GA4 Data Controls: What Consent Mode Controls Now

On 15 June 2026 the Google Signals switch inside Google Analytics stopped deciding whether your Google Ads cookies and identifiers could be collected. Consent Mode decides that now. Nothing moved in the interface, no banner appeared, and most properties carried on reporting the same figures, which is exactly why the change is easy to miss and worth understanding before the second half of it lands.

There is a second change still to come. Google has said it will move the controls for ads personalization out of Analytics and into Ads settings later in 2026, with the Consent Mode ad_personalization setting as the single switch. Between the two, the consent banner on the client's site has become the most consequential piece of the measurement stack. This is what changed, what it means for remarketing audiences, and what to check before you sign off another month of reports.

What changed on 15 June

Before that date, two settings shared responsibility for whether Google Ads cookies and IDs were collected from the Google Analytics tag and SDK. One was the Google Signals setting in Analytics admin. The other was your Consent Mode Ads settings. Both had to be in the right state.

After 15 June, Consent Mode is the single control. The privacy selections your visitors make through the banner now govern collection and use on their own. Google's wording is that the Google Signals setting in Analytics admin, and the Google Signals API, now only control the association of Analytics data with signed-in user information for behavioral reporting.

That last sentence is the part people skip. Google Signals did not disappear. It stopped being an advertising switch and went back to being a reporting feature.

Why Google framed it as one job, not two

The stated reason is a rule about where data is used. For linked properties, Ads settings control Ads data, including the data Analytics sends. Analytics settings control data used inside Analytics for reporting. The aim is to remove settings that overlap and make the same decision twice.

The practical read for anyone running client accounts: the Ads side of the chain is now gated by the consent signal your banner sends. A toggle in Analytics admin cannot open or close that gate any more.

What Google Signals still does

Enriched reporting. Demographics and interests data for users who are signed in and have Ads Personalization on. That is reporting enrichment inside Analytics, nothing more.

Data expiry. Signals data expires after 26 months by default. If the property's data retention setting is shorter, the shorter figure applies.

Regional control. You can allow or block Signals collection per region. Blocking a region keeps historical data and stops new collection from that point forward.

Server-side containers. Google's Signals page still tells anyone running server-side Tag Manager to configure Signals. That was a real dependency before 15 June and the page has not been rewritten.

The property-level ads personalization setting sits outside Signals entirely and applies whether or not Signals is switched on.

The change still to come

Later in 2026, Google will change how Analytics data is managed for ads personalization. Today that control is spread across four levels: account, property, the individual Google Ads link, and specific events and user properties. After the change, linking a property to Ads establishes the flow of data, and the Consent Mode ad_personalization setting alone decides whether that data is used for personalization in the Ads account.

No date has been published. What matters now is the default. When you link a Google Ads account, the option to Enable Personalized Advertising is switched on. Today that default sits inside a layer of other settings. After the change it becomes the thing that decides, alongside ad_personalization, whether audiences and events can be used for personalization at all.

The line about IP addresses

The same announcement adds that IP addresses collected by the Google tag and SDK will be encrypted and flow to the linked Ads account, controlled by Ads settings and terms. Google says more detail and exact dates for both the personalization and IP changes will be published later in the year. For visitors outside the EEA, the UK and Switzerland, Google already documents different IP handling, so read the current page rather than assume.

What it means for remarketing audiences

Audiences are where this lands in daily work. Five points cover most of it.

Export depends on personalization being enabled on the link. Audiences reach Google Ads when the product link exists and personalized advertising is enabled for that link. It is on by default when you link, which means it is also the setting nobody remembers changing.

Membership is built forward. When an audience is created, Analytics adds users who met the criteria during the last 30 days, and that backfill applies to Google Ads audiences only. Beyond that window the audience is not retroactive. Reports and exported lists also exclude backfilled memberships, so a user has to trigger an event after creation to show up in them.

Limits and duration. Maximum membership is 540 days, restarted each time a user meets the criteria again. A standard property holds up to 100 audience definitions, a 360 property 400. Creating audiences needs the Marketer role, and each condition has a 500-character cap.

Ads reports the remarketable portion, not your number. The same audience shows different sizes in the two tools and Google says so plainly. Ads keeps separate list sizes for Search, YouTube, Gmail and DV360. A Search remarketing list only counts users who visited Google Search in the previous 30 days. Apple's ATT prompt, device-level opt-outs, an Ads personalization preference, and a region you have switched off in Analytics all remove people from the exported list while leaving them in the Analytics count.

Consent Mode outcomes are the deciding factor now. The consent mode reference sets out what each parameter does when it is denied. ad_storage denied means no advertising cookies are read or written, Analytics will not read or write Google Ads cookies, and Signals features stop accumulating data for that traffic. ad_user_data denied keeps personal data out of online advertising. ad_personalization denied stops remarketing in Google Ads, DV360 and Search Ads 360 receiving data at all. Both ad_user_data and ad_personalization have to be granted for personalized advertising to work.

One documentation gap is worth watching. Google's remarketing pages still list activating Google Signals, or user-provided data collection, as a requirement to populate audiences for web remarketing, and the troubleshooting page repeats it. The data controls page has narrowed what the Signals setting does. Both can be true at once, but until the remarketing pages are updated, test the behaviour on your own property instead of telling a client that Signals has become optional.

The UK compliance angle

The Information Commissioner's Office published the final version of its storage and access technologies guidance on 29 April 2026, rewritten for the Data (Use and Access) Act 2025. Three points from it matter here.

Online advertising requires consent. That covers the technical processes of ad selection and delivery as well as the tracking and profiling around them. The ICO is explicit that advertising is not strictly necessary, because a service can be provided without it.

Advertising measurement does not require a separate consent, because the regulator treats it as intrinsically linked to the purpose of online advertising. If you have consent for advertising, measurement comes with it.

Consent has to hold across the chain. Where data goes to third parties, people must be told who receives it and why, and the route for withdrawal has to be passed on.

Put that beside the June change and the implication is direct. For a linked property, the banner is now the only gate on the Ads side of the chain. A consent tool that grants ad_storage before a choice, or one that never sets ad_personalization at all, produces different Ads outcomes today than it did in April.

What to check this week

Open the banner and deny marketing, then confirm in Tag Assistant or the GTM preview that ad_storage, ad_user_data and ad_personalization all report denied. The mapping from banner categories to consent parameters is where most setups break, and it broke quietly in June.

Open Admin, Product links, Google Ads links, and check the Enable Personalized Advertising state on every link. It is on by default.

Open Admin, Data collection, Advanced settings to allow for ads personalization, and read the regional switches. A region switched off keeps users out of every exported list, while lists already exported are unaffected, which makes the effect easy to misread.

Compare the data retention setting against the 26-month default for Signals data. If retention is shorter, that is the clock that applies.

Compare remarketing list sizes across the change. A property with Signals off and consent granted should have gained data on the Ads side, not lost it. Falling sizes point at the consent signal, not at the Signals setting.

Diary the personalization change. Exact dates are unpublished, so the useful action is to know which properties have personalization enabled at link level and which events are marked as not for personalization.

What to tell the client

Two sentences cover it. Google moved the switch that controls whether Google Ads can collect advertising cookies from Analytics into Consent Mode, so the banner now governs the ads side of the chain. A second change later this year puts ads personalization under the same logic, and we will review the link settings before then.

Then the honest caveat. Nothing in the reports should have moved on its own in June. If remarketing list sizes did move, the cause sits in the consent implementation, and that is worth finding now rather than after the next change.