What happens to your GA4 data when users reject cookies

All posts

When a visitor rejects cookies, GA4 receives either nothing at all or a cookieless ping with no client ID, and your Consent Mode decides which. With no Consent Mode, or with basic, the tag never sends: no pageview, no session, no conversion. With advanced Consent Mode the ping still carries the page, the referrer and a timestamp. Google can model part of the rest, but only if your property meets its eligibility thresholds.

The three states your site can be in

Almost every argument about consent and analytics comes down to a question people rarely ask out loud: when someone clicks reject, does anything leave the browser at all? There are only three possible answers, and your site is in exactly one of them right now.

If you have a banner that blocks tags and no Consent Mode wiring, the GA4 tag simply never runs for that visitor. If you run basic Consent Mode, the tag is held back until consent arrives, so a reject means it never loads either. In both cases the visit produces no data whatsoever. If you run advanced Consent Mode, the tag does load, checks the consent state, and sends a stripped down ping with analytics_storage set to denied. That ping is the entire difference between a gap Google can estimate and a gap that stays empty forever.

This is worth confirming rather than assuming. Plenty of teams believe they run advanced because their CMP advertises Consent Mode v2 support, while the tags on the page tell a different story. We wrote a separate walkthrough on telling basic and advanced apart in a live browser.

What GA4 keeps, and what it quietly loses

Assume the good case: advanced Consent Mode, pings flowing. You still do not get your data back. You get an anonymous shadow of it, and the shape of that shadow is what breaks reports.

The cookieless ping has no client ID and no session ID. GA4 therefore cannot connect two pageviews from the same rejecting visitor, and Google's modelling documentation admits it cannot tell whether those pings came from ten users or one. Without modelling, that slice adds events but no people GA4 can count. With modelling, Google estimates users, sessions and new users from consented traffic, while event counts stay as observed. Anything built on identity goes with it: user journeys, User Explorer rows, cohort behaviour. Conversions still fire as events, but with no identity to attribute them to, they tend to pile up under direct or unassigned traffic, which is exactly where a paid channel's credit goes to die.

How to tell which state your site is in

1. Open your site in a fresh incognito window

   A normal window carries an old consent decision, which is the single most common reason this test gives a false result. Incognito guarantees you see what a first time visitor sees.

2. Open the Network tab, then click reject

   Filter requests for collect. Do this before dismissing the banner, so you capture what fires in the moments around the decision rather than after it.

3. Look for a request that fires anyway

   A /g/collect request that still goes out after you rejected means the tag is running in advanced mode. An empty panel means basic, no Consent Mode at all, or a tag that is broken in a way nobody has noticed.

4. Read the gcs parameter on that request

   This is the part that settles the argument. Open the request and find gcs in the payload. A value of G100 means both storage signals arrived denied, which is exactly what a correctly wired reject looks like. Its presence proves the consent state reached Google rather than being dropped on the way.

5. Check your volumes against Google's thresholds

   Advanced mode only produces modelled data if your property qualifies, and many small sites do not. The thresholds are in the next section. Check them before you count on modelled numbers appearing in your reports.

Modelling is not a refund

Behavioural modelling is real and it does help, but it comes with published conditions that almost nobody checks against their own traffic.

Google's documentation is explicit. Modelling needs advanced Consent Mode on every page, with Google tags loading before the consent dialog appears and whether or not the visitor consents. Modelled numbers then show only under the Blended reporting identity. A property also needs at least 1,000 events per day with analytics_storage denied for at least 7 days. It also needs at least 1,000 daily users sending events with consent granted on 7 of the previous 28 days. Meeting both, Google notes, still does not guarantee eligibility. Below those volumes there is no modelling at all, no warning, and no banner in the interface telling you so. Your reports simply show the consented part of your traffic and present it as the whole picture.

The second limit is the one that catches sophisticated teams. Modelled data never leaves the GA4 interface. Google excludes it from the BigQuery export, from audiences, from user explorer, cohort and user lifetime explorations, from sequence segments, from retention reports and from predictive metrics. Your warehouse does receive the cookieless events, as Google's export documentation notes. They carry no persistent identifier unless your site sends its own user_id, so most user level counts there cover consented visitors only. The two numbers will never reconcile, because they were never measuring the same population.

A correctly wired advanced setup gives Google the signal it needs to model, and some of what the banner hides stays hidden regardless of what you buy. If you want to work through it in order, we wrote a step by step guide to conversions and consent.

What this actually costs

How much of this applies to you depends on your own consent rate, which varies with region, audience and banner design. You can measure it two ways: read the accept rate in your consent tool, or compare GA4 sessions with the requests your server or CDN logged over the same days. We went through where rejected sessions go in a separate post, and through the signals themselves in our plain English guide to Consent Mode v2.

Find out which of the three states you are in, today, in an incognito window. If nothing leaves the browser on reject, you are not losing data to privacy law. You are losing it to a configuration nobody finished. That is the gap Velo is built to close: the banner, the default denied signals and the Consent Mode v2 wiring ship as one configured layer, so the reject path is deliberate rather than accidental.