Your Conversions Didn't Drop. Your Measurement Did
Cookie banner went live, and overnight your Google Ads and GA4 conversions fell off a cliff. Before anyone declares the business broken: check your Shopify orders. If they haven't moved, your sales are fine, your tracking is what broke. Here's how to tell, and how to fix it without falling foul of GDPR.
If this happened overnight, it's almost certainly the banner. The 10-minute check: first, compare Shopify orders for the last 7 days against the previous 7. If orders are steady while reported conversions cratered, this is a measurement problem, not a sales problem. Second, open your site in a fresh incognito window with Google's Tag Assistant running, don't touch the cookie banner, and look at the consent state on your Google tags. If everything shows "denied" and no consent update ever arrives, even after you click Accept, your banner isn't talking to your tags. That's the fault, and it's fixable.
What Consent Mode v2 Actually Is
Consent Mode is Google's system for letting your tags respect cookie choices without simply switching off. Instead of a tag either firing or not, the tag is told what the visitor consented to and adjusts its behaviour, using cookies when it may, sending anonymous "cookieless pings" when it may not.
Version 2, which Google began enforcing for EEA and UK audiences in March 2024, works with four signals:
- ad_storage — may advertising cookies be stored? Controls things like the Google Ads click cookie.
- analytics_storage — may analytics cookies be stored? Controls GA4's cookies.
- ad_user_data — may user data be sent to Google for advertising purposes?
- ad_personalization — may that data be used for personalised ads and remarketing?
The last two are what "v2" added. Without them being sent as granted, Google won't build remarketing audiences from your visitors, and measurement in the EEA and UK degrades badly. Your cookie banner, properly called a CMP, a Consent Management Platform, is supposed to set all four signals based on what the visitor clicks.
The key word is supposed to. Most sudden conversion collapses come from the plumbing between the CMP and the tags, not from visitors declining.
The Five Ways It Goes Wrong
1. The CMP Isn't Passing Consent to Google at All
The banner displays, the visitor clicks Accept, the banner remembers the choice, and none of that information ever reaches your Google tags. The tags sit at their default state, usually denied, forever. This is the most common failure, and it's brutal: you lose tracking for everyone, including the majority who consented. It usually happens when a CMP is installed as a standalone script without its Google integration switched on, or installed alongside GTM without being connected to it.
2. An Outdated GTM Consent Setup
Google Tag Manager talks to CMPs through consent templates. If your CMP's template predates Consent Mode v2, it may set the two old signals but never send ad_user_data or ad_personalization. Ads measurement then quietly degrades even though "consent mode is installed". Templates and CMP plugins need to be current, an old WordPress-era cookie plugin bolted onto a Shopify store via GTM is a classic culprit.
3. Default Denied, and No Update Ever Sent
Consent mode works in two steps: a default command sets the starting state before any tags fire (sensibly, denied), then an update command follows once the visitor chooses. If the update never fires, because of a script error, a broken event, or the update code simply never being added, every visitor stays denied regardless of what they clicked. Everything looks installed. Nothing ever gets granted.
4. The Banner Blocks Tags Instead of Using Consent Mode
Some CMPs default to hard-blocking: scripts don't load at all until consent is given. That's a legitimate compliance approach, but if it's combined badly with GTM, tags can end up blocked even after consent, or blocked in situations consent mode would have handled gracefully. Hard-blocking also throws away the cookieless pings that power Google's conversion modelling, so you lose more measurement than compliance requires.
5. Region Misconfiguration
Consent rules can be applied per region. Get the region settings wrong and you can end up demanding consent from the whole world when the law requires it for EEA and UK visitors, or, worse legally, not asking the visitors you're required to ask. A UK store that suddenly loses US conversions after a banner launch has usually applied EEA rules globally without meaning to.
Real Loss vs Measurement Loss
Two very different things get mixed up in the panic:
- Measurement loss — sales happen but don't get reported. Shopify orders steady, reported conversions down. This is a broken pipe, and it's the overnight-cliff scenario almost every time.
- Real consent loss — a working consent setup will always lose some measurement, because some visitors genuinely decline. That's a legal reality, not a fault. The scale depends on your banner design and audience, and it arrives as a modest step down, not a cliff.
Shopify is your anchor here. Order counts in Shopify come from the till, not from cookies, so they're immune to consent problems. If the gap between Shopify orders and reported conversions jumped from its usual level to something dramatic on the day the banner launched, you have your diagnosis. For what a normal gap looks like in the first place, see why GA4 never quite matches Shopify.
What Conversion Modelling Does and Doesn't Recover
When consent mode is working properly, Google uses the anonymous cookieless pings from non-consenting visitors to model conversions, statistically estimating the sales it can no longer observe directly and adding them back into your Google Ads and GA4 reports. With a decent consent rate, modelling recovers a meaningful chunk of what declining visitors take away.
Two honest caveats. Modelling needs enough traffic to work with, small accounts see less benefit. And it only functions if the pings are being sent, a misconfigured or hard-blocking setup produces no pings, so there's nothing to model from. Broken consent mode doesn't just lose the decliners, it loses the estimate of the decliners too.
How to Diagnose It Properly
- Tag Assistant, consent tab. Load your site in incognito with Tag Assistant connected. Every Google tag shows its consent state. Check the default state on arrival, then interact with the banner and confirm a consent update event follows, and that all four v2 signals flip to granted after accepting.
- Look for the update, not just the default. In Tag Assistant's event stream you should see the consent default before any tag fires, then a consent update after the banner choice. Default with no update is failure mode number three above.
- GA4 DebugView. With debug mode on, watch events arrive in GA4 in real time as you accept consent and browse. If events flow in DebugView after accepting but your reports stayed empty for days, the fault arrived with the banner; if nothing arrives at all, tags are being blocked outright.
- Check both dates. Line up the exact date the CMP went live (or updated) against the date conversions dropped in Google Ads and GA4. Same day is your smoking gun.
Fixing It Without Breaking GDPR Compliance
The fix is never "take the banner off". You can be properly compliant and properly measured at the same time, that's the entire point of consent mode. Getting there usually means:
- Using a CMP that officially supports Consent Mode v2, and switching its Google or GTM integration on, not just installing the banner script.
- Setting consent defaults to denied before any Google tag fires, with the update wired to the banner's choice, and verifying both in Tag Assistant.
- Confirming all four v2 signals are being set, not just the original two.
- Applying the consent requirement to the right regions, and testing from more than one.
- Preferring consent mode's adjusted behaviour over hard-blocking where your legal advice allows, so modelling can recover what direct measurement loses.
Once it's fixed, reported conversions recover from the fix date forward, the missing weeks don't come back, Google can't retroactively count what was never sent. Which is a good argument for fixing it this week rather than next month. If the loss between click and report still stings after the consent fix, that's the problem server-side tracking exists to reduce.
Conversions fell off a cliff and you need it sorted now? This is one of the faults I can usually pin down quickly, the evidence is all in the consent states. I've spent a lot of hours reading what tags actually send, rather than what their dashboards claim. Ring me on 07515 543111 or book a tracking health check.
And if the aftermath has left your analytics in a general state, GA4 misfiring is its own rabbit hole, that's what my GA4 help covers.
Questions People Ask
The ones that come up most when a cookie banner breaks the numbers.
Usually because the banner isn't passing consent choices through to your Google tags, so every visitor is treated as having declined, including the majority who accepted. Check Shopify first: if orders are steady while reported conversions collapsed, it's a measurement fault, not a sales problem.
Not all of it. With consent mode set up properly, tags send anonymous cookieless pings for non-consenting visitors, and Google uses those to model conversions, a statistical estimate added back into your reports. You lose person-level detail, but a working setup keeps your topline numbers usable.
It's Google's system for telling tags what a visitor consented to, using four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization. If you advertise to EEA or UK audiences, yes, Google has required the v2 signals since March 2024, and without them remarketing audiences and ads measurement degrade badly.
Consent mode exists precisely to respect refusals while keeping cookieless, anonymised measurement, and it's used across the industry for that reason. It's compliance tooling, not a loophole. I'm not a lawyer, so your privacy policy and final setup should get proper legal sign-off, but "compliant" and "measured" are not opposites.
It varies with your traffic volume and consent rate, so I won't pretend there's a universal percentage. The honest version: bigger accounts with healthy consent rates recover a meaningful share of declined-visitor conversions, small accounts see less, and a broken setup recovers nothing because the pings modelling depends on are never sent.
Open your site in an incognito window with Google's Tag Assistant connected. Check the consent state your tags start with, then accept the banner and confirm a consent update follows with all four signals granted. No update, or tags that never load at all even after accepting, means the banner and the tags aren't talking.
Numbers Fell Off a Cliff?
The longer a consent fault runs, the more measurement is gone for good, Google can't backfill what was never sent. Tell me when the banner went live and what the drop looked like, and I'll tell you honestly whether it's the banner. A tracking health check covers the full setup.
More Tracking Guides
Consent faults love company. Once the banner's behaving, sanity-check whether GA4 matches your Shopify orders, whether your Meta pixel survived the changes, and whether your affiliate tracking is still recording. Or hand me the whole thing with a tracking health check.