Many UK e-commerce teams assume that enabling Consent Mode “Basic” keeps them fully compliant and maximises data recovery, but this approach can still leak identifiers before consent—raising legal risk under UK GDPR and PECR. The difference between Consent Mode Basic and Advanced is not just technical; it shapes what Google tags send about your users before you have permission, and how much of your ad and analytics data you can recover after consent is given.
By the end, you’ll be able to identify exactly what data your Google tags send before consent under both modes, assess the real legal exposure for UK sites, and decide which Consent Mode implementation aligns with your risk tolerance and measurement needs.
Consent Mode Basics: What It Does and Why It Matters
Consent Mode controls how Google tags act before and after a user gives consent. It sits between your consent management platform (CMP) and Google tags, passing the user’s consent choices as signals to Google’s scripts. The tags then adjust their data collection in line with those signals, minimising the risk of tracking before consent and helping you avoid accidental breaches.
There are two main ways to implement Consent Mode. Basic Consent Mode is binary: each consent type (ad_storage, analytics_storage, etc.) is either granted or denied. No data is sent to Google for denied types—requests are held back entirely until the user consents. Advanced Consent Mode is more granular. Instead of blocking tags outright, it sends anonymised, cookieless “pings” to Google services even before consent, with limited information and no identifiers. This aims to recover some measurement data while still respecting the absence of consent for full tracking.
UK GDPR and PECR both require explicit, informed consent before setting most tracking cookies or collecting analytics that can identify users. Analytics cookies are not exempt in the UK. Consent Mode helps ensure that Google tags do not drop cookies or access local storage before the user has made a choice, but it does not guarantee compliance. You remain responsible for configuring your CMP and Consent Mode correctly, and for keeping documentation in case of regulatory queries.
Most tag management systems and consent tools default to Basic Consent Mode. If you want Advanced mode, you must set it up specifically—usually by passing default consent states and enabling cookieless pings in your tag or GTM configuration. Check your tag firing and Google’s Consent Mode diagnostics in Tag Assistant or the browser console to confirm which mode is active and when data is sent.
What Data Is Sent Before Consent: Basic vs Advanced Compared
In Basic Consent Mode, all analytics and advertising tags are held back until the user takes action on your consent banner. No data—neither to Google Analytics, Google Ads, nor other integrated platforms—leaves the browser before the user accepts or rejects tracking. There are no network requests, no pings, and no data sent to Google or other vendors. This means you avoid any chance of transmitting data before consent, but measurement will have blind spots for users who never opt in.
Advanced Consent Mode changes this. Tags can load and send cookieless “pings” to Google even when explicit consent is missing. These pings do not include cookies, user identifiers, or persistent device IDs. Instead, the payload typically consists of:
- Timestamp of the page view or event
- Page URL and referrer
- Basic device and browser details (such as browser type, operating system, screen size)
No personal data as defined by UK GDPR—such as IP address (if anonymised), user IDs, or email hashes—travels in these pre-consent pings. However, some data still leaves the user’s device before they have made a choice. This includes environmental and contextual information that, on its own, is not considered personal data but could be subject to regulatory scrutiny if combined with other signals.
The exact fields sent can change as Google updates Consent Mode. Always check the latest documentation or use browser developer tools (Network tab) to inspect outgoing requests to collect endpoints before consent is granted. Look for payloads with no cookies or persistent identifiers—only basic context fields should appear.
Legal Exposure: UK GDPR and PECR Implications
PECR regulates the use of cookies and similar technologies on UK websites. It requires you to get valid consent before storing or accessing information on a user’s device, unless an exemption applies. UK GDPR governs the collection and processing of personal data, including identifiers like IP addresses and advertising IDs.
Consent Mode Basic blocks all analytics and advertising tags from firing until the user has actively given consent. No cookies are set, and no data is transmitted to Google or other vendors before consent. This approach meets a strict reading of PECR, as there is no “setting or accessing” any information—regulators, including the ICO, have consistently stated this is the minimum standard for non-essential cookies in the UK. Basic mode also minimises UK GDPR exposure, as there is no personal data processed pre-consent.
Consent Mode Advanced allows Google tags to send “cookieless pings” before consent. These pings do not set or read cookies, but may transmit non-personal event data, such as page views or conversions, using device and browser metadata. Some regulators—including the ICO—interpret any data transfer, even without cookies, as “accessing information” under PECR. Advanced mode can therefore attract scrutiny, especially if device or network information could be linked to an individual under UK GDPR.
The ICO has not explicitly endorsed Advanced mode. It is not possible to point to regulatory guidance confirming that cookieless pings are compliant. Your legal risk profile depends on your organisation’s risk appetite and your DPO’s advice. If you are considering Advanced mode, document your implementation choices, your legal rationale, and your assessment of what is sent before consent. Retain evidence of your configuration and any DPO or legal advice, in case of audit or complaint.
Data Recovery and Measurement Impact: What You Actually Gain
Basic mode blocks all analytics and advertising cookies until the user gives consent. If a user declines, no hits are sent to Google Analytics or Google Ads for that session. The result is a clear gap: you lose all data for non-consenting users, including pageviews, transactions, and conversions. Funnel steps and attribution for these users disappear from your reports. This loss is absolute—there is no post-hoc recovery or modelling for missing data in Basic mode.
Advanced mode takes a different approach. When a user declines consent, Google sends cookieless pings—“behavioural signals” stripped of identifiers but still containing event data such as pageviews, conversions, and some device/browser metadata. Google then uses these signals to model the likely behaviour of users who did not consent, filling some gaps in your reporting. You’ll see more complete funnel and conversion data compared to Basic mode, especially in attribution reports and conversion paths.
The actual amount of recovered data depends on your consent rate and the makeup of your traffic. If most users consent, the difference between modes is small. If you have a high proportion of users declining consent, Advanced mode’s modelling can restore a measurable share of otherwise lost conversions and sessions. You can check the “Consent Mode” section in Google Analytics 4 (under Admin > Data Collection > Consent Mode) to see estimates of recovered conversions, but Google does not provide user-level recovery details.
Neither mode restores 100% of lost data. Advanced mode’s modelling is proprietary: you cannot audit or inspect the logic, and Google does not disclose the exact recovery rates or which data points are reconstructed. You must weigh the benefit of partial data recovery against the lack of transparency and the legal considerations discussed earlier.
Implementation and Platform Support: What to Expect
Consent Mode Advanced always requires explicit configuration in your Consent Management Platform (CMP) and in your tag management setup. Basic mode works with the default Consent Mode signals, but Advanced mode needs your CMP and tag manager to pass granular consent states to Google tags, not just a yes/no value. If your CMP only supports Basic mode, you cannot trigger the Advanced data recovery features. Check your CMP’s documentation for “Google Consent Mode Advanced” or “granular consent” support—this is not guaranteed, even from major vendors.
Google Tag Manager (both web and server containers), gtag.js, and the Consent Mode API all support both Basic and Advanced modes. Syntax and implementation details differ: with GTM, you set up consent types and triggers in the UI; with gtag.js, you manage consent states in code, for example:
gtag('consent', 'update', {
'ad_storage': 'denied',
'analytics_storage': 'granted',
'functionality_storage': 'denied',
'security_storage': 'granted'
});
Advanced mode requires passing consent states for each storage type. If you only send a single value for ad_storage or analytics_storage, you are running Basic mode.
To confirm what’s actually sent, use the Consent Mode Debug View in Google Tag Manager. Also inspect browser network traffic for outgoing hits to Google tags before and after consent. Check that consent state changes match user choices and that no cookies or identifiers are set before consent, except as allowed.
Google sometimes changes Consent Mode behaviour, especially around what is sent before consent and how data recovery works. Monitor Google’s release notes and your CMP vendor’s updates. Retest after any major platform update or CMP integration change to ensure ongoing compliance and correct data collection.
Decision Criteria: How to Choose for Your Business
Choose Advanced mode only if you have a clear need to recover the additional attribution and conversion data it provides, and you fully understand the legal risk. Advanced sends pseudonymised signals before consent, unlike Basic, which blocks nearly all measurement tags until the user agrees. This means a higher volume of data flows to platforms such as Google Analytics and Google Ads while the user is still unconsented. Under UK GDPR and PECR, this increases your compliance burden and potential exposure to enforcement, especially if your consent rates are low or your regulator is known for active enforcement.
Assess your actual consent rates using your consent management platform (CMP) logs. If your acceptance rate is above 90%, the incremental data gain from Advanced may be marginal. If you see lower rates, Advanced can materially increase your observable conversions and improve attribution models, but at the cost of more data being processed before consent. This trade-off is most acute for sites with high traffic and substantial media spend, where incomplete data can distort media efficiency analyses.
Factor in your internal risk appetite. If your organisation has a low tolerance for regulatory or reputational risk, Basic mode aligns better with a strict interpretation of UK law. If you are considering Advanced, involve your DPO or legal counsel. They should review the technical behaviour of your implementation and help document your rationale for the chosen mode. For audit readiness, record your decision process, the legal advice received, and any configuration changes in a central compliance log. If you later change modes, document when and why you did so.
Frequently asked questions
Does Consent Mode Advanced make my site UK GDPR compliant?
No. Consent Mode Advanced helps reduce data loss, but does not guarantee compliance. Regulators may still object to any pre-consent data transfer. Always seek legal advice.
What specific data is sent in Advanced mode before consent?
Typically includes page URL, timestamp, referrer, and device/browser info, but never cookies or user identifiers. Always check Google’s latest documentation for parameter details.
Can I use Advanced mode with any CMP?
Not all CMPs support Advanced mode. Check your CMP’s documentation and verify integration with Google Consent Mode.
Will Advanced mode recover all my lost analytics data?
No. It enables modelling to estimate some lost conversions and events, but does not fully restore all data. Modelling is not transparent and is managed by Google.
Not sure your tracking is telling you the truth?
Propulse Agency audits e-commerce tracking setups — server-side tagging, Meta CAPI, GA4 and consent — and fixes what is quietly costing you conversions.
Audit Your Consent Flow and Data Needs First
Review your existing consent banner and tag firing logic before changing any tracking settings. If your current setup allows tags to fire before consent, you may already be exposed under UK GDPR and PECR, even on basic mode. Map which data points are triggered pre-consent—especially identifiers, analytics events, and marketing pixels.
Decide which risk you’re actually willing to carry: higher data capture with advanced mode, or stricter compliance with basic. If you’re not sure how your CMP and tag manager interact, test thoroughly in a staging environment. Many UK e-commerce sites misconfigure consent mode by assuming their CMP blocks all tracking, when in fact some tags or scripts leak data before consent is logged. Check this before rollout, not after.
Reviewed and updated by fodil on Jul 29, 2026.
