Consent Mode v2: What It Breaks in Your Conversion Data (and How to Fix It)

“Our ad conversions have dropped, but sales haven’t changed.”

That’s the sentence we hear most often after a cookie consent banner goes live. The chart in the ads dashboard goes down while the figures in accounting stay the same. When the two don’t match, the question becomes: which one is right?

Both are. They just aren’t measuring the same thing.

What’s missing from the dashboard isn’t sales, it’s the visibility of sales. When a user rejects cookies, the purchase still goes ahead; only the trail linking that purchase to your ad account disappears. The measurement system goes blind, and you mistake that blindness for a drop in performance.

At this point most articles take you straight to a setup step: add this tag, tick that box. But the setup isn’t the real issue. The real issue is mistaking two separate problems for one.

On one side there is compliance — what KVKK (Turkey’s data protection law, comparable to GDPR) requires for cookies. On the other side there is measurement — how much of your ad data you lose when consent is declined. The two appear at the same time, but they are not the same thing, and they are not solved with the same tool.

There is also a misconception specific to Turkey. In its own documentation, Google defines the Consent Mode v2 requirement for users in the European Economic Area (EEA) ; it states that from March 2024 the consent fields must be “GRANTED” for Customer Match lists to be usable in the EEA (Google Ads Help). Turkey is not an EEA member. In other words, Google isn’t forcing you.

That doesn’t mean “there’s no need”. Because:

Even if Google doesn’t force it, KVKK does. And even without KVKK, your measurement would already have been broken.

In this guide we will clarify:

• What Consent Mode actually does, and what it doesn’t
• The difference between basic and advanced mode, and what that difference costs you in data
• What KVKK requires for cookies, and which cookies are exempt
• The exact five points where conversion tracking breaks
• How to set it up step by step, and how to validate the result
• When server-side tracking is necessary, and when it is overkill
• An actionable 30-day setup plan

Our aim isn’t to recommend a plugin and move on. The aim is for you to build a measurement infrastructure you can still make decisions with after the consent banner.

Brandaft is an Istanbul-based, data-driven digital marketing agency. We set up measurement before we manage ads, because you can’t manage a budget you can’t measure. Now let’s look at what cookie consent actually costs you.

Why Did Cookies Disappear? (And What Actually Went Missing?)

The common story goes like this: browsers blocked third-party cookies and measurement was over. That story is incomplete.

What really breaks measurement isn’t the browser, it’s the consent banner. The moment a user clicks “reject”, advertising and analytics cookies can no longer be set, even on your own site. Browser restrictions add to this, but consent is the trigger.

It is important to name what has been lost correctly. What is lost is:

• Not the visitor, but the visitor’s recognisability
• Not the sale, but the sale’s attribution to a source
• Not the traffic, but the traffic’s continuity memory

So data loss isn’t a volume problem; it’s a connection problem. If you see 60 conversions in Google Ads instead of 100, 40 sales haven’t evaporated; the link between those 40 sales and your ads has been broken.

This distinction changes a lot in practice. If you think it’s volume loss, you cut the budget. If you know it’s connection loss, you fix the measurement. The first path lowers revenue; the second corrects the decision.

We previously covered how ad metrics relate to each other, and when each one is meaningful, in our post How to Measure Ad Performance ; the break described here affects all of those metrics at once.

What Is Consent Mode v2? (And What Isn’t It?)

Consent Mode is a signalling layer that lets Google tags change their behaviour based on the user’s consent status. In Google’s own words, it lets developers control advertising and analytics data collection according to user consent (Google Tag Platform documentation).

Version 2 uses four consent parameters:

Parameter	What it controls
ad_storage	Cookies and storage for advertising
analytics_storage	Cookies and storage for analytics
ad_user_data	Sending advertising-related user data to Google
ad_personalization	Personalised advertising

Each takes only two values: granted or denied.

Now let’s make the critical distinction.

Consent Mode is not a consent banner. You set up the consent banner (the banner or CMP); Consent Mode only carries the decision made on that banner to Google tags. Confusing the two means making a mistake at the most commonly skipped point of the setup: a banner, but no signal.

Nor is Consent Mode a compliance certificate. Having it set up doesn’t mean you comply with KVKK or GDPR. Compliance is about which cookie you set and when; Consent Mode is about passing that decision on to Google.

In one sentence:

The consent banner makes the decision. Consent Mode carries it.

The difference between basic and advanced mode

A setup done without understanding this difference often produces the opposite of what was intended.

Basic mode: Tags are fully blocked until the user interacts with the consent banner. In the words of Google’s documentation, no data is sent before the user consents — not even the default consent status.

Advanced mode: Tags load with the default set to denied . Even when a user declines, Google receives cookieless measurement signals ; consent status and measurement are transmitted without cookies.

The result of this difference shows up in modelling quality. In basic mode, Google uses a general model derived from aggregate behaviour patterns. In advanced mode, because first measurement signals are collected, an advertiser-specific model can be built and the modelling is more detailed (Consent Mode concepts).

In other words:

Basic mode is more protective and gives you less data. Advanced mode gives you more data, but it requires more disclosure.

Let’s put the two modes side by side:

	Basic mode	Advanced mode
Tag loading	Blocked until user interaction	Loads with default denied status
Data before consent	Nothing is sent	Cookieless signal is sent
What reaches Google on decline	Nothing	Consent status + cookieless measurement
Modelling	General model based on aggregate patterns	Advertiser-specific, more detailed model
Data quality	Low	Relatively high
Disclosure burden	Lower	Higher

Which one is right isn’t a technical question; it’s a question of legal and organisational preference . Because in advanced mode a cookieless signal reaches Google even when the user declines, you need to explain this clearly in your privacy notice and cookie policy. The decision should be made together with your legal team.

What exactly happens when consent is denied?

ad_storage set to denied means no new advertising cookies are set. In addition, third-party cookies previously set on google.com and doubleclick.net are not used, except for spam and fraud prevention.

On top of this, if the ads_data_redaction setting is enabled, ad click identifiers are removed from network requests. This increases data loss but strengthens privacy. Again, it’s a trade-off decision, not a setting to quietly leave at its default.

KVKK and Cookies: What’s Mandatory in Turkey and What Isn’t

This section is for information only and is not legal advice. We recommend finalising your cookie configuration with a legal adviser.

The Turkish Personal Data Protection Authority’s Guidelines on Cookie Practicesdivide cookies into those that require explicit consent and those that don’t. Exemption depends on two criteria: the cookie’s sole purpose is to technically enable communication over an electronic communications network, or it is strictly necessary for a service the user has explicitly requested.

Typical exempt cookies: shopping basket, session-based authentication, security, load balancing and user-initiated interface preferences.

Those that are not exempt are:

• Advertising and marketing cookies
• Retargeting cookies
• Social media plugins that track users
• Analytics tools — including Google Analytics

The last item is the most widespread mistake in Turkey. Analytics is put in the strictly necessary category on the grounds that “everyone uses it anyway”. By the logic of the guidelines this is wrong: analytics services transfer data to a third party for commercial purposes and enable cross-site tracking, which takes them outside the exemption criteria.

There are also clear expectations for the consent banner itself:

• Opt-in by default. Non-essential categories must be off by default, and the user must switch them on. A pre-ticked box does not count as valid consent.
• Equal prominence. “Accept all” and “Reject all” must be presented with the same prominence.
• No cookie walls. Making access to the site conditional on accepting all cookies is not acceptable.
• Easy withdrawal. Withdrawing consent must be as easy as giving it.

The duty to inform also applies to exempt cookies and must be met in a separate, easily accessible cookie policy. For each cookie, the policy should list its name, purpose, first-party/third-party status and retention period.

There is also a topic that most setups never discuss: using cookies from services based abroad, such as Google and Meta, means transferring personal data outside Turkey, and this must be assessed separately under Article 9 of the Law.

In short: because Turkey is not in the EEA, Google does not impose Consent Mode on you. But KVKK already requires the consent banner and the behaviour behind it. Consent Mode is the most practical way to implement that behaviour technically — a tool, not an obligation.

Where Does Conversion Tracking Break? (5 Leak Points)

The breakages we see in the field almost always happen in the same five places.

1. A banner, but no signal. The consent banner is in place and the user makes a choice, but that choice is never passed to Google tags. The tags keep working as before. This is the worst scenario for both compliance and measurement: the legal risk remains and the data is wrong.

2. The default is defined incorrectly. The default consent state must be defined before the tags load. If it is defined afterwards, some of the first requests go out with the wrong state and produce inconsistent data.

3. Consent changes aren’t applied. When a user first declines and then accepts, the updated state must be passed to the tags. If this step is skipped, even users who accept remain unmeasured.

4. The conversion page sits behind consent. The conversion tag on the thank-you page never fires because the user never saw the banner. The sale happens; the record doesn’t.

5. Inconsistency between ad platforms. The Google side is configured with Consent Mode, while the Meta side is left as it is. The two dashboards show two different realities, and the budget decision changes depending on which one you look at.

The shared outcome of these five breakages is that measured cost looks higher than real cost. We explained in detail why acquisition cost inflates and which mistakes melt your budget in our post Why Is Your CPA Rising? ; measurement loss is the most insidious item on that list, because in the dashboard it looks like a drop in performance rather than an error.

How to Set Up Consent Mode v2 (GTM + GA4 + Google Ads)

The logic of the setup works in this order.

Step 1 — Build a cookie inventory. Which cookies are set on the site, which tool does each belong to, and what is its retention period? Categorising without an inventory is just guesswork. This inventory also forms the basis of your cookie policy.

Step 2 — Define the categories. Necessary, analytics, advertising, preferences. Don’t put analytics tools in the necessary category.

Step 3 — Set up the consent banner (CMP). Opt-in by default, accept and reject options with equal prominence, and permanent access to “cookie settings”.

Step 4 — Define the default consent state. In Google Tag Manager, so that it runs before all other tags. All four parameters must be defined; a missing parameter causes a silent error.

Step 5 — Connect the consent update. When the user makes a choice, the event triggered by the CMP must pass the updated consent state to the tags.

Step 6 — Link tags to consent settings. GA4, Google Ads conversion and remarketing tags must each be configured to respect the relevant consent parameter.

Step 7 — Choose the mode and document it. Basic or advanced? Make the decision, write down the reasoning and reflect it in your privacy notice. This step is organisational rather than technical, and it is usually skipped.

The order matters. No categories without an inventory, no banner without categories, no signal without a banner. Setups that start from the other end appear to work but produce inconsistent data.

Server-Side Tracking: When Do You Need It, and When Don’t You?

When Consent Mode comes up, server-side tagging usually follows straight away. Most of the time, it comes up too early.

Server-side tracking means tag requests pass through a server you control instead of the user’s browser. What it provides is data quality and control: you decide which data goes where, you are less affected by browser restrictions and page load is reduced.

What it doesn’t provide is this: it doesn’t remove the need for consent. Sending data from a server doesn’t mean you can process it without the user’s consent. This is the most common false assumption in the field.

When it’s genuinely needed:

• Your monthly traffic is high and you are above the modelling threshold
• You feed the same conversion data to more than one ad platform
• You need to combine measurement with your CRM or order system
• You want auditable control over data processing

When it’s unnecessary:

• Your monthly conversions are in double digits
• You advertise on a single platform
• Your current client-side setup is already faulty — fix that first

Server-side tracking is an upper floor. Building an upper floor while the ground floor isn’t solid only makes the error more expensive.

Platforms Beyond Google: Meta and Others

Consent Mode is a Google solution. Meta, LinkedIn, TikTok and other platforms don’t read this signal. Assuming you’re done once the Google side is set up leaves the least visible leak point wide open.

The result looks like this: in Google Ads, conversions are adjusted according to consent status, while in Meta a pixel keeps working with the old logic. The two dashboards show two different realities. The budget decision changes depending on which dashboard someone looked at that week.

The right approach is to build the consent decision as a platform-independent layer that works like this:

• Your consent banner produces a decision per category (advertising, analytics, preferences)
• On the Google side, this decision is translated into Consent Mode parameters
• The same decision is translated into a firing condition for the Meta pixel, LinkedIn Insight Tag and other tags
• No ad tag fires until the relevant category has been consented to

On the Meta side, the Conversions API, a server-side option, also comes into play. But the rule is the same as on the Google side: sending data from a server doesn’t remove the consent requirement. It only changes the transmission route.

Cross-platform inconsistency also undermines reading SEO and ad data together. We covered how to bring the two channels to the same decision table in our post Integrated Marketing: SEO and Meta Ads Synergy ; if the measurement layer is inconsistent, that integration is built on wrong data from the start.

How Reliable Is Modelled Conversion Data?

In advanced mode, Google estimates the conversions of users who haven’t consented by modelling them. The number you see in the dashboard includes this estimate.

Two things need to be separated here.

Modelling doesn’t fill in missing data. It produces a statistical estimate from observed behaviour patterns. The quality of the estimate depends on how much observable data you have — Google states that your tag must pass a certain data collection threshold for modelling to work, but does not publish the numerical value of that threshold.

The practical consequence: in small accounts, modelling either doesn’t kick in or produces volatile results. In high-volume accounts, it works reasonably well.

That’s why the right way to treat modelled data is:

As a directional signal, it is reliable. As an absolute number, it is not reliable.

So by looking at modelled conversions you can say “campaign A is better than campaign B”. But you can’t say “exactly 143 conversions came in and revenue was this much”. You need to manage the budget with this distinction in mind; we explained the goal-based budget model in our post How to Set a Google Ads Budget , and modelling uncertainty should be treated as a margin added on top of that model.

Post-Setup Validation

The job isn’t done when the setup is. Don’t call it “done” until you’ve seen it working. The validation order:

1. Pre-consent state. In the browser’s developer tools, check which cookies are set before interacting with the banner. If any non-essential cookie is set, the setup is faulty.
2. Decline scenario. Decline and watch how the tags behave. If you’re in advanced mode, a cookieless signal should be sent and no cookies should be set.
3. Accept scenario. Accept, then verify that the consent state is updated and the tags work normally.
4. Change-of-mind scenario. Decline first, then accept. Check that the updated state is passed on.
5. Conversion test. Complete a real conversion and confirm it appears in the dashboard.
6. Google Tag Manager preview mode. Check that the consent parameters pass through each tag with the expected values.

Don’t go live until all six steps pass. A half-finished setup is more misleading than no setup at all: data comes in, but it comes in wrong.

We laid out the diagnostic sequence, step by step, for when traffic arrives but sales don’t show up in our post Website Traffic but No Sales ; measurement validation is the first step of that diagnosis, because every analysis built on broken tracking is flawed from the start.

A 30-Day Measurement Infrastructure Plan

Days 1–7 — Diagnosis The cookie inventory is built. The current consent banner and tag structure are reviewed. Which conversions are measured on which platform is mapped. Baseline values are noted for estimating the current loss.

Days 8–14 — Decision and preparation Categories are defined. The basic-or-advanced decision is made with the legal team and put in writing. The cookie policy text is drafted. A CMP is chosen.

Days 15–21 — Setup The consent banner goes live. The default consent state and update mechanism are set up. Tags are linked to consent settings. The six validation steps are run in a test environment.

Days 22–30 — Validation and baseline Validation is repeated on the live site. Consent rate tracking begins. Conversion numbers before and after the setup are compared. The share of modelled data is noted and added to the reporting template.

What you should have at the end of day 30 isn’t perfect data. It is knowing how much you can’t see, and being able to keep that blind spot out of your decision-making.

6 Common Mistakes

1. Treating analytics as a necessary cookie. The most common and riskiest mistake. By the logic of the guidelines, analytics tools are not covered by the exemption.

2. Pre-ticked boxes. Consent given without user action doesn’t count as consent.

3. Hiding the “Reject” button. The accept button is prominent, the reject button grey and small. Equal prominence is expected; and the harder it is to reject, the more questionable the validity of the consent collected becomes.

4. Quietly switching on advanced mode. If you send cookieless signals, you must say so in your privacy notice. It isn’t a decision for the technical team to make alone.

5. Not validating after setup. It’s assumed to work because the tag was added. In a significant share of cases, one of the parameters goes through missing.

6. Mistaking lost data for a performance drop and cutting the budget. This is the most expensive mistake. The budget is cut in response to conversions that fell because measurement broke, real sales then fall too, and the decline is “proven”.

Conclusion: The Problem Isn’t Lost Data, It’s Lost Decisions

What you lose after cookie consent isn’t a few percent of conversion data. What you lose is the foundation of the decisions you make based on that data.

Consent Mode v2 doesn’t solve this on its own. It isn’t a box to tick by installing a plugin; it’s part of a system that starts with an inventory and ends with validation. And the output of that system should be not perfect data, but data with known limits — that’s the question to ask.

With data whose limits you know, you can make decisions. With data whose limits you don’t know, you only produce reports.

Consent Mode v2: Frequently Asked Questions

Is Consent Mode v2 mandatory in Turkey?

Google’s own documentation defines the requirement for users in the European Economic Area, and Turkey is not an EEA member. However, KVKK (Turkey’s data protection law) requires explicit consent for advertising and analytics cookies, much as GDPR does in Europe. Consent Mode is the practical way to implement that requirement technically; even without a Google mandate, the compliance need does not go away.

Should I choose basic or advanced mode?

This is a legal and organisational decision, not a technical one. Advanced mode provides more data because it sends cookieless signals even when a user declines; this must be clearly explained in your privacy notice. Basic mode is more protective and provides less data. Make the decision together with your legal adviser.

Can Google Analytics be classed as a strictly necessary cookie?

Not according to the logic of the KVKK Cookie Guidelines. Analytics tools transfer data to a third party for commercial purposes and enable cross-site tracking, which puts them outside the “strictly necessary” exemption. This is the most common mistake we see in Turkey.

Why did my conversions drop after I added a cookie banner?

Most likely your sales did not drop; your measurement went blind. When a user declines, the purchase still happens, but it cannot be linked back to the ad. The right response is not to cut the budget but to measure the size of the gap and take it out of your decision-making.

Can I trust modelled conversion data?

As a directional signal, yes; as an absolute number, no. Modelling produces estimates from observed patterns and only works once a certain data threshold is passed. It is volatile in small accounts and reasonable in high-volume ones.

If I switch to server-side tracking, do I still need consent?

Yes. Server-side tracking changes where the data is sent from, not the legal basis on which it is processed. The consent requirement stays exactly the same.

How long does a Consent Mode setup take?

The technical setup usually takes a few days. But once you include the cookie inventory, category decisions, policy text and validation, the realistic timeframe is 30 days. An unvalidated setup does not count as finished.

How do I know my setup is working?

Test six scenarios: cookie state before consent, decline, accept, change of mind, a real conversion test and a parameter check in Tag Manager preview. Do not go live until all six pass.

---

This content is for information only and does not constitute legal advice. We recommend reviewing your cookie configuration and privacy notices with a legal adviser.

Would you like us to pinpoint where your measurement infrastructure is breaking? We’ll review your current setup and map out the size of the loss and the order of repairs.