Consent mode and the hole in your data
In the UK and EU, storing or reading non-essential cookies requires consent first — in the UK that obligation comes from PECR rather than from UK GDPR, which is why "we have a legitimate interest" is not an answer. Correctly implemented, analytics tags do not fire until someone agrees. The consequence is arithmetic: if 60% of visitors decline, you directly observe 40% of your traffic.
Google's consent mode fills part of that gap with modelling. This is legitimate and useful. It is also frequently misunderstood in a way that leads to confident statements about numbers that were estimated.
What actually happens
Without consent mode, a declined visitor sends nothing. They are simply absent from your data.
With basic consent mode, tags do not fire at all until consent. Same absence, but the consent state is respected in a way regulators are happier with.
With advanced consent mode, tags load and send cookieless pings — no identifiers — which lets Google model the missing conversions and behaviour from the observed portion.
Modelled data is estimated data. It is a good estimate, it is clearly better than a hole, and it is not a measurement.
Where it bites
Small sites. Modelling requires volume. Below Google's thresholds, no modelling happens and the hole stays a hole.
Comparisons across a consent change. Deploy a banner, or change its design, and the observed share moves. Traffic appears to fall off a cliff on the day of a deploy that changed nothing about traffic.
Cross-system reconciliation. Ads and GA4 handle consent differently, so the ratio between them shifts when consent rates shift.
What to do about it
Record your consent rate as a metric. It is as important as any traffic number, because it is the denominator under all of them. A consent rate that changes explains a great many mysteries.
Annotate the change. Any banner change is an annotation in every report, forever. Without it, someone will diagnose an SEO problem that was a UX change.
Prefer ratios over absolutes. Conversion rate is far more robust to a consent hole than conversion count, because both numerator and denominator shrink together.
Do not fix it by not asking. Firing analytics before consent is the one solution that is both effective and illegal.
Not legal advice
This is a measurement piece, not a compliance one. Consent requirements vary by jurisdiction and by what you are actually doing with the data, and the person to ask is a data protection adviser rather than an analytics one.
The honest framing for a client
"We can see roughly this share of visitors directly; the rest is estimated. Trends are reliable, absolute totals are approximate, and here is our consent rate over time." That is a defensible position. "Traffic is down 40%" when the banner changed last month is not.