Privacy-First Measurement: Consent and Modeled Data

Short answer

Privacy-first measurement means collecting only what visitors agree to, filling the gaps with clearly labelled modeled data, and relying on first-party data you own. Done well, it gives you numbers you can defend and a brand people trust.

Key takeaways

For EEA traffic, Google requires consent signals (ad_user_data and ad_personalization) before user data can be used for ad personalization, a requirement enforced from March 2024.
Treat modeled conversions as estimates: report observed and modeled numbers separately so trends stay honest.
Chrome still lets users keep third-party cookies, but Google retired most Privacy Sandbox APIs in October 2025, so first-party data is the safer base.

Your analytics shows fewer conversions than your order system, your ad platform shows more, and the gap widened after you added a cookie banner. That is the normal state of marketing data in 2026. This page explains which parts of the gap come from consent, which come from modeling, and how to build a measurement setup that respects visitors and still supports budget decisions.

Every visitor who declines tracking disappears from cookie-based reports, so raw analytics undercounts in proportion to your decline rate.

The undercount is uneven. Decline rates differ by country, device and banner design, so a campaign aimed at a privacy-conscious audience can look worse than it is. Report consent rate as its own metric: if it drops after a site change, your conversion trend falls too, with no change in real sales.

Consent Mode passes the visitor's choice to Google tags, and since March 2024 Google has required the ad_user_data and ad_personalization signals for EEA users before their data can be used for ad personalization.

Google added those two parameters to the consent mode API as part of stronger enforcement of its EU user consent policy. Its Customer Match help states that from March 2024 both fields must be granted for EEA data to be used. People call this "Consent Mode v2."

The main settings:

Consent type	Controls	If denied
ad_storage	Advertising cookies	No ad cookies are written
analytics_storage	Analytics cookies	No analytics cookies are written
ad_user_data	Sending user data to Google for ads	Personal data such as user_id and enhanced conversions are not sent
ad_personalization	Personalized ads and remarketing	Remarketing lists receive no data

You also choose basic mode (tags wait for a choice) or advanced mode (cookieless pings while consent is denied, which feeds better modeling). Decide with your legal adviser.

How should you treat modeled conversions?

Modeled conversions are estimates, so report them next to observed conversions and never as a replacement for back-end revenue.

When consent is denied, Google uses consent-aware pings to model conversions, but only once your traffic passes a data threshold, so a small site may see no modeling at all.

Hypothetical example: a store records 800 orders in a month. Its analytics observes 560 purchases from consenting visitors, and Google Ads reports 700 conversions including modeled ones. The honest summary is "560 observed, about 140 modeled, 800 actual." Tracking all three shows whether the model drifts. Our piece on why analytics tools disagree covers the other causes of these gaps.

Where does Chrome stand on third-party cookies in November 2026?

As of November 2026, Chrome has not removed third-party cookies; Google keeps offering users a cookie choice and retired most Privacy Sandbox replacement APIs in October 2025.

The plan changed several times. Google spent years preparing to phase out third-party cookies, then moved toward user choice, and its October 17, 2025 update said Chrome would maintain that approach. The same update retired Topics, Protected Audience, Attribution Reporting, IP Protection and several other Privacy Sandbox technologies, citing low adoption. CHIPS, FedCM and Private State Tokens remain. Any plan built on a cross-site identifier is fragile.

What should a privacy-first setup include?

Build on first-party data and server-side control, then add modeled data only where you can label it.

Collect consent with a clear banner and pass it to every tag through Consent Mode or your platform's equivalent.
Track the business outcome in your own systems: orders, qualified leads, booked calls, with source captured at signup.
Move tags to a server-side container on your own domain. Only you see that data until you send it on, so you can strip fields you do not need.
Ask customers how they found you on forms. It catches channels no tag sees, such as AI assistants.
Report observed, modeled and back-end totals side by side, every month.

Our SEO ROI measurement service sets up exactly this kind of reporting. To translate the cleaned-up numbers into payback, use the SEO ROI calculator with back-end revenue, not cookie-based revenue.

Can privacy be a business advantage?

Yes: collecting less and explaining it plainly builds trust, and trust lifts conversion and repeat purchase.

A short privacy notice, a banner that is easy to decline and no surprise retargeting tell visitors the company respects them. People link to and return to brands they trust, which helps organic search indirectly. A smaller data footprint also means less to secure.

You will see less detail per visitor. For most budget decisions, that detail was never as accurate as dashboards suggested; see our note on the limits of attribution.

Frequently asked questions

What is the difference between basic and advanced consent mode?

In basic mode, Google tags do not load until the visitor interacts with the banner. In advanced mode, tags load with consent defaulting to denied and send cookieless pings, which Google uses for an advertiser-specific conversion model.

Are modeled conversions real conversions?

They are statistical estimates of conversions from people who declined cookies. Use them for bidding and trends, and reconcile them against back-end revenue monthly.

Does server-side tagging get around consent?

No. Server-side tagging changes where tags run and gives you control over what data leaves your server. Consent obligations stay exactly the same.

Is Chrome still blocking third-party cookies in 2026?

Chrome did not complete the deprecation it once planned. Google's October 2025 update said Chrome would keep its current approach of offering users third-party cookie choice, and it retired APIs such as Topics, Protected Audience and Attribution Reporting.

Sources

It's the ROI Editorial writes about SEO, GEO and measuring the return on search. Found an error or an outdated detail? Email contact@itstheroi.com.

Why do consent banners change your marketing numbers?

What does Google Consent Mode v2 require?