Denied Consent Isn't a Blackout
People assume that when a user rejects cookies, Google Ads just goes dark for that visitor. What actually happens is more nuanced, and it varies signal by signal. Consent Mode v2 sends four advertising-relevant consent states, and Google Ads reacts differently to each one. Knowing exactly what breaks, what degrades, and what keeps working under denied consent is the difference between a panicked "our conversions dropped" ticket and an accurate read of your data.
This guide assumes you already have Consent Mode v2 implemented. Still choosing an implementation style? Read Consent Mode v2: advanced vs basic first, and use the parameters reference to keep the four signals straight.
The Four Signals and What Each Governs
Google Ads cares about four Consent Mode signals. Two are "upstream" storage permissions and two are "downstream" data-use permissions:
- ad_storage: whether advertising cookies and device identifiers may be stored and read.
- analytics_storage: whether analytics cookies may be stored and read.
- ad_user_data: whether the user's data may be sent to Google for advertising purposes.
- ad_personalization: whether the user's data may be used for personalized advertising, meaning remarketing.
A user can grant some and deny others, so these outcomes stack. Let's take them one behavior at a time.
Remarketing: Gated by ad_personalization
Remarketing is the most binary of the outcomes. When ad_personalization is denied, Google won't add the visitor to your remarketing and Customer Match audiences. The moment a denied state is recorded, that user stops feeding your audience lists. There's no modeling backfill here: an audience you're not permitted to build simply doesn't grow.
The practical consequence: in high-refusal markets, remarketing pools shrink and audience-based campaigns lose reach. That's working as intended under the DMA and Google's EU User Consent Policy, not a bug to work around. The lever you do control is your consent rate, which is a banner-design problem rather than a tagging one.
Conversion Tracking: Gated by ad_storage
When ad_storage is denied, Google Ads can't read the advertising cookie it normally uses to tie a conversion back to a click. What it can still use is the click identifier passed in the landing-page URL, the gclid (or wbraid and gbraid on iOS). If a user clicks your ad and converts in the same session, that click-to-conversion link can still be observed through the URL parameter even without a stored cookie.
What you lose is the durable, cross-session attribution that cookies provide, and any conversion that depends on recognising a returning user. That gap is exactly what conversion modeling is designed to estimate.
Enhanced Conversions: Gated by ad_user_data
Enhanced conversions work by sending Google hashed first-party data, an email or phone number the user provided, to improve match rates. That transmission is governed by ad_user_data. When ad_user_data is denied, enhanced conversions are blocked entirely: no hashed data leaves the page. So a site leaning on enhanced conversions to shore up measurement in a cookie-restricted world still needs the user to grant ad_user_data for it to fire at all.
Conversion Modeling: The Backfill, and Its Threshold
For the conversions lost to denied ad_storage, Google uses conversion modeling to estimate what happened. It analyses the observable journeys of users who did consent, quantifies the relationship between consented and unconsented traffic, and applies that model to the cookieless pings from users who declined. This is why an advanced Consent Mode implementation matters: it sends those cookieless pings, giving the model raw material. A basic implementation that blocks tags entirely sends nothing to model from.
Modeling is not automatic at any volume. Per Google's documentation, your account and conversion action must clear two bars:
- Consent mode (or IAB TCF v2.0) is implemented correctly, and
- You have a daily ad click threshold of 700 ad clicks over a 7-day period, per country and domain grouping.
Below that threshold, modeled conversions won't appear, and smaller accounts in high-refusal EEA markets can find themselves under-counting with no backfill. There is no configuration switch to force it; the only fix is more consented volume.
Smart Bidding: It Reacts to Whatever You Report
Smart Bidding strategies like Target CPA and Target ROAS optimise against the conversions in your account, including modeled ones. So denied consent doesn't stop bidding, but it does change the data bidding sees. If modeling is active, bids optimise against observed plus modeled conversions, which is close to reality. If your volume is below the modeling threshold, bidding optimises against only your consented conversions, which understates true performance and can push bids down. This is the mechanism behind reports of Smart Bidding "pulling back" after Consent Mode enforcement in low-volume, high-refusal accounts.
What Changes on 15 June 2026
Google is consolidating how these controls interact. From 15 June 2026, Consent Mode becomes the single control governing whether Google Ads data is collected, with ad_storage acting as the authority. If you've been relying on Google Signals or split GA4 and Ads controls, this changes your architecture. We cover it in detail in GA4 and Google Ads split consent controls on 15 June 2026. The behaviors in this guide, remarketing and enhanced-conversion gating especially, are the reason getting the four signals right is now non-negotiable.
How to Verify, Not Assume
Don't trust that these signals are wired correctly, prove it. In your tag manager's preview, load a page, deny consent, and confirm that ad_storage, ad_user_data and ad_personalization all read denied before any Google tag fires. Then grant consent and confirm they flip to granted. Google Ads also surfaces a consent-mode diagnostics status in the account. For a full method, see how to debug Consent Mode v2, and to understand the reporting side, how Consent Mode v2 affects GA4 reporting.