GA4 consent mode, server-side tagging and honest measurement

You can still measure marketing performance in a consent-first world — just not the way anyone did in 2019. GA4's consent mode, server-side tagging and modelled conversions let you keep a useful picture of what is working while honouring what visitors have told you about their privacy. The discipline lies in being honest about which numbers are observed, which are modelled, and which are simply gone.

Why does consent change what GA4 can measure?

Most Canadian organisations now sit under at least one consent regime. PIPEDA expects meaningful consent for collection that a reasonable person would not obviously anticipate. Quebec's Law 25 goes further: technologies that identify, locate or profile a person need clear disclosure, and cookie-based analytics sits squarely in that conversation. Sell into Europe and GDPR applies to those visitors too. The practical result is a consent banner, and a meaningful share of visitors who decline.

When a visitor declines, GA4 loses its persistent identifiers. Without a cookie there is no stitched session, no returning-user flag, no multi-touch attribution path and no remarketing list entry. The visitor still exists — they still read your pages and may still buy — but your analytics property records them faintly or not at all. The gap between what happened and what GA4 reports grows with every declined banner, and pretending the gap is not there leads to worse decisions than acknowledging it.

What does consent mode actually do?

Consent mode is the mechanism that carries a visitor's choice from your consent banner to Google's tags. When consent is granted, tags behave normally. When it is denied, the behaviour depends on which flavour you deploy.

• Basic consent mode holds Google tags back entirely until consent is granted. Declined visitors send nothing. It is the most conservative reading of Canadian and European law, and the easiest to defend.
• Advanced consent mode lets tags fire without cookies, sending anonymous, cookieless pings that carry no persistent identifier. Google uses these pings to model conversions and behaviour. It preserves more signal, but whether cookieless pings are acceptable to send from declined visitors is a legal judgement, not a tag setting — make it with counsel, in writing.

The current version of consent mode (v2 at the time of writing) also carries separate signals for ad user data and ad personalisation, which Google requires for its advertising features in the regions its consent policies cover. If your banner does not pass these signals correctly, audience and conversion features quietly degrade — a common and avoidable configuration fault.

Is server-side tagging a way around consent rules?

No, and it matters that your team understands why. Server-side Google Tag Manager moves tag processing from the visitor's browser into a server container you control, usually on your own subdomain. That brings genuine benefits: fewer third-party scripts on the page, a lighter page for the visitor to load, more resilience against browser tracking prevention, and — most importantly — a single checkpoint where you decide exactly which fields are forwarded to which vendor. You can strip IP addresses, drop query parameters that carry personal details, and keep raw data inside infrastructure you govern.

What it does not do is change the law. PIPEDA and Law 25 regulate the collection and the purpose, not the transport. Tracking a declined visitor through a first-party server endpoint is still tracking a declined visitor — arguably worse, because it is harder for the person to detect and block. Treat server-side tagging as data-governance infrastructure that makes honouring consent easier and cleaner, and design it alongside your security and compliance posture rather than as a workaround to it.

How honest is GA4's modelled data?

GA4 fills consent gaps in two main ways. Behavioural modelling estimates the sessions and users you could not observe, based on the patterns of consented visitors who look similar. Conversion modelling estimates conversions that could not be tied to an ad interaction directly. Both draw on the cookieless pings that advanced consent mode provides; run basic consent mode and there is less raw material, so less modelling.

Modelling is legitimate statistics, but it deserves honest handling. The estimates are built from people who accepted tracking, and the people who declined may differ from them in ways the model cannot see. How large that difference is on your site is, by definition, unobserved. GA4's standard reports blend modelled and observed data without always flagging the seam, so a number that looks observed may be partly inferred.

Three working rules keep you honest. First, treat modelled figures as directional: good for comparing channels and spotting trends, weak as precise totals. Second, never quote a modelled number to a decimal place in a report — false precision is a quiet form of misleading. Third, note in your dashboard which figures include modelling, so nobody downstream mistakes an estimate for a count.

What can you still know when visitors decline?

More than the doomsayers suggest. Aggregate trends remain trustworthy: if your consent rate is reasonably stable, the direction of traffic, the relative performance of pages and the ranking of channels among consented users usually generalise well. And your most valuable measures never depended on cookies at all. A quote request lands in your CRM whether or not the requester accepted analytics. Revenue lands in your accounting system. Consented email engagement is observed, not modelled.

Simple arithmetic on those first-party records is often more decision-worthy than anything in an analytics interface. Blended cost per lead is just total spend divided by leads recorded in your CRM for the period — no cookies involved. Comparing periods before and after a campaign, or between regions where you did and did not advertise, gives you incrementality evidence that no consent banner can erode.

How should you report so nobody is misled?

Reporting is where measurement honesty either survives or dies. A few habits protect it. Separate observed from modelled figures visually, or at minimum footnote them. Report ranges and direction where the underlying data is estimated, and reserve exact figures for first-party counts. Keep a measurement changelog: the day you changed the banner, switched consent mode flavours or moved a tag server-side, your baselines shifted, and future readers of the chart deserve to know why.

A number you cannot explain to your own board — or to a regulator — is not an asset. It is a liability with a chart attached.

Finally, make sure your privacy policy, your banner and your tags tell one consistent story. Law 25 expects transparency about profiling and, for many projects, a privacy impact assessment; PIPEDA expects consent that matches what actually happens. An analytics setup your own documentation cannot describe accurately is a finding waiting to be written up.

How OlDevs helps you measure with a clear conscience

OlDevs has built and measured digital products from Vancouver since 2014, and our performance marketing practice treats measurement as engineering, not decoration. Through our Analytics & CRO discipline we design consent-aware GA4 and server-side tagging setups, wire reporting to the first-party records that actually run your business, and document every modelled figure so your team — and your counsel — can stand behind the numbers. One accountable team does the work, you see a working demo every week, and you own all code, designs, accounts and IP. We serve clients across Canada remotely, with video calls in your time zone and on-site visits when the work calls for it.

If your reporting has felt less trustworthy since the consent banner went up, let's fix that properly. Request a quote and we will reply within one business day.