Google Consent Mode, basic and advanced

What is Consent Mode?

Consent Mode is how Google's measurement tags (Google Analytics 4, Google Ads, Tag Manager and Floodlight) learn what the visitor decided. They read consent signals set on the page before they run, and they don't read the banner itself. UserGuard sets the four signals that Analytics and Ads read: analytics_storage, ad_storage, ad_user_data and ad_personalization. That's Google Consent Mode v2. Google's other embeds, including Maps, YouTube and reCAPTCHA, don't read any signals, so they stay under the blocking rules.

UserGuard sets all four to denied as soon as its snippet runs. Where the consent model permits the visitor, it grants them from the start. When the visitor decides, it updates them right away: analytics_storage follows the Analytics category, and the three ad signals follow Marketing. You don't have to turn any of this on. It happens on every site as long as the snippet sits above the Google tag in <head>, which is where the install guide puts it. A visitor who accepts everything sends four granted signals, and a visitor who rejects sends four denied ones.

GA4 has no on-off switch for this. It reports whether the signals are arriving for each data stream, under Admin › Data collection and modification › Consent settings. That status can take up to three days to update.

What is the difference between basic and advanced?

Basic and advanced are Google's names for the two ways to run Consent Mode. The one difference between them is whether Google's own scripts load before the visitor decides.

• Basic. The blocking rules hold Google's loaders like any other tracker until the visitor is permitted, which means a choice under opt-in and the first page under opt-out. No Google tag runs before consent. When the visitor accepts, the tags load with granted signals. Basic is UserGuard's default. It depends on blocking being on and on the rules naming Google's hosts, which the built-in rules do.
• Advanced. Google's loaders run without waiting for a choice, with every signal denied. They set no cookies. Instead they send cookieless pings containing a timestamp, the user agent, the referrer, whether the page's URL carried an ad click, and the consent state. Google can then model what the visitors who declined would have done. GA4's behavioral modeling and Google Ads' advertiser-specific conversion model both need this. Basic mode still gets Ads' general model.

Google supports both configurations. Basic is the stricter one, and with it no Google tag runs before consent. Advanced gives that up in exchange for measuring the visitors who said no.

Turning on advanced mode

Open the banner editor, go to Behavior › Google Consent Mode, and turn on Advanced consent mode. Then publish. The badge beside the group reads Advanced. If you turn it off, the badge reads Basic as long as blocking still holds Google's loaders, since a site with blocking off is in advanced mode by another route. Anyone with the member role or above can change this setting.

When advanced mode is on, three Google hosts stop waiting for consent: googletagmanager.com, google-analytics.com and analytics.google.com. That means Tag Manager and the Google tag load for everyone. Google's Analytics and Ads tags inside the container run too, with every signal denied, and their pings go out cookieless. Everything else keeps waiting. UserGuard applies its built-in list of known trackers underneath your own rules, even with blocking switched off, so Meta, CallRail, StackAdapt and the rest stay held where your rules don't name them. So does any script or pixel loaded directly from an ad host such as doubleclick.net.

Some things stay the same. The banner still shows and still records decisions. Visitors sending Global Privacy Control are still treated as opted out, with every signal denied, although Google's loaders run for them too.

One warning about the container. Tag Manager runs before a choice and injects whatever it holds, so a vendor UserGuard has never seen will fire. The snippet can't hold some tags by URL, such as a call to a server container or a Conversions API. Those tags need a consent requirement inside Tag Manager, or they'll fire before a choice. Only turn on advanced mode where you know what the container holds.

Checking it in Google

• Tag Assistant. Load the site without touching the banner. Under basic, the container is absent until you accept. Under advanced, the Google tag loads and the Consent tab shows the four signals denied, then granted once you accept. Test from a browser that doesn't send Global Privacy Control. Brave sends it, so it's treated as opted out.
• GA4. Go to Admin › Data collection and modification › Consent settings. It lists each data stream with its behavior and advertising consent signals and whether they're active.
• Google Ads. Go to Goals › Conversions › Summary and open a website conversion action's Diagnostics tab. It reports consent mode as implemented, below threshold, or modeling.

What modeling needs

Advanced mode sends the pings, but modeling is Google's decision, and Google sets minimums. GA4's behavioral modeling needs at least 1,000 events a day with analytics_storage denied for seven days, and 1,000 daily users with it granted for seven of the last twenty-eight days. It shows modeled data only under the Blended reporting identity, and meeting the minimums doesn't guarantee that Google trains a model. Google Ads' advertiser-specific conversion model needs 700 ad clicks over seven days per country and domain. Below those levels, Google receives the pings and models nothing beyond its general model. On a site with a few hundred decisions a month, expect the signals to be correct and the modeled numbers to stay empty.

Under opt-out and notice

When the consent model is opt-out or notice-only, the visitor is permitted from the start. UserGuard sends granted signals before releasing any tag, and Google's tags then run with cookies from the first page. A visitor who later withdraws, or who arrives with Global Privacy Control, gets denied signals for the categories they declined. A visitor holding a Do Not Sell opt-out keeps the sale categories denied even after Accept all. Under opt-in, nothing is granted until the visitor makes a choice.