DEV Community: Mehwish Malik

Google Signals vs Consent Mode in GA4: What Actually Changed on 15 June 2026

Mehwish Malik — Tue, 15 Sep 2026 06:45:39 +0000

If you own the GA4 or GTM stack for a UK or EEA site, one recent change deserves an hour of your attention.

What actually changed

Before 15 June 2026, turning off Google Signals also blocked ad data from reaching Google Ads. That behaviour is gone. Google Signals now only affects reporting inside GA4, such as cross-device users and demographic dimensions.

The single control for Google Ads data flow is now the ad_storage parameter inside Google Consent Mode v2. If it is set to granted, ad data reaches Google Ads regardless of the Google Signals toggle.

Consent Mode has four signals

You will need each one mapped correctly in your CMP:

ad_storage: advertising cookies
analytics_storage: analytics cookies
ad_user_data: sends user data to Google for ads
ad_personalization: personalised ad targeting

Missing or wrong defaults on any of these are the most common cause of silent tracking loss.

Behavioural modelling thresholds

GA4 fills gaps with modelled data when consent is denied. To activate this, your property needs at least 1,000 daily events with analytics_storage=denied for seven days and 1,000 daily users with analytics_storage=granted for seven of the last 28 days.

If your traffic is lower, modelling will not kick in and denied traffic will simply be missing.

Fix path

Set default consent to denied for all four parameters before any tag fires.
Update to granted only after the user accepts through the banner.
Test firing order with GA4 DebugView and Google Tag Assistant.
Confirm the GA4 to Google Ads link still reports conversions.

A tested Google-certified banner from Seers handles the four signal mapping without custom code. The full walk-through of both features is in the Seers guide on GA4 Consent Mode and Google Signals.

Picking a CMP in 2026: what actually matters at implementation time

Mehwish Malik — Fri, 04 Sep 2026 12:06:41 +0000

Every consent management platform claims GDPR coverage. The gaps show up during integration, not on the pricing page.

Three technical questions decide the fit.

1. How does it handle prior blocking?

Cookie auto-blocking should stop third-party scripts before consent, without you rewriting every tag. Cookiebot, Seers AI, and Cookiehub scan and block automatically. Others still require manual tagging inside GTM.

2. Does the mobile SDK actually exist?

Many CMPs sell "mobile support" that turns out to be a WebView wrapper. Native iOS and Android SDKs are different, and they decide whether App Store review passes or fails. Seers AI, Didomi, and Usercentrics ship native SDKs. OneTrust does too, but at enterprise pricing.

3. Which ad platforms speak your consent signals?

Google Consent Mode v2 is table stakes. If you spend on Meta or Amazon, check for Meta Consent Mode and Amazon Consent Signal support. Missing these breaks attribution and forces manual workarounds inside GTM.

Pricing traps to check before signing

Per-domain vs per-visitor: multi-site setups blow up under per-domain models.
Renewal terms: OneTrust customers report 20 to 40 percent annual increases.
Setup fees: enterprise CMPs often add $10,000 to $50,000 on implementation.

tiktok.com

Seers.AI prices by visitors, includes a free tier for small sites (100 visitors a month), and charges no setup fees. IAB TCF v2.3 certification and 28 languages come in the base product.

Quick integration checklist

Server-side tagging support if you run GTM server container
Consent logging with an audit trail for regulator requests
WCAG 2.1 accessibility on the banner itself
DSAR handling in the same dashboard, not a separate SKU

Full side by side of the seven main CMPs including Cookiebot, OneTrust, Didomi, Usercentrics, Osano, and iubenda: https://seers.ai/blogs/universal-consent-platform-comparison/

Your Tag Fires Green In Preview. Your Client's Conversions Are Still Down.

Mehwish Malik — Fri, 04 Sep 2026 11:00:34 +0000

You open Tag Manager preview. The tag fires. The trigger looks right. Everything is green. Then the client asks why conversions are down thirty percent. You have nothing to show them. On paper, nothing is broken.

This is a common gap in Consent Mode v2 setups. It will not show up in preview mode at all.

A fired tag does not mean Google actually used the data. Consent Mode v2 checks four separate signals before ad data counts as usable:

analytics_storage, controls whether analytics cookies can be used
ad_storage, controls whether advertising cookies can be used
ad_user_data, controls whether user data can be sent to Google for ads
ad_personalization, controls whether that data can be used to personalize ads

If any of these were denied, or never explicitly set, the tag fires fine. It just contributes nothing usable to remarketing or attribution.

The mistake that causes this most often

The consent update triggers on page load instead of the actual button click. That creates a race condition. The tracking pixel fires a split second before the CMP registers the real choice. Preview mode does not catch this, because it does not simulate that timing gap. Fix: trigger marketing tags off the consent update event specifically, never off page view.

What changed in June 2026

Before June 2026, a GA4 setting called Google Signals could still pull in some ad data, even with an incomplete consent setup. That workaround is gone now. ad_storage alone decides whether advertising data reaches Google Ads. If your dataLayer wiring is off, nothing catches that gap anymore.

Worth checking beyond the code

GDPR also requires reject to carry equal visual weight to accept. Not smaller text, not a duller color. Several EU fines were issued specifically over banner design, not just tracking behavior. Worth flagging to whoever owns the banner, even if it is outside your usual scope.

Once the signal is wired correctly, Google's modeling recovers a real share of what was lost. A median lift of around 17 percent in reported conversions has been cited once modeling activates properly. That only works if the underlying signal was accurate to begin with.

If maintaining three separate consent-to-signal mappings by hand is not worth your time, Seers handles that pipeline directly, mapped to Google, Meta, and Amazon. There is a free scan that flags scripts firing outside the consent event, worth running against your current setup either way.

Non-technical breakdown of the fines tied to this exact issue is here.

How to Actually Test Your Cookie Banner (and What to Ask CMP Vendors)

Mehwish Malik — Thu, 03 Sep 2026 12:56:27 +0000

Every marketing team says its cookie banner is compliant. Most banners fail the moment you inspect them. Here is how to test yours in five minutes, and the questions to ask before you buy or renew a CMP.

The five-minute test

Open your site in a private window.
Reject all cookies.
Open DevTools, Network tab, disable cache.
Reload the page.
Filter by facebook.com, google-analytics.com, googletagmanager.com, doubleclick.net, tiktok.com.

If any of those show a request with a status of 200, your CMP has failed. It is hiding the state but not stopping the tag.

Six buyer questions no vendor wants

Do you block scripts by DOM removal or by proxy? DOM removal is stronger.
Is IAB TCF v2.2 included in every plan, or extra?
Does Google Consent Mode v2 require me to add code, or does the CMP inject the flags for me?
Do you provide a per-user, per-purpose, per-version log I can export as CSV?
Do you cover the EU AI Act with a governance record, or only cookies?
Is the mobile app SDK bundled or a separate contract?

Most of the enterprise CMPs charge extra for at least three of those.

Why the mistakes cost so much

Shein paid EUR 150 million in France precisely because their banner did not block tags. LinkedIn paid EUR 310 million for using member data without a valid basis. The full read on consent and targeted advertising lists the enforcement pattern and the setup mistakes behind each one.

Where Seers AI stands out

Seers AI blocks tags at DOM load, not after. It bundles IAB TCF v2.2, Google Consent Mode v2, Microsoft Consent Mode, Global Privacy Control, IAB GPP and CCPA opt-out in every paid plan and its free tier. It also ships an AI Governance module for the EU AI Act and a Mobile App CMP, so a small team does not need three separate contracts. Setup on WordPress or Shopify takes a click. Free plan available, 14-day free trial with everything unlocked:

Skip the enterprise sales call unless you actually need it.

GA4 Consent Mode v2 + Google Signals: a developer's step-by-step debug guide

Mehwish Malik — Thu, 27 Aug 2026 12:55:20 +0000

Developers rebuilding GA4 pipelines this quarter: this is the debug guide you need. Since 15 June 2026, the way GA4 handles user and ad data has shifted. Google Signals no longer controls what flows into Google Ads.

Consent Mode does. Sites that missed the update are seeing smaller audience reports, dropped Enhanced Conversions and Google Ads Smart Bidding drifting off target. Here is the step-by-step patch every dev team should run this sprint.

The Seers guide on Google Signals and Consent Mode in GA4 covers each Admin screen with screenshots.

What Google Signals is

Google Signals joins a person's sessions across their phone, laptop and tablet when they are signed into Google with Ads Personalisation on. It enriches demographics, interests and cross-device paths inside GA4. It does not fire tags and does not manage cookies. It only enriches data that has already been collected with consent.

What Consent Mode is

Consent Mode is the gatekeeper. It reads four flags before any Google tag runs: ad_storage, analytics_storage, ad_user_data and ad_personalisation. Basic mode blocks tags until the visitor accepts. Advanced mode sends cookie-less pings when consent is denied, which GA4 later feeds into behavioural modelling.

Why the order matters

Consent Mode runs first. Google Signals runs after, using only what consent allows. If your CMP loads late, the first pageview slips through with default values and Signals has nothing to enrich.

Behavioural modelling thresholds

Modelling only turns on when GA4 sees 1,000 daily events with analytics_storage denied for 7 straight days, plus 1,000 daily users with it granted for 7 of the past 28 days. Modelled data usually appears in reports within 7 to 14 days once both bars are cleared.

Real business impact

Enhanced Conversions and Google Ads Smart Bidding both read Consent Mode signals. A stale setup thins Smart Bidding inputs and drags campaign performance. A non-compliant setup can also trigger GDPR fines of up to 4% of global annual revenue under Article 83 of the UK and EU GDPR.

How to fix your setup

Turn Google Signals on in Admin > Data Collection.
Move your CMP tag to the top of Google Tag Manager firing order.
Switch to Advanced mode with your legal team's sign-off.
Validate with GA4 DebugView, Google Tag Assistant and Consent Mode Diagnostics.

Why teams pick Seers over building it

If you want to skip custom code, Google Consent Mode v2 by Seers is a TCF-certified consent banner that plugs into Google Tag Manager in minutes, writes default consent values before any Google tag loads, and handles all four flags automatically.

Bottom line

Run this in a staging property first with a fresh Chrome profile, then push the same config to production. Modelled data starts flowing back within 7 to 14 days once both thresholds are met.

50,000+ websites already run their cookie consent through Seers.ai, which includes a free cookie audit that flags weak points on your site in seconds.

Why Are My Consent Flags Correct in Tag Manager but Wrong in the CRM?

Mehwish Malik — Thu, 20 Aug 2026 06:37:39 +0000

Because you solved collection and skipped propagation. Most consent bugs aren't legal
problems. They're sync problems.

A user clicks reject. Your banner writes it locally. Your tag manager reads it. And
then nothing else in your stack ever hears about it again.

The four flags Google reads

ad_storage : may we set advertising cookies
analytics_storage : may we set measurement cookies
ad_user_data : may we send user data to Google for ads
ad_personalization : may we personalise ads

The last two arrived in November 2023. Since March 2024, Customer Match lists used in
the EEA need both set to GRANTED. Miss one and the list just doesn't serve. No warning,
no error.

Setting these is an afternoon's work. Keeping them honest is the part nobody owns.

Where it drifts

Your user changes their mind in the mobile app three weeks later.

Your web container never finds out. Neither does your CRM. Your email tool keeps
sending. The flags in your tag manager are still perfectly valid, and now they're also
wrong.

The bit that actually bites: identity

Here's the design decision that decides whether any of this works.

Consent keyed to a cookie is consent keyed to a browser. Same person on a phone and a
laptop gives you two records, and eventually two different answers.

Key it to a stable user identifier instead, and resolve the anonymous cookie to that
identifier the moment they log in. Otherwise universal consent quietly becomes
per-device consent with extra steps.

Build it as a service

Write once to a central store. Then push, don't poll. Webhooks out to your CRM, ESP,
warehouse and ad platforms.

Watch your propagation window. If your CRM syncs overnight, that's up to 24 hours of
processing you can't defend. Batch is fine for reporting and useless for revocation.

Stamp every write with a timestamp, the purpose, the channel and the rule that applied
at that moment. A year from now that stamp is the only thing standing between you and
"we think so".

And version your banner copy. Proving someone consented is easy. Proving what they were
looking at when they did it is what people forget to build.

The universal consent model
covers how offline and in-app consent joins the same record.

(If you'd rather not build the identity layer, propagation queue and audit log
yourself, Seers AI ships it: https://seers.ai/)

Four questions stall enterprise deals. Most teams cannot answer one of them.

Mehwish Malik — Tue, 18 Aug 2026 12:51:58 +0000

Ask your team which EU AI Act article your production model triggers.

Most cannot answer. Since 2 August 2026, somebody can ask officially.

What landed on that date

The AI Office and national authorities took on supervision and enforcement.

Their powers are concrete:

Send a formal request for information.
Run their own evaluation of your model.
Demand access to a general-purpose model.
Interview staff and inspect provider premises.
Order a provider to restrict a model's public availability. None of that starts in a courtroom.

Five artefacts, and when to build them

Evidence, not intent. That means:

A register with a named owner per model, including third-party APIs and bundled vendor features.
Data lineage per dataset. Source, licence, and whether personal data sits inside it.
Model cards and version history, so you can say which version decided what, and when.
Input and output logs for anything touching a person's job, credit, health or education.
A human review path that somebody actually staffs. Build it into the pipeline. Reconstructing it after an incident does not work.

Teams already running consent tooling from Seers hold half of this. Disclosure evidence and data maps overlap heavily with AI documentation.

One deadline moved. One did not.

Annex III high-risk duties now apply from 2 December 2027. High-risk AI inside regulated products gets until 2 August 2028.

That is real breathing room.

GDPR did not move. Articles 13 and 14 already require you to tell people how automated processing works on their data.

Why the business cares

A register with owners, versions and logs answers a customer security questionnaire in a day.

Without one it takes a month. Enterprise deals stall on that gap more often than on price.

The comparison of AI governance and AI compliance is worth reading before your next release.

Seers AI Governance scans a live site and maps each system it finds to the articles that system triggers.

Your Hashed User IDs Are Still Personal Data Under GDPR

Mehwish Malik — Tue, 18 Aug 2026 06:36:44 +0000

Plenty of engineering teams believe that hashing an email or swapping a real user ID for a random token takes a table out of GDPR scope. It does not, and the wording of the law is the reason.

Article 4(5) defines pseudonymisation as processing personal data so that it "can no longer be attributed to a specific data subject without the use of additional information".

The ICO reads that exactly as written: pseudonymisation is "effectively only a security measure. It does not change the status of the data as personal data".

So if a salt, a key vault entry, a lookup table or a join key exists anywhere in your estate, the hashed table is personal data. Retention limits, breach reporting and subject access requests all still apply to it.

What actually leaves scope

Only irreversible anonymisation. If any reasonable means could relink a row to a person, you are still inside GDPR.

Where this bites in real stacks

Client-side tags firing before the consent state resolves.
Web servers keeping full IP addresses in default log config.
Error monitoring attaching session and device IDs to stack traces.
Mobile SDKs reading the advertising identifier on app launch. Each of those touches something on the regulator list of what counts as personal data under GDPR, so each one needs a lawful basis before it runs.

Why the business cares

Article 83 puts the upper tier at 20 million euros or 4% of global annual turnover. A logging default is a cheap fix. An enforcement action is not.

Fix it at the edge, not in twelve codebases

Chasing consent logic through every SDK is work you will repeat forever. Move collection behind server side tagging and you get one control point instead of twelve.

Seers.AI sits there and decides, per visitor, per identifier, what is allowed to leave. The AI learns your tag landscape as it changes, so a new script added by the marketing team does not quietly become your next incident. Give the boring part to a system that never forgets to check.

fbq('consent','revoke') Before init: The One Line Most Meta Pixel Setups Are Missing

Mehwish Malik — Thu, 06 Aug 2026 07:47:24 +0000

Most Meta Pixel installs are compliant in intention and leaking in practice. The reason is sequencing.

The default snippet Meta gives you calls fbq('init', ...) and then fbq('track', 'PageView'). Both sit high in the so the Pixel loads fast. Your consent banner is a separate script that loads later. For the window between them, the Pixel has already sent a PageView with no consent recorded anywhere.

Meta's own GDPR implementation docs cover the fix. The Pixel has a consent state, and you set it before you initialise:

`js fbq('consent', 'revoke'); // must run before init fbq('init', 'YOUR_PIXEL_ID'); fbq('track', 'PageView');

Then, in your banner's accept handler:

js fbq('consent', 'grant');

While revoked, the Pixel loads but holds back tracking data. That is the state you want by default for EU and UK traffic.

The part that catches teams out

The Conversions API does not inherit this. It runs server side, so your revoke call has no reach over it. If you are gating the Pixel and firing CAPI events for everyone, you have gated the visible half of your setup and left the other half open. The route changed. The legal basis did not.

Second trap: if the Pixel and CAPI both report the same purchase, you double count it. Meta deduplicates when both events carry the same event_id and event_name`. Generate the ID once per event, pass it to both, and your numbers stop inflating.

One more that has quietly changed: the Advertiser Tracking Enabled parameter is no longer required for Facebook SDK for iOS 17.0.0 and later. If your mobile setup still hardcodes it, review it.

The full sequence, including the GTM variant, is in this walkthrough of facebook ads consent tracking.

Where a CMP earns its place

Wiring this by hand across Meta, Google Consent Mode v2 and Microsoft means three separate signal paths to keep in sync, and every deploy is a chance to break one. A consent platform with native Meta integration emits all three from one source, so the banner state and the tag state cannot drift apart. That is the reason to use one, rather than the banner itself.

Manifest vs Latent Disclosure: What SB 942 Actually Makes You Build

Mehwish Malik — Thu, 30 Jul 2026 07:27:31 +0000

California's AI Transparency Act started on 2 August 2026. If your AI tool makes images, video or sound, has over a million users a month, and works in California, you have three things to build. Here is the full duty list.

1. A label people can see

A watermark on images. An overlay on video. A spoken tag on audio.

It has to be easy to notice. Small grey text in the corner will not pass. Build it as a real feature with a toggle, because users must be able to switch it on.

2. A tag people cannot see

A signed note inside the file that says what made it and when. It has to be very hard to strip out. The standard used here is C2PA.

One warning. Re-encoding kills these tags. Convert a PNG to JPEG in your export pipeline and the tag can disappear. Test every export path before you ship.

3. A free public checker

Anyone sends you a file. You say whether your AI made it, and return any origin info you find. Public endpoint, rate limited, no login, no fee.

Text-only output is not covered. Images, video and sound only.

What to build and what not to build

Build the watermarking. It touches your models and your pipeline.

Do not build a law tracker. That means someone reading bills, someone updating config, and someone remembering that AB 853 moved this date by seven months. Forever.

What Seers AI covers instead

150+ privacy laws, updating themselves when a law changes
Cookie and script scanning, blocked until a visitor agrees
Consent records and analytics, which is your proof if anyone asks
Google Consent Mode v2, Microsoft Consent Mode, IAB TCF v2.2, Global Privacy Control
One click install on WordPress, Shopify, Magento and Joomla
28+ languages, support at any hour

Check the Seers AI feature list and count how many of those you were about to build. 50,000+ sites already run it.

Free for 14 days.

How Geo-Targeted Cookie Banners Work (and Why One Global Banner Fails)

Mehwish Malik — Wed, 29 Jul 2026 07:48:39 +0000

If you serve traffic across regions, one cookie banner is a bug, not a feature. GDPR needs opt-in before non-essential cookies fire. CCPA is opt-out. LGPD wants consent per purpose. Hard-code one banner for all three and you either block scripts you did not need to or fire scripts you should have blocked. Both cause problems.

How it works

On page load, the consent script reads the visitor's IP and checks it against a geolocation database to resolve a region. That region maps to a config: which banner to show, which cookie categories to block by default, and which legal basis applies.

An EU visitor keeps non-essential tags blocked until they opt in. A California visitor can load tags with a Do Not Sell or Share control. A low-regulation region can get a light notice.

Worth getting right

Resolve the region before rendering tags, so blocking happens on first paint.
Default to deny for unknown IPs, then relax per region.
Log every consent event with region, banner version and timestamp for your audit trail.
VPN traffic resolves to the server's location. Most teams accept this.

The business payoff

Tags load where the law allows, so your data is fuller in relaxed regions and clean in strict ones. Local banners lift opt-in rates. Fewer scripts in low-regulation regions help Core Web Vitals. And the cost of getting it wrong is steep, with GDPR fines reaching €20 million or 4% of global turnover.

Building and maintaining the geolocation, blocking and logging layer yourself is a lot of upkeep. Seers does all of it: region detection, the right banner per law (GDPR, CCPA, LGPD and US state laws), cookie blocking before consent, and per-region consent logs for your audit trail.

You set the rules once, drop in a single script, and it updates as laws change, with plugins for WordPress, Shopify, Magento and Drupal. You can start with Seers free. If you want the full case first, here are the benefits of geo-targeted cookie banners.

How Geo-Targeted Cookie Banners Work (and Why They Beat One Global Banner)

Mehwish Malik — Wed, 29 Jul 2026 07:26:40 +0000

If you serve traffic across regions, a single cookie banner creates a technical and legal mismatch. GDPR needs opt-in before non-essential cookies fire. CCPA is opt-out. LGPD wants consent per purpose. Hard-coding one banner for all of them means you either block scripts you did not need to, or fire scripts you should have blocked.

How it works

When a page loads, the consent script reads the visitor's IP and checks it against a geolocation database to resolve a country or region. That region maps to a consent configuration: which banner layout to show, which cookie categories to block by default, and which legal basis applies. For an EU visitor, non-essential tags stay blocked until an explicit opt-in event. For a California visitor, tags may load with a Do Not Sell or Share control available. For a low-regulation region, you can serve a minimal notice.

Implementation notes

Resolve the region before rendering tags, so blocking happens on first paint rather than after.
Keep a default deny state for unknown or ambiguous IPs, then relax per region.
Log each consent event with the region, banner version, and timestamp for your audit trail.
Expect VPN traffic to resolve to the server's location, not the user's. Most teams accept this as standard.

Business value

Region-aware blocking means analytics and marketing tags load where the law allows, so your data is fuller in relaxed regions and clean in strict ones. Contextual banners lift consent rates. Fewer scripts in low-regulation regions also help Core Web Vitals.

Rather than maintaining this logic by hand, a consent management platform such as Seers automates location detection, banner display, cookie blocking, and logging across GDPR, CCPA, LGPD and US state laws, so you can ship region-based consent without writing the geolocation layer yourself. For the full rationale, this breakdown of geo-targeted cookie banner benefits walks through the eight main gains.