Privacy and Analytics: GDPR, Consent and Consent Mode

Privacy and analytics are linked like this: the stricter the consent rules, the less complete the counter data, and an SEO specialist needs to understand which data remains reliable. Below: what is known about consent under GDPR and CCPA, how Consent Mode works in Google Analytics, under which conditions Google fills in missing data with a model, and what in popular claims (“CCPA requires consent”, “a fine of up to 4%”, “Search Console does not depend on consent”) needs refining. This is not legal advice: for conclusions for your site, consult a lawyer.

GDPR and CCPA are not the same

GDPR. Under Article 83 of the regulation, fines for infringing the basic principles for processing, including the conditions for consent (Articles 5, 6, 7 and 9), can reach EUR 20,000,000 or, for an undertaking, 4% of total worldwide annual turnover of the preceding financial year, whichever is higher (the text of Article 83). So “up to 4% of turnover” is an incomplete phrasing: the upper limit is the greater of the two values. The lower tier (up to EUR 10 million or 2%) applies to other infringements.

CCPA. The California law works differently. According to the California Attorney General, it gives consumers the right to know what personal information is collected and how it is used, to delete it, to correct inaccurate information, to opt out of the sale or sharing of personal information (including via the GPC signal) and not to be discriminated against for exercising their rights (the CCPA page). That is an opt-out model, not mandatory prior consent as in the claim “CCPA requires explicit consent”. Which obligations apply to your site depends on where your users are and on your activity — a question for a lawyer.

How Consent Mode works

Consent mode (Analytics Help) lets you communicate a user’s cookie or app identifier consent status to Google; Google tags adjust their behavior to the user’s choice. Important details:

• Consent mode does not provide a banner: it interacts with your consent management platform (CMP) or custom implementation.
• When consent is denied, tags do not store cookies but send cookieless “pings” to Google with a minimum of information: functional information (timestamp, user agent, referrer), coarse information (for example, whether the URL contained ad-click information), a boolean consent state and a random number generated on each page load.
• For Google Analytics, Google fills data collection gaps with conversion modeling and behavioral modeling.
• In November 2023 the mode was updated: two additional parameters appeared (advertising user data and personalization). For a site with its own solution, the help page advises setting a default consent state and updating it on user actions, and scoping defaults to the regions where you show a banner (developer setup).
• There are basic and advanced implementations; the choice determines whether modeling is possible (see below).

Behavioral modeling: the conditions

Behavioral modeling uses machine learning: the behavior of users who decline cookies is estimated from the behavior of similar users who accept. Per the help page on behavioral modeling, it is enabled automatically when a property is eligible, and only when there is high confidence in model quality. If there is not enough consented traffic, events from users who decline consent are not reported. The conditions:

1. Consent mode is enabled across all pages of the site and all app screens.
2. The advanced implementation: tags load before the consent dialog and in all cases, not only after consent.
3. At least 1,000 events a day with analytics_storage='denied' for at least 7 days.
4. At least 1,000 daily users sending events with analytics_storage='granted' for at least 7 of the previous 28 days.

Meeting the conditions does not guarantee eligibility: the model factors in other criteria, such as the ratio of new to returning users. To see modeled data, choose the Blended reporting identity. User counts in such reports will probably be higher than in reports with only observed data. So for small sites that do not reach the thresholds there will be no modeling, and part of the data will simply remain uncounted (GA4 overview).

What remains reliable

The Search Console Performance report shows how a site performs in Google Search results: impressions, clicks, queries, pages (help page). That data is not collected by tags on your site. One can conclude that its completeness does not depend on a consent banner on the site — but that is our inference: the documentation does not say so directly, and Search Console data has its own limits (Search Console for an analyst). So to answer “how much organic traffic”, it is convenient to compare clicks from Search Console with sessions from GA4 and understand the difference rather than expect them to match (KPIs in SEO).

Techniques from practice

• Server-side tagging and collecting your own data (first-party data) help depend less on blockers, but do not cancel consent requirements.
• Blockers and browser protections (Safari, Firefox, extensions) cut part of the measurement regardless of the banner: that is practice, not part of the documentation above.
• The text of the privacy policy and the banner must be agreed with a lawyer, not copied.

What is not in the sources

• “CCPA requires explicit consent before collecting data” — that is the GDPR model; the CCPA is described as a right to opt out.
• “GA4 loses 30% of data”, “25% of data from decliners” — individual stories; the share depends on your banner and audience.
• “‘(not provided)’ because HTTPS encrypts the referrer” — an explanation without a source; for search queries use the Search Console report.
• “Search Console does not depend on consent” — not stated directly in the documentation.

Checklist

1. The consent banner is set up with a lawyer and works.
2. Consent mode is connected to the CMP; the default state is set and scoped to the needed regions.
3. An implementation allowing modeling (advanced) is chosen and the 1,000/1,000 thresholds are checked.
4. It is clear in reports which data is observed and which is modeled.
5. Search Console and GA4 are compared to assess organic search.
6. Decisions do not rest on “loss” figures from other people’s stories.

Mistakes

• Treating CCPA and GDPR as the same requirement.
• Promising a client “a fine of up to 4%” without “or EUR 20 million, whichever is higher”.
• Turning on Consent mode and expecting modeling without meeting the conditions.
• Expecting GA4 and Search Console to show the same numbers.
• Copying consent wording from another site.

What next

Next comes first-party data: how to collect your own user data with their consent and use it instead of third-party identifiers. The international dimension is in the lesson on international SEO.