What a wrong consent category does to GA4 and Google Ads

All posts

A cookie in the wrong consent category sends Google the wrong Consent Mode signal. Filed too strictly, analytics_storage or the advertising signals stay denied, so GA4 drops visitors who said yes and Google Ads stops building audiences from them. Filed too loosely, tags run for people who said no. The gcs parameter on the live page shows which.

Where does the category actually reach Google?

Your consent tool shows categories: necessary, functional, analytics, marketing. Google never sees those names. What Google reads are the Consent Mode signals the banner sets when the visitor decides, and the four that matter for measurement are listed in Google's Consent Mode reference: analytics_storage for analytics cookies, ad_storage for advertising cookies, ad_user_data for sending user data to Google for advertising, and ad_personalization for personalised ads.

Somewhere between the banner and the tag, each category is wired to one or more of those signals. The usual wiring is analytics to analytics_storage, and marketing to the three advertising signals together. A category decides your data in two places, then. It sets the signal Google's own tags read, and in tools that block scripts by category, it decides whether a script is allowed to load at all.

So a wrong category rarely looks wrong in the consent tool. The defect only shows up in what leaves the page.

What does each wrong assignment do to your data?

Four mistakes cover most of what goes wrong. The first three cost you data you were allowed to have. The fourth costs you nothing in the reports, which is exactly why it survives.

• Analytics wired to the wrong signal. A visitor accepts analytics and declines marketing, but the analytics category was mapped to ad_storage, or both categories to a single signal. GA4 receives the visit without its cookie, so a visitor who said yes drops out of your observed reports exactly as if they had declined, along with their key events.
• Marketing that never moves the two newer signals. The category updates ad_storage but leaves ad_user_data and ad_personalization at denied. Consent looks fine for storage, yet Google is told it may not use that visitor's data for advertising or personalisation, so remarketing audiences stop growing from people who agreed to them.
• The Google tag, or the whole container, filed under marketing. In a tool that blocks scripts by category, declining marketing then removes the container itself. Visitors who accepted analytics send GA4 nothing at all, and, if you run Consent Mode in advanced mode, visitors who declined everything no longer send the cookieless request that Google's modelling depends on.
• An advertising pixel filed under analytics or functional. The pixel runs for visitors who refused marketing. It is a compliance defect rather than a data one, and it is the version regulators can see from outside in one page load.

Choosing the right category for a given script is its own question, and we answered it in which consent category each third party script belongs in. This post is about the cost of getting it wrong, and how to find out whether you already have.

How do you check your own category mapping?

Six steps. Run the tests on the live site in a clean browser window, never in Tag Assistant preview.

1. Write down what each category should update

   Open your consent tool's Consent Mode settings and note, per category, which of the four signals it changes. Analytics should change analytics_storage. Marketing should change ad_storage, ad_user_data and ad_personalization together.

2. Accept analytics only and read gcs

   Load the page, open the network panel, filter for collect, then accept analytics and decline marketing. The next request should carry gcs=G101. G110 means the wires are crossed. G100 means the analytics category is not updating anything Google reads.

3. Accept marketing and read gcd

   In a fresh window, accept marketing and decline analytics. gcs only covers the two storage signals, so read the gcd parameter, which encodes all four. Both ad_user_data and ad_personalization should show as granted by the update. How to decode it is in what the gcd parameter means.

4. Decline everything and confirm the container still loads

   With everything declined and Consent Mode in advanced mode, a collect request should still leave carrying gcs=G100. An empty panel means the Google tag or Google Tag Manager itself sits in a category that blocks it. Move it out: Google's tags enforce consent themselves, as we explain in whether to block Google tags until consent.

5. Look for advertising domains outside marketing

   Go through your consent tool's list of scripts and cookies. Anything from Meta, TikTok, LinkedIn, Microsoft Advertising or Google's advertising domains that sits under analytics or functional is running for people who refused marketing. Move it, then decline marketing and confirm nothing from those domains loads.

6. Confirm the signals arrive after a few days

   In GA4, go to Admin and, under Data collection and modification, open Consent settings, then select the data stream. It shows whether analytics and advertising consent signals are reaching the property, and flags problems it detects. Google Ads shows consent mode status in its conversion diagnostics. Both lag, so read them after a few days of traffic, not on the day of the fix.

What does the damage look like in your reports?

If you cannot test yet, the reports usually hint at which mistake you have. A crossed analytics wire tends to show as a fall in observed users and sessions, dated to the day the banner or its settings changed, while the share of visitors accepting analytics has not moved. Missing advertising signals show as remarketing lists that stop growing while traffic holds, and as an Action required label in GA4's consent settings. A blocked container shows as a sharp fall in all GA4 traffic from consent regions, which people often read as a tracking outage.

Traffic, campaigns and seasonality move the same numbers, so treat these symptoms as the reason to run the six steps. The gcs reading is the diagnosis.

Some loss is intended. Visitors who decline analytics stay missing from GA4's observed data, and whether Google models them depends on your property meeting its data thresholds, covered in what consent modelling is and when it starts.

Where a person still has to decide

Most of this comes down to two decisions: which signal a category drives, and which category a script belongs in. The first is plumbing and should not change once it is right. The second changes every time someone adds a tag, which is why an estate that was correct at launch drifts.

Velo fixes the first in code rather than in a settings screen: marketing drives all three advertising signals together and analytics drives analytics_storage, so that wiring cannot drift. The second stays a human call. Velo lists what its scan finds for you to review and place, and the check above is still worth running after every change.