When a visitor declines cookies, Google Ads can only model the sale they go on to make if consent mode passes it the right signals. At £20k a month of Google Ads, with a third of visitors declining and those signals wrong, Smart Bidding learns from two in three of the buyers you paid for. Set up the other way, tags fire before anyone has chosen, which is exactly what the ICO’s cookie guidance asks you to prevent.
A consent mode v2 audit from Conversion Uplift tests whether your cookie banner, Google Tag Manager and server container respect each visitor’s choice, request by request on your live site, and gives you ranked fixes plus an evidence pack your privacy owner can keep. £750 + VAT, results in 5 working days. The method is the one Neal Cole wrote for CXL’s official GA4 and GTM audit course; his team of senior analysts runs the tests and he signs the report.
9 of the 26 organisations we have audited since 2024 had tags firing before consent or consent mode set up wrong. See what we found.
Not sure yet? Start with the free consent check: what your homepage loads before and after a visitor rejects or accepts cookies, no access needed. Or book a 30-minute call with Neal.
Neal Cole wrote the official GA4 and GTM audit course for CXL, holds CXL’s Special Topics in GTM for GA4 and Analytics Mania’s Intermediate Google Tag Manager and Advanced Topics certifications, and has spent 20+ years fixing tracking for Hastings Direct, Casumo, Irish News, Assurant, The Press Association (PA Media), Marex, Funbox and other businesses where a wrong number is expensive. He wrote the method. A small senior team runs it on your site, and he puts his name to the report.
We are analysts, not lawyers. Where a question is a legal one, such as whether an analytics exception applies to your set-up, we give your DPO or data-protection adviser the evidence and leave the judgement with them. If you need someone on hand after the audit, see what a GA4 consultant covers.
Most sites have a banner and a consent tag. The work is making sure the choice a visitor makes reaches every tag, in the right order, on every page they can land on, and that your server container keeps to it. These are the six places it usually goes wrong. If you would rather start on the GTM side yourself, our consent mode set-up guide walks through it.
Your CMP’s template on the Consent Initialization trigger, with analytics_storage, ad_storage, ad_user_data and ad_personalization set to denied before anything else runs, and no page_view, view_item or experiment event pushed to the data layer ahead of them. We check wait_for_update is used as a short wait rather than mistaken for a gate, and that no second default tag overwrites a choice the visitor already made. With the order right, every Google tag carries a consent state from the first hit, so Google Ads can model the sales of visitors who decline and Smart Bidding prices your £20k a month on all your buyers rather than the two in three who accepted.
Cookiebot, OneTrust, CookieYes, Complianz or a banner your developers built: we check each category lands on the right Google signal, that accepting analytics alone leaves ad_storage, ad_user_data and ad_personalization denied, and that the update reaches GTM before the event your triggers wait for, under the name your banner actually sends. A trigger waiting for an event the banner never fires stops purchases reaching the ad platforms at all. Mapped correctly, every accepted purchase reaches Google Ads, and the remarketing audiences your £20k a month is spent on hold only people who agreed to be in them.
Consent mode only instructs Google’s own tags. Meta Pixel, Microsoft UET, TikTok, LinkedIn Insight, Clarity and form-analytics scripts need their own consent checks in GTM, and anything hard-coded in the theme, added by a CMS plugin or loaded from a second container sits outside GTM altogether. We list every vendor your site loads, what each one stores before and after a choice, and the consent check it should wait for. You keep the Meta and Microsoft Ads pixels your campaigns depend on, firing for visitors who agreed, instead of switching them off after a complaint and losing the conversion data behind that spend.
In basic mode, Google tags wait until a visitor agrees. In advanced mode they load with denied defaults and send cookieless pings, which give Google Ads a conversion model built on your own traffic but are still data sent before consent. We capture exactly what your site sends in each state, including the url_passthrough and ads_data_redaction settings, and set out the trade-off for your privacy owner to decide and record. You choose with the modelling you would gain or give up set against your monthly Google Ads spend, rather than living with a default someone picked during set-up.
For each journey we save the requests, cookies and storage your site writes with no choice, after reject, with analytics only, after accept and after withdrawal, alongside the CMP version, the GTM and server container versions and a tag-by-purpose inventory. The reference point is the ICO’s guidance on storage and access technologies, finalised in April 2026; we don’t offer a legal opinion on it. When a complaint, a due-diligence questionnaire or an agency handover asks how consent works on your site, you answer with a dated record in a day rather than paying for an urgent outside review.
Moving tags server-side doesn’t remove the need for consent. We check the consent state travels with each request into your server container, that GA4 and Google Ads server tags respect it, that Meta CAPI, the TikTok Events API and other non-Google server tags have rules of their own, and that hashed email and click IDs are only sent when ad_user_data and ad_storage allow. Done properly, server-side tracking on Stape recovers the conversions ad blockers and Safari would cost you without sending anything a visitor refused. It’s quoted separately: see server-side tracking, from £1,100 + VAT.
Consent mode is configured in Google Tag Manager. If the rest of the container needs checking too, add the GTM audit for £250 + VAT.
A cookie scanner crawls your pages and lists what it finds. A consent test has to press reject, reload, come back, accept analytics only, then withdraw, and watch what each tag does every time. We do that by hand, in clean browser profiles and in one that already holds Google cookies, on the three journeys you choose: usually a landing page, a form or checkout, and the confirmation page. Every request is captured, including those to your own first-party collection domain, and checked against what the visitor chose.
Alongside the live test, the consent settings on every tag in your web and server containers are read through Google’s read-only Tag Manager API, and a senior analyst checks each one against what the browser showed. Tag Assistant and GTM preview confirm the order defaults and updates arrive in. Neal signs the report.
What the audit doesn’t do is write your privacy policy, choose your CMP or give a legal opinion. It tells you what your site does, what it should do and how to fix the difference. The free consent check runs the reject and accept passes on your homepage only, which is often enough to tell you whether you need the full audit.
For a childcare brand, against £20,173 in browser-only GA4 over the same period, where consent timing, cross-domain journeys and lost click IDs cut the count. Read the case study.
For a global insurer, once its form tracking was fixed. Read the case study.
For an online casino group after moving GA4 into BigQuery. Read the case study.
Every price is fixed, so if a job takes longer than we estimated, you don’t pay more.
| Step | What you get | Price |
|---|---|---|
| Free consent check | What your homepage loads before and after a visitor rejects or accepts cookies, read from the public site. No access needed | Free |
| Consent mode v2 audit | Consent settings on every tag in your web and server containers, your banner’s signal mapping, and a live test of no choice, reject, analytics only, accept and withdraw on three journeys. Ranked fixes and an evidence pack your privacy owner can keep, in a report Neal Cole signs | £750 + VAT |
| Consent fixes | CMP template, defaults, signal mapping, tag consent checks and server rules, built, tested and documented | Fixed price quoted after the audit |
| GTM audit | The rest of the container: tags, triggers, variables and the data layer. Details | £250 + VAT |
| Server-side tracking | Collection moved to server-side GTM on Stape, with consent passed to every server tag and enhanced conversions and Meta CAPI sent from your own domain. Prices | From £1,100 + VAT or monthly with no setup fee |
| Tracking Monitor | Weekly checks that tags still wait for consent and conversions still arrive, so a banner or site release that breaks either is caught that week. How it works | Fixed monthly fee |
Most clients start with the free consent check. If it shows tags firing early or signals that don’t match, the audit tells you exactly what to change and gives you a fixed price to fix it.
These come from GTM, GA4 and consent audits we have done since 2024, one organisation per example. Tags firing before consent, or consent mode set up wrong, turned up at 9 of the 26 organisations we audited.
You give our analyst read access to your web and server GTM containers and name the three journeys that matter most. We work with businesses spending £10k or more a month on paid media, or in a regulated sector; below that, the free consent check is the right place to start.
A senior analyst runs each journey with no choice, reject, analytics only, accept and withdraw, capturing every request your site sends, and checks the result against the consent settings on every tag.
Within 5 working days: the ranked fixes, the evidence pack for your privacy owner, and a fixed price for the fixes if you want us to make them.
Consent mode is how your cookie banner tells Google’s tags what a visitor agreed to. Version 2 added two signals, ad_user_data and ad_personalization, to the original analytics_storage and ad_storage, so Google Ads knows whether it may use a visitor’s data for advertising and for personalised ads. Google’s EU user consent policy covers visitors in the UK. Our audit checks all four signals are set before any tag fires and change correctly when a visitor chooses, against Google’s consent mode documentation.
A fixed £750 + VAT for one website, covering your web and server containers and three live journeys. The price holds if the work takes longer than we expected. Fixes are quoted at a fixed price once the audit says what needs doing, or the report works as a specification for your own developers or agency.
The usual causes are a default set after the first events have already fired, a trigger waiting for an event name the banner never sends, banner categories mapped to the wrong signal, tags hard-coded outside Google Tag Manager, two consent tags overwriting each other, and server tags that ignore the consent state. Tag Assistant shows some of these; the rest need a request-by-request test.
Basic mode holds Google tags back until a visitor agrees. Advanced mode loads them with denied defaults and sends cookieless pings before consent, which gives Google Ads a model built on your own traffic. We recommend basic as the starting point unless your privacy owner has assessed what advanced mode sends from your site and recorded the decision. The audit captures those requests, so that decision rests on evidence.
They overlap. A cookie audit usually lists the cookies on your site and reviews the banner wording. Our cookie compliance audit adds the part that decides what your tracking is allowed to collect: whether each tag obeys the choice, request by request, and whether Google and your server container receive the right signals. The cookie and tag inventory comes with the report.
Not on its own. PECR covers storing or reading information on a visitor’s device, and consent mode only tells Google’s tags what was chosen. Whether you comply depends on your banner, your purposes and every vendor on the site. The ICO updated its cookie guidance in April 2026 after the Data (Use and Access) Act 2025 added some exceptions, but advertising, including measuring campaigns, still needs consent. We give your privacy owner the evidence; the legal judgement stays with them or your adviser.
No. Server-side GTM still sets and reads cookies through the visitor’s browser, so PECR still applies, and Google’s documented set-up passes the consent state from your web container to the server. What it adds is control: you decide exactly what each platform receives and can strip out data a visitor didn’t agree to before it leaves your server.
An AI assistant reads the consent settings on every tag through Google’s read-only Tag Manager API, which is far faster than clicking through the container. The live tests are done by hand by a senior analyst, using the method Neal Cole wrote for CXL’s official GA4 and GTM audit course, and Neal signs the report. You get the speed of the automation and a named person accountable for every finding.
Written by the team, free to use before or after an audit:
From the source: the ICO’s rules for online advertising and Google’s consent mode set-up guide.
Need another piece of the stack checked? See the GTM audit, GA4 audit, server-side tracking, Tracking Monitor or, for gambling operators, iGaming tracking.
Tell us which cookie banner you use and what’s prompting the question: missing conversions, tags firing before consent, or a question from your privacy team. Neal replies personally, usually within one working day.
Would rather talk? Call 01978 896787 or book a 30-minute call with Neal.
Not ready for a conversation? Start with the free consent check: just put “free check” in the message.
We migrated their systems to Google Tag Manager, implemented detailed form field tracking, and developed online dashboards for self-service reporting.
Read Full Case Study
The client struggled with data quality issues due to the limitations of free Google Analytics 4, given the high traffic volumes on their site. Solution: We exported raw data to BigQuery and set up automated dashboards to leverage tabular analysis directly from BigQuery.
Read Full Case Study
A childcare brand was under-reporting revenue by over 90%. Here’s what it was costing them.
Online claims conversion up from 20% to 45% for a global insurer, after fixing form tracking
80% more usable event data for an online casino group, by moving GA4 into BigQuery
Conversion Uplift is led by Neal Cole, author of the official GA4/GTM audit course for CXL, not “CXL-trained” like much of the field, but the person who wrote the course. Behind him is an experienced team with a background in the sectors where getting measurement wrong is most expensive: financial services and gaming. The person who audits your setup is the person who fixes it.
Conversion Uplift Founder
and creator of CXL.com's GA4 Audit Course
Analytics Engineer
Senior Analytics Consultant
Data Analyst
Neal regularly shares what we’re seeing in the field, where analytics data goes wrong, what AI changes for measurement, and how server-side tracking and BigQuery keep the numbers honest. Practical, specific, and occasionally uncomfortable.
Start with a free website audit, or talk to Neal directly about a full diagnostic. Either way, you’ll know exactly where your numbers stand, and what it’s worth to fix them. Results in minutes, no account access needed.
