Most advertisers believe they are measuring their website traffic. In reality, since GDPR, most are measuring the minority of visitors who click “Accept” on a cookie banner — and quietly ignoring everyone else. That gap doesn’t just distort your reports. It starves the algorithm that spends your budget.

We found this on our own site. Checking Google Analytics against a cookieless source over the same week, GA4 was recording roughly one in eight of our real visitors. The other ~88% were browsing, converting, and entirely relevant to bidding — and completely unmeasured. If it can happen to a team that builds AI ad systems for a living, it is almost certainly happening in your account.

Why the gap exists

Under UK GDPR and PECR, you need consent before setting non-essential cookies — which includes the cookies Google Analytics and the Google Ads tag rely on. So every compliant site shows a consent banner, and a large share of visitors never engage with it: they ignore it, dismiss it, or simply start using the site.

What happens next depends on a setting most teams never deliberately chose: Consent Mode.

  • In Basic Consent Mode, Google’s tags are held back entirely until a visitor consents. Decline or ignore the banner, and nothing is sent. That visitor — and any conversion they make — is invisible to Google Analytics and to Google Ads.
  • In Advanced Consent Mode, the tags still load with consent defaulted to denied, but they send cookieless pings for everyone. Google then uses those anonymous signals to model the conversions and behaviour of the people who declined.

The difference is enormous. Basic mode means you only ever see the consenting minority. Advanced mode lets Google reconstruct most of what the rest were doing. Many accounts are on Basic without realising it — and a banner that is small and easy to ignore makes the consenting share even smaller.

Why this wrecks paid performance specifically

A reporting gap is annoying. A bidding gap is expensive. Smart Bidding — Maximise Conversions, Target CPA, Target ROAS — learns from the conversions your account records. When most conversions are never recorded, three things go wrong at once:

  1. The bidder is starved. With only a fraction of conversions visible, the algorithm has thin, biased data to learn from. In the extreme — a new campaign with no recorded conversions at all — Smart Bidding can’t bid, and the campaign barely serves. (We’ve diagnosed exactly that failure mode on live accounts.)
  2. Budget flows to the wrong places. If the consenting cohort behaves differently from the silent majority — and it usually does — the algorithm optimises toward a skewed slice of your audience, quietly misallocating spend.
  3. ROAS is under-reported. Conversions you never measured can’t be attributed, so your reported return looks worse than reality. Teams cut campaigns that are actually working, because the data says they aren’t.

None of this shows up as an obvious error. The account keeps spending. The dashboards keep populating. They are just populating with a fraction of the truth — and the automation is making real budget decisions on top of it.

The fix is not a more aggressive banner

The instinctive reaction is to make the cookie banner harder to ignore, or to force a choice before anyone can use the site. Resist it. A cookie wall — gating access on acceptance — is considered non-compliant under UK GDPR because consent must be freely given, and an intrusive interstitial adds friction precisely where first impressions matter most, increasing bounce on the visitors you paid to acquire. You would be degrading the user experience to recover data you can get a better way.

The better fix has three parts:

  • Switch to Advanced Consent Mode. Configure your Google tags to load on every page with consent defaulted to denied, sending cookieless pings, and add ads_data_redaction and url_passthrough so ad identifiers are handled compliantly and click attribution survives. This recovers the modelled data with no change to your banner.
  • Add a cookieless second source of truth. A privacy-first analytics tool that doesn’t require consent (and so isn’t subject to the same gap) gives you an honest baseline to measure the size of your undercount and sanity-check Google’s modelling.
  • Strengthen first-party signals. Enhanced Conversions and server-side/offline conversion import close the loop to real revenue for the conversions that do come through, improving the quality of what the bidder learns.

Together, these feed Smart Bidding something much closer to your whole audience — without a single dark pattern.

How to check your own account in ten minutes

  1. Inspect the tag. Is your Google tag configured only after the banner is accepted (Basic), or does it load on every page with denied defaults and ads_data_redaction/url_passthrough (Advanced)? In Google Ads, conversion actions flagged “Consent mode: basic” are the tell.
  2. Measure the gap. Compare your Google Analytics sessions against a cookieless source for the same window. The ratio is, roughly, your consent rate — and the inverse is how much you’re flying blind.
  3. Read the bidding impact. Look for conversion actions with far lower volume than traffic implies, campaigns stuck in “learning”, or strong-performing campaigns that look weak only in platform-reported ROAS.

If those checks make you uneasy, that’s the point — and it’s fixable fast. Tracking integrity is the foundation everything else in value-based bidding and Performance Max is built on. Get it wrong and the most sophisticated bidding strategy in the world is optimising toward a shadow of your audience.

This is the first thing our AI Paid-Ads Audit checks — because you can’t optimise spend you can’t see. We run the same diagnosis on our own account every day. If you’d like a quick read on where you stand, the 60-second Account Health scorecard on the audit page is the fastest place to start.