GA4 and privacy: Consent Mode explained honestly

Every tracking mechanism built across parts 1 through 16 depends on a real, honest assumption: that GA4 is allowed to run at all. In regions covered by GDPR, and increasingly elsewhere, that permission is real user consent, not a default — this part covers what actually happens when it's declined.

The real default: consent isn't assumed

Before consent is given or declined: GA4 tags do not fire at all in
  regions requiring explicit consent

This is a genuine legal requirement, not a GA4 configuration nicety — a visitor's default state, before any interaction with a cookie banner, must be "not tracked," with tracking only beginning after genuine, informed consent is actually given.

What Consent Mode v2 actually does

consent('default', {
  analytics_storage: 'denied',
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied'
})

// after the visitor accepts the cookie banner:
consent('update', {
  analytics_storage: 'granted',
  ad_storage: 'granted',
  ad_user_data: 'granted',
  ad_personalization: 'granted'
})

Consent Mode is Google's own real signaling mechanism, not a full replacement for a genuine cookie-consent banner — it tells GA4 (and Google Ads, and any other linked Google tag) the actual current consent state, and GA4's own tags respect that state directly rather than firing unconditionally regardless of what a visitor chose.

What happens to a "denied" visit: not zero data, modeled data

Visitor declines analytics_storage: no cookie is set, no real
  individual visit is tracked — but GA4 still records an anonymous,
  cookieless "ping" and uses conversion modeling, trained on the
  real, consented traffic from similar visitors, to estimate the
  aggregate scale of consent-declined behavior

This is a genuinely important, easy-to-miss distinction: declining consent doesn't simply produce a gap of literal zero data in GA4's reports. Instead, GA4's own modeling — trained on real patterns from visitors who did consent — estimates the aggregate behavior of the ones who didn't, filling the reported totals with a statistically reasonable estimate rather than leaving a visible hole. The individual, cookie-based tracking genuinely doesn't happen; the aggregate reported numbers are still adjusted to account for it.

Why this matters for reading Bright Leaf Coffee's real numbers honestly

Reported conversions: 890 (part 12's funnel total)
Of which, modeled (consent-declined) rather than directly measured:
  an unknown, variable share depending on real regional consent
  rates and traffic mix

Every number pulled from GA4 throughout this entire series — the funnel in part 12, the audience sizes in part 11, the attribution splits in part 13 — carries this same real caveat in regions with meaningful consent-decline rates: some portion is modeled, not directly observed. This isn't a flaw to distrust the platform over; it's simply the honest, current state of analytics under real privacy regulation, worth knowing rather than assuming every reported number is a literal, individually-tracked count.

The real technical requirement: Consent Mode must load before GA4's own tag

Correct order: consent('default', {...}) fires first, then gtag.js
  or GTM loads afterward, so GA4's tag already knows the real consent
  state the moment it initializes
Incorrect order: GA4's tag loads and potentially fires before the
  default consent state is ever set

This is a real, load-order-sensitive requirement — part 4's tag installation guidance needs a genuine amendment here: the default consent state must be established before GA4's own tag has any chance to fire, or a brief real window opens where tracking could fire without a defined consent state at all.

A note on implementing this pattern with a real cookie banner

Any real cookie-consent banner wired up to Consent Mode should implement exactly this default-denied-then-granted-on-accept pattern — the banner itself only needs to call gtag('consent', 'update', {...}) with the visitor's real choice at the moment they make it; GA4's own tag handles the rest.

Next: building real dashboards in Looker Studio, connecting directly to the GA4 data built out across this entire series.