click identifiers from Google Ads and Floodlight requests when ad_storage is denied. If your legal team accepted advanced mode reluctantly, this is a cheap concession to offer them.
Setting it up in Google Tag Manager
Most sites run consent mode through GTM and a CMP template. The order of operations matters more than anything else. Google’s guide is blunt about it: if the consent code is called out of order, the defaults won’t work.
- Add your CMP’s template tag and fire it on the Consent Initialization – All Pages trigger, which fires before every other trigger.
- Configure defaults in the template, including region rules, and make sure all four consent types are set.
- For advanced mode, leave your Google tags (Google tag, GA4 events, Google Ads, Floodlight) on normal triggers. They have built-in consent checks and adjust themselves.
- For basic mode, go to each Google tag’s Advanced Settings > Consent Settings and choose Require additional consent for tag to fire, adding ad_storage or analytics_storage as needed.
- Turn on the consent overview under Admin > Container Settings > Enable consent overview. The Tags list then shows which tags have consent configured and lets you bulk-edit the rest.
Non-Google tags such as Meta, TikTok and LinkedIn pixels don’t read consent mode by themselves. Give each one an additional consent requirement, or your banner is only protecting half your stack.
If you’re setting up the property at the same time, my walkthrough on how to set up GA4 properly covers the settings that sit alongside consent.
How to check it’s working
I’ve audited plenty of accounts where the banner looked fine and consent mode wasn’t doing anything. Check three places.
Tag Assistant
Open GTM preview, pick the first event in the timeline and open the Consent tab. You should see the on-page default, the on-page update after you click the banner, and the current state for all four types. If the default row is empty, your CMP is firing too late.
Network requests
In your browser’s developer tools, filter for requests to Google’s collection endpoints and look at the gcs parameter. G100 means ad and analytics storage are both denied, G111 means both are granted. Reject cookies on the banner and confirm the value changes. With basic mode, you shouldn’t see any Google requests at all until you accept.
GA4 consent settings
In GA4, go to Admin > Data collection and modification > Consent settings and pick your web stream. Google’s help page on consent settings explains that it shows your EEA share of traffic and conversions and whether ad-related and analytics-related consent signals are arriving. Without ad_user_data and ad_personalization, only users outside the EEA are added to your audiences, which quietly shrinks remarketing lists.
Give it a few days before you trust the numbers. Also expect a visible drop in GA4 users once basic mode goes live in Europe. That’s not a bug. It’s the traffic you were never allowed to measure.
My recommendation on basic vs advanced consent mode
For most advertisers spending real money on Google Ads with European traffic, run advanced consent mode, deny everything by default in the EEA, UK and Switzerland, and switch on ads data redaction. Choose basic when your legal team says no pre-consent requests, when Google Ads is a minor channel, or when traffic is too low to ever hit the modeling thresholds anyway.
Whichever you pick, write the decision down with the reasoning and the date. Regulators, clients and your future self will all ask. Once consent is sorted, the next job is making sure your reporting reads the data correctly, and my guide to tracking website traffic in GA4 is a good place to start.
If you’d like a second pair of eyes on your consent and tagging setup, the free growth check includes a quick look at it.
Photo by Luke Chesser on Unsplash