In 2026, 48% of the internet’s most-visited websites have at least one Google Consent Mode misconfiguration, according to Privado AI’s June 2026 audit of 250 top-traffic sites in the United States, France, and the United Kingdom. That gap is more exposed than it used to be: on June 15, 2026, Google removed the Google Analytics setting that used to limit how much mismatched data reached Google Ads. Consent Mode is no longer a background compliance setting; for many sites it is the only thing standing between a visitor’s opt-out and Google’s ad stack.
How many websites misconfigure Google Consent Mode?
Nearly half of the top 250 sites Privado AI tested, 48%, have at least one Consent Mode misconfiguration that sends personal data to Google Ads even after a visitor has opted out. Privado AI’s Web Auditor tool ran three consent conditions against each site: a Global Privacy Control (GPC) signal for California traffic, a reject-all click for France and the UK, and no consent action at all, then flagged any tracking request that fired despite a recorded refusal.
Figure 1: Share of the 250 top-traffic websites Privado AI tested with at least one Google Consent Mode misconfiguration. Source: Privado AI, “The State of Google Consent Mode” report, June 2026.
A visible reject button is not proof that the rejection reaches Google. The banner and the tag firing behind it are two separate systems, and Privado AI’s numbers show the two are already out of sync on nearly half of major sites.
What causes most Consent Mode failures?
Three failure patterns account for most of the problem in Privado AI’s dataset. The Global Privacy Control signal, the browser-level opt-out required under California law, went unhonored on 40% of tested sites. Consent Mode’s default state was set to granted before any user took action on 28% of sites, a default-state problem specific to Europe’s opt-in requirement. And 19% of European sites recorded a visitor’s rejection in the banner’s own log but never updated the Consent Mode value that Google reads, so Google kept receiving signals as if consent had been given.
Figure 2: Share of tested sites failing each Consent Mode check. Source: Privado AI, 250 sites, June 2026.
A cookie policy that lists the categories a banner controls and a banner that is wired to enforce that same list are two different jobs, and most audits check only the first one. Site owners who generate a current cookie policy and then test what their tags send after a reject click close the gap Privado AI’s audit keeps finding.
How strict is Google’s own privacy compliance bar?
Not strict enough to be a formality. Privado AI’s broader compliance sweep, covering every CCPA and GDPR check in its audit, found that 90% of the 250 sites tested failed at least one test, and only 10% passed every check the audit ran.
Figure 3: Overall privacy compliance test results across the 250 sites Privado AI tested. Source: Privado AI, June 2026.
The same divide shows up in how banners are built, not just how tags fire. Our cookie banner click-behavior data for 2026 covers a related gap: hiding a reject button changes accept rates by 22 percentage points on its own, before Consent Mode ever gets involved. Passing every check remains rare even among sites large enough to sit in a top-traffic sample.
When did Google make Consent Mode mandatory, and what changed in 2026?
Google introduced the original Consent Mode in September 2020, giving European advertisers using gtag.js or Google Tag Manager two settings, ad_storage and analytics_storage, that adjusted how Google tags behaved based on a visitor’s cookie choice. Google published two more parameters, ad_user_data and ad_personalization, in November 2023, forming what the industry calls Consent Mode v2.
Since March 2024, Google’s own support documentation states that advertisers reaching EEA users must collect consent and pass those signals to Google to keep using ad personalization, measurement, and remarketing features. Google tightened enforcement further in mid-2025: multiple advertising trade publications, including PPC Land, reported that Google began restricting personalization, remarketing, and conversion tracking for accounts with broken or missing Consent Mode signals on EEA and UK traffic starting around July 2025, in some documented cases wiping out most of an account’s measured conversions overnight with no advance warning. Treat that specific enforcement date as reported rather than officially confirmed by Google in a dated announcement we could independently verify.
The most recent shift landed on June 15, 2026, when Google removed the Google Analytics setting that had capped how much personal data reached Google Ads for cross-device remarketing. With that setting gone, Consent Mode’s own signal is the last check between a visitor’s choice and what Google Ads receives, which is exactly why Privado AI’s misconfiguration numbers carry more weight now than they would have a year earlier.
| Consent Mode check | Share of sites failing | Sample tested |
|---|---|---|
| At least one Consent Mode misconfiguration | 48% | 250 sites, US/France/UK |
| GPC signal not honored | 40% | California sites |
| Default consent set to granted before action | 28% | 250 sites |
| Reject-all click ignored, UK | 47% | 118 sites |
| Reject-all click ignored, France | 44% | 111 sites |
Source: Privado AI, “The State of Google Consent Mode” report, June 2026.
Does Google Consent Mode recover lost conversion data?
Yes, in part. Google’s own published data from April 2021 states that conversion modeling through Consent Mode recovers more than 70% of ad-click-to-conversion journeys otherwise lost when a visitor declines cookies. In a case study Google published in September 2022, Air France reported a 9% conversion uplift across European markets after adopting Consent Mode, including a 4% uplift within France specifically.
That modeling only turns on once a site clears fixed thresholds. Google Analytics requires a property to log at least 1,000 events a day with analytics_storage set to denied for 7 straight days, plus at least 1,000 daily users with analytics_storage set to granted for 7 of the previous 28 days, before behavioral modeling activates.
Figure 4: The volume test Google applies before GA4 behavioral modeling activates. Source: Google Analytics Help, “Behavioral modeling for consent mode.”
We could not find a verified, industry-wide figure for what share of GA4 properties or Google Ads accounts meet these thresholds and have working modeling turned on. Google publishes the eligibility rules and the recovery rate for sites that qualify, not a count of how many qualify, so treat any blanket “X% of advertisers use Consent Mode” claim you see elsewhere with caution unless it names a sample and a method the way Privado AI’s report does.
Where does Consent Mode break down by geography?
The UK and France show the widest gap between a visitor clicking reject and tracking stopping. On UK sites, 47% of the 118 tested kept firing tracking requests after a reject-all click; on French sites, 44% of 111 tested did the same.
Figure 5: Share of UK and French sites still tracking users after a reject-all click. Source: Privado AI, June 2026.
Both countries enforce GDPR and the ePrivacy rules that require a reject click to work, so a near-half failure rate in each market is a compliance exposure, not a rounding error. A site that shows a reject button and still tracks the visitor who clicked it has built the appearance of consent without the underlying control.
The Bottom Line
The headline number here is not really about Google’s technology, it is about the gap between what a banner promises and what the tags behind it do. Consent Mode has been required for EEA and UK advertisers since March 2024, Google’s own modeling can recover most of the resulting data loss, and yet 48% of major sites still get the wiring wrong in 2026. With Google’s June 2026 change removing the last Google Analytics backstop, that wiring is the whole compliance picture now, not one layer of it. A cookie policy that matches what the banner offers is the starting point; testing what the tags do after a reject click is the part most audits still skip.
Frequently Asked Questions
What percentage of websites misconfigure Google Consent Mode? 48% of the internet’s 250 most-visited websites have at least one Google Consent Mode misconfiguration, according to Privado AI’s June 2026 audit of sites in the US, France, and the UK. Only 10% of the sites tested passed every privacy compliance check in the audit.
When did Google make Consent Mode mandatory? Google has required EEA and UK advertisers to pass consent signals through Consent Mode since March 2024, per Google’s own support documentation. Google added the underlying v2 parameters, ad_user_data and ad_personalization, in November 2023.
Does Google Consent Mode recover lost conversion data? Partly. Google states that conversion modeling through Consent Mode recovers more than 70% of ad-click-to-conversion journeys lost to consent declines, based on data Google published in April 2021.
What changed with Google Consent Mode on June 15, 2026? Google removed the Google Analytics setting that had limited how much personal data reached Google Ads for cross-device remarketing, leaving Consent Mode as the only remaining control between a visitor’s opt-out choice and Google’s ad stack, per Privado AI’s June 2026 report.
Sources and References
- Privado AI. (2026). “The State of Google Consent Mode Report.” 250 top-traffic websites tested across California, France, and the UK, published June 15, 2026.
- Google Ads Help. “FAQs About the EU user consent policy for Customer Match upload partners.” States the March 2024 EEA consent requirement.
- Google for Developers. “Set up consent mode on websites.” Documents the November 2023 update adding ad_user_data and ad_personalization.
- Google Analytics Help. “[GA4] Behavioral modeling for consent mode.” States the volume thresholds for modeling eligibility.
- Google. (2020). “Measure conversions while respecting user consent choices.” Original Consent Mode launch announcement.
- Google. (2021). “Conversion modeling through Consent Mode in Google Ads.” Source of the 70%+ recovery figure.
- Google. (2022). “Unlocking the full value of Consent Mode.” Air France case study and conversion uplift figures.
- PPC Land. (2026). “Consent Mode V2 enforcement is silently breaking Google Ads conversions.” Reporting on mid-2025 enforcement tightening.
Note: All figures verified as of October 2026. Google Consent Mode requirements and enforcement change quickly, so headline figures are refreshed at least twice a year. The mid-2025 enforcement date is reported by trade publications rather than a dated Google announcement we could independently verify, and is flagged as such above.
