Cookie Consent: What Your GA4 Analytics Stops Measuring
Last month you added a cookie banner to the site — legal advice, or just caution. This month you open the GA4 report and visitor numbers are down. The campaign hasn't changed, the product hasn't changed, the ad budget is the same. But the number shrank.
The site didn't get smaller — the measurement did. Everyone who clicks "Decline" stops existing for GA4, because recognising a visitor depends on a cookie. That's not a bug, it's how the system is built. Below is what actually goes missing, how Google tries to fill it back in, and what to do about it.
Why the cookie banner is there at all
GA4 recognises "the same person" through a small file it writes to your browser — the _ga cookie. Asking permission before writing it is a requirement of EU data law, but the issue isn't only legal: browsers like Safari and Firefox already restrict third-party cookies by default, banner or no banner, on their own schedule.
Who this is mandatory for, who it's just prudent for
For a small business selling only inside Azerbaijan, this is often not a legal requirement at all. But for a hotel taking bookings, an online store shipping abroad, or any site that cares about European traffic, it's different — one visitor from there is enough to make the banner necessary. The banner itself isn't the problem; the problem is that most people install it without knowing what measurement stops working the moment it does.
What actually happens in GA4 when someone clicks "Decline"
When a visitor denies consent, GA4 doesn't go silent — it speaks differently. According to Google's own documentation, even without a cookie, a minimal signal carrying no personal identifiers — a "cookieless ping" — is still sent to Google.
What that signal carries, and what it doesn't
The signal reports an event, not an identity — which page, roughly when, what kind of device. Tracking a specific visitor, recognising a returning one, adding them to a remarketing list — none of that is possible, because no identifier is stored at all.
What modeling can fill in, and what it can't
Per Google's explanation of consent mode, "if you are using Google Analytics, Google fills the data collection gaps with conversion modeling and behavioral modeling." So the total for visitors who declined doesn't vanish entirely — a statistical estimate replaces it. But that estimate is aggregate: it doesn't hand you a row that says "May 3rd, mobile, 40 visitors from Baku," it hands you a general correction along the lines of "at this traffic volume, expect roughly this many additional conversions." On a small site with modest traffic, that correction loses its own usefulness — Google doesn't publish an exact minimum threshold for when modeling kicks in, but the logic is simple: you can't build a reliable average out of too few events.
Saying "the number dropped" actually means "the part we can see dropped" — that sentence belongs in the report, not just in your head.
Cookieless analytics: the route where no banner is needed
One alternative is to skip cookies entirely. Per Cloudflare's own description, their Web Analytics product "does not use any client-side state, such as cookies or localStorage, to collect usage metrics." The result: no consent banner is needed, because there's nothing to ask permission for — no personal profile, no recognising a returning visitor. This site runs exactly that way: the report arrives without cookies, and the banner never appears at all.
What you give up in exchange is real, too: user-level funnels, a multi-step purchase path, the "this person was here three months ago and came back" kind of recognition. A cookieless tool tells you how many people arrived and on which page; GA4's consent mode is trying to answer the closer, harder question of who, by which path, and where they dropped off — even if only approximately.
Running both together
This isn't an either-or choice. Track overall traffic volume and speed impact with the cookieless tool — that number is always complete, because it never depends on anyone's consent. Keep the conversion funnel, campaign source and purchase path in GA4, but keep the consent rate in view alongside it. The two numbers won't match, and they shouldn't — they're measuring different questions.
How to write an honest report
When you hand over a report, separate three things: the measured number, the modeled addition, and the total from the cookieless tool. Instead of "traffic dropped 12%," the sentence "the GA4 number dropped 12%; the cookieless tool shows real visitor count unchanged — the gap sits in the consent rate" gives the same data without pointing whoever makes the decision in the wrong direction. Taking a number from one source and presenting it as-is is convenient, but if a budget decision rests on that number, not saying which part was measured and which was estimated is a way of misleading yourself first.
Three things worth checking this week
- Is consent mode actually wired up, or is the banner just a visual element? On some sites the banner shows but clicking "Decline" changes nothing technically — the cookie still gets written. That's worse legally, and it artificially "fixes" the number technically. Check your browser's developer panel (
Application → Cookies) to see whether_gagenuinely disappears after declining. - Is a cookieless tool already running? If not, you'll never see part of the measurement — neither the real number nor the modeled one. This is the cheapest, fastest fix, since setting it up takes well under a day.
Setting this up correctly once is cheaper than re-explaining the number every month. In our GA4 integration service, we set up consent mode, the cookieless layer and a combined reporting view in one pass — so the same question doesn't come up again next month.
