Consent Mode absent or mis-wired

Symptom and cause

Symptom

EU/UK customers are buying, invisibly. A banner is installed, but conversions from consented users still don't show up.

Cause

The consent banner sits in front of the tags but Consent Mode v2 was never wired, or wired backwards. Tags either fire with no signal, or never fire at all.

Where it's caught

Consent Mode debugging: default/update states missing or inverted; a visible gap between platform sales and tracked conversions in EU traffic.

How the signal gets lost

Consent Mode is a JavaScript signalling layer that sits over Google tags. A default call fires before any tag loads (ideally region-scoped to the EEA, UK and Switzerland, all four signals denied, with a wait_for_update of around 500ms), then an update call carries the shopper's actual choice once they interact with the CMP. Two of the four signals, ad_storage and analytics_storage, change on-page behaviour: cookies, device identifiers, pings. The other two, ad_user_data and ad_personalization, are downstream instructions that govern whether personal data is sent to Google for advertising and used for remarketing. The fault lands in one of three states: no default ever set; an update that never fires, so the hit stays frozen on the denied default; or a race where wait_for_update is too short and the ping leaves before the CMP answers. Basic Consent Mode blocks tags entirely on denial, so nothing is sent. Advanced loads tags on the denied default and sends a cookieless ping (gcs G100) that modelling needs. From 15 June 2026, ad_storage consent became the sole control over whether Google Ads cookies and identifiers are collected for the GA4-to-Ads ad-data flow. Google Signals, which previously also gated that flow, now governs only the association of GA4 data with signed-in users for GA4-internal behavioural reporting. With that backstop gone, any setup where ad_storage is denied or mis-sent loses the conversions the Signals link once partly carried. Modelling rebuilds reporting and the bidding signal, but not remarketing audiences. The loss is confined to where ad_storage is denied or mis-sent. Accounts that already grant ad_storage see little change, and some that historically suppressed sharing via Signals may now share more.

US / paid (google / cpc) conversions track sessions, consent granted

EU-UK / paid · tracked ↑ sessions high, conversions collapsed

EU-UK / paid · should be here consented conversions, never signalled

US / organic

EU-UK / organic server-counted, less consent-gated

the consent gap

Channel, as GA4 files it	Sessions	Conv.
US / paid (google / cpc)	3,180	214
EU-UK / paid (google / cpc)	████ 3,760	41
US / organic	2,040	96
EU-UK / organic	1,690	58
EU-UK / paid · modelled recovery	n/a	~120 (not firing)

How to catch it

1. Open tagassistant.google.com against the live site in a fresh incognito session. Read the earliest Consent event before you touch the banner: all four signals (ad_storage, ad_user_data, ad_personalization, analytics_storage) must appear in the On-page Default column, set to denied for EEA/UK. An empty Consent tab, or a warning that a tag read consent before a default was set, is the fault.
2. Still in Tag Assistant, reject in the banner and watch for an On-page Update event, then reload and accept all. If rejecting and accepting produce no change in the Consent tab, or the tags fire identically with full storage on both paths, the banner is decorative and never calls the gtag consent API. That is the core mis-wire.
3. In DevTools, Network, filter on collect, and read the gcs and gcd parameters on the hit to google-analytics.com/g/collect (or region1.google-analytics.com/g/collect for EU-hosted collection). gcs is G1xy, where x is ad_storage and y is analytics_storage: G100 is both denied, G111 is both granted. gcs stuck on G111 regardless of the banner, or no gcs and gcd at all, means Consent Mode is not driving the tags. gcd present but carrying only two states, or gcd absent entirely after interaction, means v2's ad_user_data and ad_personalization are not wired.
4. In GA4, Admin, DebugView, confirm the signals reach GA4. With analytics_storage denied under Advanced mode you should still see events arrive carrying no _ga and no cid; a populated cid on reject means consent is not applied. Under Basic mode a denied user sends nothing, so an empty DebugView until consent is granted is correct, not broken. Work out which mode you are in before you call it a fault.
5. Read the dashboard tell before you open the site. In Traffic acquisition or the Ads conversions report, compare EEA/UK conversions against sessions and against non-consent regions. A conversion-to-session ratio that collapses for EU and UK paid while US holds, starting on the date a banner or GTM container shipped, points at F-201. Confirm in Google Ads, Conversions, Diagnostics, whether consent-mode modelling is active for those domain-by-country pairs.
6. Run the money check, then rule out F-204. Pull real EU/UK store orders (Shopify, Woo, CRM) for a window and set them against tracked Google Ads conversions and GA4 transactions for the same segment; a shortfall well beyond the normal platform-to-store delta flags consent loss. To separate it from F-204, append ?gclid=test to an ad landing URL and confirm the gclid survives the redirect chain. gclid surviving but gcs stuck or absent is F-201; gclid stripped mid-redirect while gcs reads correctly is F-204. The two can co-exist, so check both.

What putting it right involves

1. Set the default to denied before any tag loads. Fire gtag('consent','default', ...) on GTM's Consent Initialization trigger with all four signals (ad_storage, ad_user_data, ad_personalization, analytics_storage) denied and wait_for_update around 500ms. Scope it with the region key, an array of ISO 3166 codes for the EEA, UK and CH, so non-consent jurisdictions are not throttled for no reason. The property key is the singular region taking an array value, not regions, which is a real implementation bug.
2. Fire the update call on the banner decision. Map the CMP's accept and reject onto gtag('consent','update', ...) for all four signals, not only ad_storage and analytics_storage, and persist the choice so it reapplies on return visits. The defining F-201 mis-wire is a CMP that stores the choice but never emits the update, which leaves the tags frozen on the denied default. The tell is gcs and gcd that never move between accept and reject.
3. Move from Basic to Advanced Consent Mode where EEA/UK denial rates are material. Basic blocks tags entirely on denial, so Google receives nothing to model from. Advanced sends cookieless pings (gcs G100) that feed conversion modelling. Modelling recovers reporting and the bidding signal, partially, once a baseline of data exists. It does not rebuild remarketing audiences: non-consenting users are never added to audience lists, so do not present modelling as making denied consent costless.
4. Add the recovery backstops, and state their scope. Enhanced Conversions (gated by ad_user_data granted, and for EEA traffic also requiring ad_storage granted) improves match quality for the consented population only. It is not a recovery path for non-consenting users and is no substitute for ad_storage. Server-side tagging can re-send events when ad_storage is later granted, but it is not immunity to tracking prevention and does not bypass consent: if the browser request to the endpoint is blocked the chain breaks at the origin, and denied stays denied.
5. Make the 15 June 2026 privacy decision on purpose, rather than inheriting it from a dead toggle. ad_storage is now the sole control over whether Google Ads cookies and identifiers are collected for the GA4-to-Ads flow, and Google Signals now only governs the association of GA4 data with signed-in users for GA4-internal behavioural reporting. If Signals was historically kept off as a soft privacy lever, that lever no longer gates the Ads data flow. Grant ad_storage and Google may link the shopper to their Google sign-in, which is more sharing than the old Signals-off state produced; deny it and Google sees little beyond the gclid, which also kills Ads measurement. Decide it as a trade-off. Do not let the old Signals setting decide it silently.
6. Verify end to end. In DevTools confirm gcs and gcd flip between reject (denied) and accept (granted) on a fresh session; confirm the default fires before any measurement tag; in Tag Assistant confirm the four signals on the earliest Consent event and a cookieless ping on denial under Advanced; in Google Ads, Conversions, Diagnostics, confirm Consent Mode is detected with no missing-parameter warnings. Then re-run the EU/UK store-sales-to-tracked ratio and confirm the abnormal portion of the gap has closed. The goal is not that tracked now equals store sales, which it never will.