Consent Mode v2 is Google's mechanism for making its tags (GA4, Google Ads) respect each visitor's cookie choice. "Default denied" means every consent type starts out as "denied" until the visitor actively accepts. If your tracked traffic dropped after you rolled it out, that's almost always a measurement drop, not a business one: GA4 simply can't see visitors who decline, or only sees them as estimates.
We hear the same line from Hungarian small businesses all the time: "we added the cookie banner and GA4 says traffic fell off a cliff." Here's what's happening under the hood, how to check whether your setup is right, and how we measure without building reports on a legal grey area. One caveat up front: we're not lawyers. We know the technical side, so make the final call with your own data protection adviser.
- "Default denied" means Google tags don't set cookies without consent, and all four consent signals (
ad_storage,analytics_storage,ad_user_data,ad_personalization) start as denied. - Tracked traffic drops because visitors who decline are not measured at all in basic mode, and in advanced mode you only get cookieless signals from them.
- GA4's behavioural modelling only switches on above certain traffic thresholds, and even then it's not guaranteed. Plenty of small business sites stay below them.
- Check your real traffic against consent-independent sources: Search Console, shop orders, your CRM, server logs.
- For most small businesses, the safest combination is basic mode, an honest banner and reporting anchored to backend data.
What does "default denied" actually mean?
Consent Mode is a signalling system. According to Google's developer documentation, it controls how Google tags behave based on the user's consent choices. Collecting that consent is still your job, through a banner or a consent management platform (CMP). Consent Mode just passes the decision on to the tags.
Version 2 added two signals alongside the existing ad_storage and analytics_storage: ad_user_data covers sending advertising-related user data to Google, and ad_personalization covers personalised ads (see the setup guide). "Default denied" is the initial state you set before any tag loads:
gtag('consent', 'default', {
ad_storage: 'denied',
analytics_storage: 'denied',
ad_user_data: 'denied',
ad_personalization: 'denied',
wait_for_update: 500
});When the visitor makes a choice in the banner, the CMP overwrites the relevant signals with an update command. wait_for_update sets how many milliseconds tags should wait for the banner's answer before firing.
Why did this suddenly become everyone's problem in 2024? From March 2024, Google made measurement, remarketing and personalisation features in the EEA conditional on passing consent signals. Google's EU user consent policy help page says advertisers must send those signals via Consent Mode or the IAB TCF. A CMP from Google's partner programme isn't mandatory for advertisers, only for publishers selling ad inventory. The same page also states that a certified CMP doesn't guarantee compliance on its own.
What's the difference between basic and advanced mode?
This choice determines how much data you see and how much legal risk you take on. Google Ads Help summarises it like this:
| Basic mode | Advanced mode | |
|---|---|---|
| Before consent | Nothing is sent to Google, not even the default consent state | Tags load and the consent state is sent |
| When consent is denied | Tags don't run | Cookieless pings are sent |
| Conversion modelling | General model | Advertiser-specific, more detailed model |
Advanced mode gives you more data, but the declining visitor's browser still talks to Google. The European Data Protection Board's Guidelines 2/2023 stress that Article 5(3) of the ePrivacy Directive covers more than cookies and extends to other tracking techniques. We won't rule on whether cookieless pings fall under it. What we will say is that this isn't a call for your developer to make; weigh it up with a lawyer.
Why did your tracked traffic drop?
Your visitors didn't vanish, your visibility of them did
In basic mode, anyone who declines, or just closes the banner, doesn't exist as far as GA4 is concerned. In advanced mode, cookieless pings don't become proper sessions: there's nothing tying pageviews together, so they don't show up in reports the way a consenting visitor's journey does. If the banner went live on a specific day, you'll see a step in the chart. That's where your measurement changed, not your business.
On smaller sites, modelling often never kicks in
GA4's behavioural modelling is meant to fill in the gaps for visitors who decline, but Google's prerequisites are strict. Consent Mode has to run on every page, in the advanced setup. The property must collect at least 1,000 events a day with analytics_storage denied for at least seven days, and it needs enough consenting users too. Google adds that meeting these doesn't guarantee eligibility, because the model checks further criteria. A smaller service site or a young online shop often won't get there, which leaves you with no modelled data, just the people who said yes.
Or the setup is simply wrong
These are the mistakes we run into most often in audits:
- The default is set too late. If the GA4 tag fires before the
defaultcommand, measurement becomes unpredictable. In GTM, that's what the Consent Initialization trigger is for. - The banner never sends an
update. The visitor accepts, but the signal never reaches the tags, so nothing is measured even after consent. - Duplicate tags. A hard-coded gtag snippet and a GTM-managed GA4 tag run side by side with different consent handling.
- The default is "granted" for everyone. That's a compliance failure rather than a measurement one, and the numbers look suspiciously healthy.
You can check all of this in Tag Manager's preview mode, which shows the consent state for each event and when each tag fired.
How do you find out how much traffic you really lost?
Compare GA4 against sources that don't depend on the cookie banner:
- Search Console: Google measures organic search clicks on its own side. If there's no step there but there is one in GA4, the traffic is still arriving; you just can't see it.
- Shop backend and CRM: an order or a quote request is a fact, not an estimate. For online shops, backend order data is always our reference point and GA4 only shows the proportions (something we build in from the start in our webshop development work).
- Ad clicks: the clicks you see in Google Ads are recorded in the ad system, not on your site.
- Server logs: raw and full of bots, but good enough to show the trend.
What matters is the ratio: how many GA4 sessions you get per backend order or per Search Console click. If that ratio shifts once when the banner launches and then holds steady, you're looking at your new measurement baseline, and you can track trends from there.
How do you measure in a GDPR-friendly way?
- Start with the banner. In a 2022 cookie decision (NAIH-3195/2022), the Hungarian data protection authority, as reported, set out that consent must be requested separately for each purpose, withdrawal must be possible, the information must be clear, and this duty can't be offloaded onto partners. We'd add one thing: declining should be exactly as easy as accepting.
- Our default is basic mode. For most Hungarian small businesses it's the cleaner option: less data, but no argument about what left the browser without consent. We suggest considering advanced mode when meaningful Google Ads spend depends on conversion data and a lawyer has signed off.
- Build on your own data. Source data captured on forms and orders (for example, incoming UTM parameters) stays in your system and isn't an estimate.
- Report trends, not absolute numbers. Annotate the banner launch date in GA4 and treat it as your new zero point. Don't compare old and new figures like for like.
- Server-side tagging isn't a workaround. It gives you more control over what goes to third parties, but it doesn't replace the consent requirement.
If you also care about how visible you are in search, our technical SEO article covers what we check on a site from the point of view of Google and AI search engines.
Frequently asked questions
Does a small business in Hungary have to use Consent Mode v2?
If you use Google Ads, remarketing or GA4 with visitors in the EEA, Google expects consent signals, and without them you lose certain measurement and advertising features. If you don't use Google tags, Consent Mode isn't relevant, but the cookie consent rules still apply to you.
Is a Google-certified CMP enough?
No. Google itself says a certified CMP doesn't guarantee compliance, because that depends on the actual configuration and the wording of the banner. The CMP is a tool; responsibility stays with the site owner.
Does GA4 modelling bring the lost data back?
Only partly, and only if the property meets Google's thresholds. Modelled data is an estimate inferred from the behaviour of consenting visitors. It's a useful compass for decisions, not something to do your books with.
Do cookieless analytics tools solve the problem?
They can narrow what you collect, but according to the EDPB guidelines the ePrivacy rule isn't limited to cookies. Whether a specific tool needs consent depends on how it's configured, so decide that with a lawyer.
How can I tell if my setup is right?
In Tag Manager's preview, check that the default command runs before every tag and that an update appears after the visitor accepts. If you'd rather not dig through it alone, we'll take a look as part of our free audit.
If you want your tracking, banner and reporting sorted out together, that's exactly what our marketing team does: clean data you can actually base decisions on.