Google Consent Mode, basic and advanced

Google's tags read consent signals, not the banner. UserGuard sets them on every site with no setting. Here is what they say, what basic and advanced mean, and how to see them in Google.

Google's measurement tags — Google Analytics 4, Google Ads, Tag Manager, Floodlight — do not read the banner's decision directly. They read consent signals set on the page before they run. UserGuard sets the four that Analytics and Ads read: analytics_storage, ad_storage, ad_user_data and ad_personalization. That is Google Consent Mode v2. Google's other embeds, Maps, YouTube and reCAPTCHA among them, read no signals at all, which is why those stay under the blocking rules.

UserGuard sets all four to denied as soon as its snippet runs, grants them from the start where the consent model permits the visitor, and updates them the moment the visitor decides: analytics_storage follows the Analytics category, and the three ad signals follow Marketing. This happens on every site, with nothing to turn on, as long as the snippet sits above the Google tag in <head>, which is where the install guide puts it. A visitor who accepts everything sends four granted signals; a visitor who rejects sends four denied ones.

GA4 has no on-off switch for this. It reports whether the signals arrive, under Admin › Data collection and modification › Consent settings, per data stream; the status can take up to three days to update.

Basic and advanced

These are Google's names for the two ways to run Consent Mode. They differ in one thing: whether Google's own scripts load before the visitor decides.

Basic. Google's loaders wait until the visitor is permitted, held by the blocking rules like any other tracker: a choice under opt-in, the first page under opt-out. No Google tag runs before consent. When the visitor accepts, the tags load with granted signals. This is UserGuard's default, and it rests on blocking being on and the rules naming Google's hosts, which the built-in rules do.
Advanced. Google's loaders run without waiting for a choice, with every signal denied. They set no cookies and send cookieless pings instead: a timestamp, the user agent, the referrer, whether the page's URL carried an ad click, and the consent state. Google can then model what the visitors who declined would have done. GA4's behavioural modelling and Google Ads' advertiser-specific conversion model both need this; basic mode still gets Ads' general model.

Both are supported Google configurations. Basic is the stricter one and keeps the promise that no Google tag runs before consent. Advanced trades that promise for measurement of the visitors who said no.

Turning on advanced mode

Open the banner editor, then Behavior › Google Consent Mode, and turn on Advanced consent mode. Publish. The badge beside the group reads Advanced; turn it off and it reads Basic, as long as blocking still holds Google's loaders, since a site with blocking off is in advanced mode by another route. Only an admin can change it.

What changes: three Google hosts, googletagmanager.com, google-analytics.com and analytics.google.com, stop waiting for consent, so Tag Manager and the Google tag load for everyone. Google's Analytics and Ads tags inside the container run too, with every signal denied, and their pings go out cookieless. Everything else keeps waiting: UserGuard's built-in list of known trackers is applied underneath your own rules, even with blocking switched off, so Meta, CallRail, StackAdapt and the rest stay held where your rules do not name them, and so does any script or pixel loaded directly from an ad host such as doubleclick.net.

What does not change: the banner still shows and still records decisions. Visitors sending Global Privacy Control are still treated as opted out, with every signal denied; Google's loaders run for them all the same.

One warning. Tag Manager runs before a choice and injects whatever it holds, so a vendor UserGuard has never seen will fire. Tags inside the container that the snippet cannot hold by URL — a call to a server container or a Conversions API, for instance — need a consent requirement inside Tag Manager, or they fire before a choice. Turn advanced mode on only where you know what the container holds.

Checking it in Google

Tag Assistant. Load the site without touching the banner. Under basic, the container is absent until you accept. Under advanced, the Google tag loads and the Consent tab shows the four signals denied, then granted once you accept. Test from a browser that does not send Global Privacy Control; Brave sends it and is treated as opted out.
GA4. Admin › Data collection and modification › Consent settings lists each data stream with its behaviour and advertising consent signals and whether they are active.
Google Ads. Goals › Conversions › Summary, then a website conversion action's Diagnostics tab, reports consent mode as implemented, below threshold, or modelling.

What modelling needs

Advanced mode sends the pings; modelling is Google's decision, and Google sets floors. GA4's behavioural modelling needs at least 1,000 events a day with analytics_storage denied for seven days, and 1,000 daily users with it granted for seven of the last twenty-eight days; it shows modelled data only under the Blended reporting identity, and meeting the floor does not guarantee Google trains a model. Google Ads' advertiser-specific conversion model needs 700 ad clicks over seven days per country and domain. Below those, Google receives the pings and models nothing beyond its general model. A site with a few hundred decisions a month should expect the signals to be correct and the modelled numbers to stay empty.

Under opt-out and notice

When the consent model is opt-out or notice-only, the visitor is permitted from the start, so UserGuard sends granted signals before releasing any tag; Google's tags then run with cookies from the first page. A visitor who later withdraws, or who arrives with Global Privacy Control, gets denied signals for the categories they declined, and a visitor holding a Do Not Sell opt-out keeps the sale categories denied even after Accept all. Under opt-in, nothing is granted until a choice.