Detecting Consent Mode basic vs. advanced

Advanced keeps sending cookieless pings with the gcs parameter after rejection, basic sends no Google measurement at all. The deep scan reads the mode off the reject state.

What gets tested

The deep scan answers the cookie banner with "Reject" and reads what the Google tag does next. If it sends cookieless pings carrying the consent stamp (gcs parameter), Consent Mode runs in advanced mode. If no measurement goes out, it runs basic, or the CMP blocks the tags entirely. Plain library loads don't count.

Why it matters

The two modes trade data quality against legal risk. Basic drops every piece of Google measurement on rejection; the gap stays visible in your reporting. Advanced keeps sending cookieless pings and lets Google model conversions, and it is exactly these consent-less pings that several supervisory authorities consider problematic. Many setups simply run in whatever mode the CMP default picked, not in one somebody decided on.

Common causes

The CMP set advanced as its default during setup and nobody ever reviewed the preset.
A theme or plugin shipped the gtag snippet with url_passthrough and advanced behavior baked in.
Basic is configured in the CMP, but a second, directly embedded tag bypasses the blocking.
Privacy policy and tag setup were never reconciled: the policy describes a different mode than the tag sends.

The fix

Pick the mode deliberately and write the decision down. Basic is the conservative line. Advanced only after an assessment by your privacy counsel, and then the decision belongs in your privacy policy too. Verify in the network tab: reject the banner, filter for "gcs=", compare the result against the documented decision.

Check it yourself first

The Tracking Check tests this point along with all the others, in seconds.

Start the Tracking Check →

Asked often

What does the "Consent Mode: basic or advanced" finding mean?

The deep scan read from the post-rejection behavior which mode your Consent Mode runs in. This is a note, not a failure: both modes are legitimate setups with different trade-offs between data quality and legal risk.

Is Consent Mode advanced GDPR-compliant?

Legally unsettled. The pings work without cookies but still carry the IP address and request metadata; supervisory authorities differ on whether that requires consent. This decision belongs with your privacy counsel, not in the tag setup.

How do I check the mode myself in the browser?

Open the network tab, reject the banner, filter for "gcs=". Requests with gcs=G100 mean advanced mode. An empty list with no collect requests at all means basic, or a CMP that blocks the Google tags entirely.

The fix, delivered

Wired up in days, not sprints.

Findings from the Tracking Check go into a ranked sequence with effort estimates in the Audit Sprint, every module with an acceptance criterion.

To the service Request an Audit Sprint