Cookieless Tracking in GA4: How to Set It Up

Olamide Sule, founder of Dolphin Analytics: a digital analytics expert based in London delivering solutions for agency and in-house clients.

Cookieless tracking in GA4 is not a separate product you switch on. It is what GA4 does when a visitor declines cookies and your tags are set up to keep measuring anyway. We configure this for agency and in-house clients most weeks, and the walkthrough below is the one we give them: what GA4 actually sends without cookies, the exact settings in Google Tag Manager and GA4, and the checks that prove it works.

We cover the cookieless side only here. If you still need to wire your cookie banner into Google’s consent signals, start with our Google Consent Mode v2 setup guide, then come back here.

What is cookieless tracking in GA4?

Cookieless tracking in GA4 is measurement that carries on after a visitor declines analytics cookies. GA4 normally identifies users with two first-party cookies, _ga and _ga_<container-id>, which Google’s cookie usage page lists with a two-year expiry. When consent for analytics storage is denied, GA4 stops using them and sends anonymous pings instead.

The same Google cookie page states that the GA4 libraries “do not require you to set cookies to transmit data to Google Analytics”. It lists _ga as the cookie “used to distinguish users” and the second as the one that persists session state. Take them away and GA4 still hears that a page was viewed, but it loses the link between one pageview and the next.

“Cookieless” also gets used for two other things that are not GA4 settings: the decline of third-party cookies in browsers, which our post on third-party cookies and ITP covers, and separate cookieless analytics tools, which we compare in GDPR-compliant analytics tools. This guide stays with GA4.

How does cookieless tracking work in GA4?

GA4’s cookieless tracking works through advanced Consent Mode. When analytics_storage is denied, Google’s Consent Mode help page for GA4 says the tag “will not read or write first-party analytics cookies” and sends cookieless pings instead. GA4 then feeds those pings into behavioural and conversion modelling to estimate what the declined visitors did.

The ping is deliberately thin. Google’s Consent Mode concepts page lists functional information such as the timestamp, user agent and referrer, plus the consent state itself. The GA4 Consent Mode help page adds screen resolution and IP address to that list, and states that Google Analytics does not store or log IP addresses.

Only advanced mode sends these pings. The same concepts page describes the split:

	Basic Consent Mode	Advanced Consent Mode
When tags load	Only after the visitor interacts with the banner	As soon as the page opens, with default consent states
What a decline sends	Nothing	Pings without cookies
Modelling Google applies	General model (less detailed)	Advertiser-specific model (more detailed)

So if your goal is cookieless tracking in GA4, basic mode is the wrong starting point. Basic mode sends nothing from a declined visit and leaves nothing to measure.

How do you set up cookieless tracking in GA4?

Setting up cookieless tracking in GA4 takes five steps: load denied defaults before any tag, let the GA4 tag fire under them, add the ad-click options, switch GA4 to Blended reporting, and verify. The work sits in Google Tag Manager (GTM) and GA4 Admin; there is no cookieless toggle in GA4 itself.

Step 1: Load denied defaults before any Google tag

Advanced mode depends on the default consent state being set before the GA4 tag reads it. In GTM, put your CMP (Consent Management Platform, the tool that shows the banner) template on the built-in Consent Initialization trigger. Google’s GTM consent documentation describes that trigger as one that “will always fire before all other tags”.

If you use gtag.js directly, the default command from Google’s Consent Mode setup guide goes above the Google tag snippet. The guide documents wait_for_update as the number of milliseconds tags wait for the banner to update consent:

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('consent', 'default', {
    'ad_storage': 'denied',
    'ad_user_data': 'denied',
    'ad_personalization': 'denied',
    'analytics_storage': 'denied',
    'wait_for_update': 500
  });
</script>

The full CMP mapping (which banner category updates which signal) is in our Consent Mode v2 guide, so we won’t repeat it here.

Step 2: Let the GA4 tag fire on a denied state

The GA4 tag has to load on a declined visit for the ping to exist. The setting that most often stops it lives in GTM, and it is the fault we find most when we open a container. Go to Tags > [your Google tag or GA4 event tag] > Advanced Settings > Consent Settings. Google’s GTM consent documentation explains that Require additional consent for tag to fire means the tag “will only fire if the status of all specified consent types are ‘granted’”.

Add analytics_storage there and you have rebuilt basic mode by hand: the tag stays silent on every decline and no ping goes out. Google Analytics tags already carry built-in consent checks, according to the same GTM page, so set GA4 tags to Not set or No additional consent required and let those checks do the work.

To check every tag at once, enable the consent overview: Admin > Container Settings > Additional Settings > Enable consent overview. Then go to Tags and click the Consent Overview icon. Google’s GTM consent page says the screen groups tags into “Consent Not Configured” and “Consent Configured”, which makes a stray requirement on a GA4 tag easy to spot.

Pixels outside Google’s list of tags with built-in checks (Meta, TikTok, LinkedIn) are a different case. For those, the same GTM page describes Require additional consent for tag to fire as the way to hold a tag until the consent types you name are granted, so tie them to ad_storage.

Step 3: Keep ad-click measurement with url_passthrough

A declined visit also affects Google Ads, because ad_storage controls advertising cookies. Google’s Consent Mode setup guide documents url_passthrough, which passes click identifiers such as gclid and _gl through URL parameters across pages instead. The same guide documents ads_data_redaction, which redacts ad click identifiers in Google Ads and Floodlight requests while ad_storage is denied. With gtag.js, both are single set commands:

<script>
  gtag('set', 'url_passthrough', true);
  gtag('set', 'ads_data_redaction', true);
</script>

In GTM, check your CMP template’s settings before adding a Custom HTML tag for these. If the template already sets them, a second tag just gives you two sources for the same value.

Step 4: Switch GA4 Reporting identity to Blended

Modelled users only appear in GA4 reports under the Blended reporting identity. Go to Admin > Data display > Reporting identity and choose Blended. Google’s reporting identity page defines Blended as “By User-ID, device ID, then modeling” and states the choice “does not affect data collection or processing”, so you can switch back at any time.

Step 5: Verify the cookieless pings in Tag Assistant

Open Tag Assistant, connect your site, and decline the banner. Google’s consent debugging guide says to select the earliest Consent event, open the Consent tab and read the On-page Default column, then select the most recent Consent event and read On-page Update. The same guide notes the Consent tab is empty when consent mode is not implemented at all.

On a decline, analytics_storage should read denied in both columns, and your GA4 tag should still show as fired. Then check your browser’s cookies. Because a denied tag won’t write first-party analytics cookies, no _ga cookie should exist for that session. If the tag did not fire, step 2 is the likely cause. If _ga appeared before you answered the banner, your default is loading too late or is set to granted.

When does GA4 start showing modelled data?

GA4 only models declined visitors once the property clears Google’s thresholds. Google’s behavioural modelling page requires at least 1,000 events a day with analytics_storage denied for at least 7 days, and at least 1,000 daily users with analytics_storage granted for at least 7 of the previous 28 days. Meeting those numbers does not guarantee eligibility; the model also has to pass Google’s quality checks.

The second threshold matters for anyone planning a fully cookieless GA4 setup. Google’s modelling documentation says the model learns from visitors who accepted cookies. If every visitor stays denied, there are no consented users to learn from, so the property cannot meet that requirement.

Modelled data also has hard limits. The same Google page lists where it never appears:

• Audiences
• User explorer, cohort and lifetime explorations
• Segments containing sequences
• Retention reports
• Predictive metrics
• BigQuery exports

That last one catches data teams out. Standard reports under Blended identity include modelled users, while the raw BigQuery export only holds what was observed, so the two will not match.

Does server-side tagging make GA4 cookieless?

No. Server-side tagging changes where your data is processed, not whether consent applies. Google’s server-side tagging overview describes it as processing data “on a server you control, rather than in the user’s browser”, with the data visible only to you until you send it on.

On consent, Google’s server-side consent mode page says the Google tag adds consent parameters to each request, and that Google product tags in the server container are consent-aware. Under basic mode with analytics_storage denied, no Analytics cookies are set, accessed or read “both on the client and server”. You configure consent in the web container; the server container follows it.

Where server-side tagging does help is control: you decide what leaves your server and where it goes. Our server-side tracking setup guide walks through the build if you need it.

Can the Measurement Protocol replace cookie-based tracking?

No. The GA4 Measurement Protocol sends events from your server straight to Google Analytics, but Google’s Measurement Protocol documentation says it exists “to augment automatic collection through gtag, Tag Manager, and Google Analytics for Firebase, not to replace it”. The same page says you must use tagging to use it at all.

The protocol joins its events to online activity through a client_id, which the Measurement Protocol reference says comes from your tagging. It is useful for events a browser cannot see, like an offline sale or a subscription renewal. It is not a way to track visitors without a tag. Our Measurement Protocol explainer covers when it earns its place.

Does cookieless tracking mean you don’t need consent?

Not automatically. A cookieless ping still sends data from the visitor’s device, and whether your setup needs consent depends on the law where your visitors are and how you configure it. In the UK, the ICO’s guidance on storage and access technologies sets out the exceptions and the conditions each one carries.

We treat cookieless tracking as a way to measure better inside a compliant consent setup, never as a way around one. Confirm your position with a data protection specialist before you change defaults.

How we set up cookieless tracking for clients

Most cookieless setups we inherit look right in the CMP and fail in GTM: a consent requirement on the GA4 tag, a default that loads after the Google tag, or a basic-mode toggle nobody changed. We check each of those in the container, confirm the pings arrive in Tag Assistant, and set GA4 up to report modelled users once the property qualifies. Getting tracking right has real stakes for agencies: for Bolt Marketing and its client Smallwood Wealth Management, we fixed the tracking, so the agency could see what was actually happening in Meta, and they kept their client.

To see what consent setup your site exposes today, run a free Sonar scan: one click, no account, and it reports the tags, pixels and consent setup it can prove from the outside. For the wider tracking work, see how we approach tracking and consent. Or tell us what’s broken, or book a call.

This page is general information about analytics configuration, not legal advice.