GA4 Consent Mode v2:
set up correctly, run GDPR-compliant.

In Basic mode, Google tags are blocked entirely until a user gives consent: no requests reach Google before opt-in, and rejected users send no data at all. In Advanced mode, the tags load immediately but send cookieless pings (no identifiers) when consent is missing, which lets Google model the conversions you lose to rejection. Advanced recovers more data; Basic is the more conservative choice from a data-protection standpoint because nothing is sent without consent. The trade-off is data recovery versus legal caution.

For European Economic Area traffic, yes, in practice. Since 6 March 2024 Google requires Consent Mode v2 signals to keep using audience lists, remarketing and personalised measurement features in Google Ads and GA4. This is driven by the EU Digital Markets Act. Without v2, you do not lose Google Ads itself, but you lose remarketing audiences, conversion modelling and personalised measurement for EEA users. It is not a German law: it is a Google platform requirement.

This is genuinely contested, not settled. Advanced mode sends cookieless pings even from users who have not consented, and several German and Austrian data-protection experts argue that transmitting any data to Google before consent can constitute processing without a legal basis. For maximum legal caution, many DACH specialists recommend Basic mode, where nothing is sent until opt-in. This is a documented trade-off rather than a verdict. We give you a technical assessment so you can make an informed decision with your own legal counsel. This is not legal advice.

You need a Google-certified consent management platform that natively supports Consent Mode v2. The most common in the DACH region are Cookiebot, Usercentrics, and the open-source Consentmanager and Klaro options. What matters is not the brand but the wiring: the CMP must set the four consent signals before any Google tag fires, push them into the dataLayer, and update them when the user changes their choice. A certified CMP that is incorrectly configured still leaks data, which is the most common failure we find.

They are two of the four consent signals introduced by Consent Mode v2. ad_user_data governs whether user data may be sent to Google for advertising purposes; ad_personalization governs whether that data may be used for personalised advertising and remarketing. They were added on top of the original two signals (analytics_storage and ad_storage) specifically to satisfy the EU Digital Markets Act. If these two are not transmitted correctly, Google Ads degrades remarketing and personalised measurement for your EEA audience.

Use Google Tag Assistant and the browser network tab to confirm that no Google requests fire before consent (Basic) or that cookieless pings carry gcs and gcd parameters (Advanced). Check that all four signals (analytics_storage, ad_storage, ad_user_data, ad_personalization) update the instant a user accepts or rejects. In GA4, the Consent Mode reporting and the modelled conversions panel confirm the signal is reaching Google. The single most common silent failure is a tag that fires once before the CMP has set the default state.

Google states that conversion modelling in Advanced mode can reconstruct over 70 percent of the conversion paths lost to cookie rejection. That figure is Google's own and applies only to Advanced mode with sufficient data volume; modelling needs a minimum traffic threshold to activate. Real recovery varies by site, traffic and consent rate, so treat 70 percent as a ceiling, not a guarantee. In Germany, where roughly 40 percent of users reject cookies, the recoverable gap is large enough to matter.

They solve different problems and work best together. Consent Mode governs the legal signal: whether and how data may be collected. Server-side tracking governs the channel: it moves measurement to your own server so ad-blockers, Safari ITP and iOS restrictions stop deleting your events. Consent Mode without server-side still loses data to browser-level blocking; server-side without correct Consent Mode is a compliance risk. The robust setup combines both: consent enforced on the server, and the signal honoured end to end.