With rising concern about privacy intrusions by big tech companies like Google and Meta, regulations such as the GDPR, CCPA, etc. have become both more common and influential. 
 
It’s of course a step in the right direction as far as protecting individuals’ privacy, but it does also signal the need to adapt — both for those huge companies that essentially run the internet, and for the digital marketers who have to advertise through their systems. 
 
To that end, Google transitioned from Universal Analytics to GA4 so that they’re compliant with these newer regulations. Today, we’re going to take a look at GA4’s consent handling, including the mechanisms behind it, what it means for you, and features like consent mode. 
 
Let’s check that out: 

The privacy landscape and increasing importance of online consent 

The main driver behind this is a (rightful) increasing public concern over huge tech companies’ — particularly Google and Meta — encroachment into individuals’ lives as they were gaining increasingly intrusive access to peoples’ data. 

GDPR, from the European Union, is one of the cornerstone regulations in that regard — implemented in 2018, it requires an explicit opt-in from individual users to provide much of the data that would previously be tracked by default. 

Under EU law, any organization that processes personal data of EU residents must comply with GDPR regulations; this means any website serving in the EU is subject to said regulations which, in practice, means pretty much all websites you’ll come across in North America. 

What this looks like is an option on these sites that gives EU users the chance to opt in, providing consent for cookies to track their behavior on that given site. 

Some US states have similar laws. 

For example, California has the CCPA, Colorado the CPA — although critically, these laws use “opt-out” mechanisms instead of the GDPR’s opt-in version, meaning the default can be for users to be tracked by cookies unless they opt out, but the option must be provided for them to do so. 

Why consent compliance is critical 

There are two components to this: legal risk, and brand trust. 

Basically — and probably most compelling — to start, consent compliance is so important because you legally have to. GDPR non-compliance can result in significant legal penalties that are way worse than any “advantage” you get by tracking people in the EU without their consent. 

Beyond that, though, is simply being a brand that people feel is trustworthy — it’s not good to be a villain just from an ethical standpoint but, even if you for some reason don’t care about that, it’s not good to be a villain from a business standpoint either. If your organization goes out of its way to break compliance laws — and break laws that are specifically in place for consumer protection — it doesn’t exactly endear people to you and make them want to interact with or buy from your business. 

There are countless examples of brands losing out on loads of business when they decide to engage in dubious, shortsighted behavior to make a quick buck, and in doing so lose the public’s trust. Don’t be like that. 

What does GA4’s requirement to respect consent state? 

With Google rolling out GA4 to be compliant with state data privacy regulations, it will adjust data collection based on user consent preferences, in turn communicated through consent mode if a user declines cookies. 

If consent for cookies is denied, cookieless pings are sent to GA4, which helps the system model data. 

Having GA4 enhanced measurement and user-provided data collation — AKA first-party data as opposed to third party cookies — correctly configured will allow the system to more accurately model data trends you can expect were present in the sessions where users didn’t allow tracking. 

GA4’s consent architecture and mechanisms 

The structure for this is based on Google’s consent mode. 

This adjusts tag firing behavior depending on user consent, ensuring no data is gathered that violates any privacy regulations and that everything is compliant with national, international, state, or regional privacy laws requiring explicitly-given consent. 

The best practice for a business is to implement this in GA4, especially if your site serves in regulated regions like the EU or in American states with consent laws. Once implemented, GA4 will use modeling from patterns established by those who have consented to data gathering to “fill in the gaps” and give you the best estimated projections for behavior for the macro users who have opted out — meanwhile, when cookies are denied, consent mode will collect anonymous aggregated event data for this modeling, also known as cookieless pings. 

Implementation best practices (and pitfalls) for integrating with a consent management platform 

Also known as a CMP, this manages how your website collects, stores, and communicates user consent preferences regarding cookies and tracking. 

When you integrate your CMP with Google Tag Manager and GA4 — this is implemented via a script on your site — it ensures consent signals are properly sent to Google’s consent mode. In turn, this allows your tags to behave according to relevant privacy regulations and user choices. 

There are a handful of Google-certified CMPs — OneTrust, Cookiebot, Usercentrics, Didomi, and Quantcast Choice, for example — that make integrating easy because they natively support Google consent mode. This just makes implementation smoother and simpler. 

The bottom line is that, when properly implemented, a CMP helps easily configure consent mode, allows user consent preferences to easily flow into GA4, protects your brand from legal action by ensuring compliance, and improves GA4 consent mode-based data modeling. 

How this impacts your strategy — and presents opportunities for marketing 

The main principle here is re-balancing privacy and data insight so the latter doesn’t totally overrun the former. 

In doing so, you should expect to see reduced granularity for your data, with more reliance on modeling. 

Assuming correct consent mode implementation on your site, non-consenting users don’t provide data — that’s where GA4 modeling kicks in. Obviously this can’t provide the same specificity of data gathering, but it still improves insights from what you’d have otherwise while remaining compliant. 

Leveraging first-party tracking 

One thing you can do is, in the absence of third-party cookies, set up GA4 tags through Google Tag Manager so they fire directly from your own domain. You can also enable enhanced conversions — more on those here — by linking GA4 with your CRM to tie web data to leads or sales. 

After turning on consent mode and using a consent management tool so tracking only runs when users agree to it, consider other factors for to ensure reliable data — for example, server-side tagging, which moves tracking to your own server instead of the browser, gives you better control and helps ensure the insights you’re receiving are dependable. 

Be sure to regularly test your setup in Google’s Tag Assistant tool to make sure your first-party data is being collected correctly and is staying compliant. 

Key takeaways 

The main point of this all is how GA4 is an adaptation to approach this evolving ecosystem — one that’s shifting away from third-party, non-consensual tracking, towards gathering data via a combination of those who opt-in to share it, plus modelling further macro projections for those who don’t. 

Properly setting up your system will help you both comply with stateside, European, and other international regulations while also ensuring you’re simultaneously getting the best insights. 

And once you have that all established and ready to go, remember: Continuous monitoring of your systems through a CMP will streamline consent management and, at the same time, ensure constant compliance so that you’re always good to go.