TopolearnConsent handling is legally required in many regions and decides whether GA4 can model the users who say no.
Consent mode is the mechanism by which the Google tag adapts to a user's consent choices. Four consent types matter for GA4 and Ads: analytics_storage (GA cookies), ad_storage (ads cookies), and the two added in v2 (late 2023, required for EEA audiences from March 2024): ad_user_data (send user data to Google for advertising) and ad_personalization (remarketing).
The protocol has two calls. gtag('consent', 'default', {...}) must run before the Google tag loads, setting each type to denied or granted, optionally per region and with wait_for_update (milliseconds to wait for the banner's answer before sending anything). When the user chooses, your banner calls gtag('consent', 'update', {...}). Consent management platforms (Cookiebot, OneTrust, Usercentrics, Google's own template in GTM) issue these calls for you; your job is to make sure the default runs first and the update runs on every page load with the stored choice.
Two implementation levels:
- Basic: tags do not load at all until consent; no data from decliners.
- Advanced: tags load with denied defaults and send cookieless pings (no identifiers stored). GA4 uses those pings to run behavioural modelling, filling in estimated sessions and key events for the consented-but-missing population in reports (Blended identity). Modelling needs enough volume: roughly 1,000 denied-consent events per day for 7 of the last 28 days.
Other privacy controls in GA4: IP addresses are never logged or stored in GA4 (anonymisation is not a setting; it is the design), with EU traffic processed on EU servers; Google signals and Granular location and device data collection can be turned off per region under Admin > Data collection; Ads personalisation can be disabled per region; data-sharing settings on the account; data retention and deletion from the previous lesson; and the ability to disable collection entirely with window['ga-disable-G-XXXX'] = true.
Verify in DebugView: each event shows its consent state, and Tag Assistant's consent tab shows the default and update sequence.
Example
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){ dataLayer.push(arguments); }
// 1. Defaults BEFORE the Google tag loads: deny everything in the EEA/UK, wait 500 ms for the banner
gtag('consent', 'default', {
ad_storage: 'denied', ad_user_data: 'denied', ad_personalization: 'denied',
analytics_storage: 'denied',
region: ['AT', 'BE', 'DE', 'FR', 'IT', 'ES', 'NL', 'GB', 'CH' /* ...rest of EEA */],
wait_for_update: 500
});
gtag('consent', 'default', { ad_storage: 'granted', ad_user_data: 'granted',
ad_personalization: 'granted', analytics_storage: 'granted' });
</script>
<script async src="https://www.googletagmanager.com/gtag/js?id=G-ABC123XYZ"></script>
<script>
gtag('js', new Date());
gtag('config', 'G-ABC123XYZ');
// 2. Called by your cookie banner, and again on every page load with the stored choice
function onConsent(choice) {
gtag('consent', 'update', {
analytics_storage: choice.analytics ? 'granted' : 'denied',
ad_storage: choice.ads ? 'granted' : 'denied',
ad_user_data: choice.ads ? 'granted' : 'denied',
ad_personalization: choice.ads ? 'granted' : 'denied'
});
}
</script>Remember
- Four consent types; v2 added ad_user_data and ad_personalization
- 'default' before the tag loads, 'update' from the banner, on every page
- Advanced mode sends cookieless pings that power behavioural modelling