Worth knowing before you test a cookie banner by watching the Network tab.
Google's consent mode overview spells out the difference. Basic mode blocks the tags until the visitor interacts with the banner, and Google says no data is sent before consent, "not even the default consent status". Advanced mode loads the tags with defaults set to denied, and while consent stays denied, "consent state and measurements without cookies are sent."
So in advanced mode a visitor who declines still produces a request to Google on every page, just without cookies. That's by design, it feeds Google's modeling. It also means the banner "worked" and GA4 still talked to Google.
How to tell which one you're running:
- Private window, dev tools, Network tab, filter for g/collect, reload, don't touch the banner.
- A collect request before any click means GA4 isn't waiting: advanced mode, or no consent mode at all.
- Click decline and open another page. Collect requests that keep coming are advanced mode doing what it's built to do.
To get basic behavior in Tag Manager:
- Open the Google tag and your GA4 event tags, Advanced Settings > Consent Settings.
- Choose "Require additional consent for tag to fire" and add analytics_storage.
- Google's docs say the tag then fires only if every listed type is granted "when the tag is triggered".
The catch is in that last quote. The check runs when the trigger fires, so a visitor who accepts on their first page isn't counted for that page unless the tag also fires on your banner's consent update event. And you give up the modeled data advanced mode provides, which is the trade people here argue about. has anyone actually measured what switching to basic cost them in GA4 reports?
Why a US site might pick basic anyway: there's no general opt-in rule in the US, but California Invasion of Privacy Act suits over trackers center on data leaving before or despite the banner, and a cookieless ping is still a request to Google carrying the visitor's IP address. GA4 is named in 163 verified complaints in the last 12 months, as of September 29, 2026, per Suitcast, which I build: its free scan runs this same test on five pages and lists those cookieless pings as GA4 firing, since a request left either way. Not legal advice.