GA4 Cookieless Tracking: How It Actually Works (and What You Need to Set Up Now)

Google Analytics 4 has no cookieless mode. It never needed one — GA4 tracks with first-party cookies, not the third-party ones everyone’s worried about.

“GA4 cookieless tracking” describes one specific situation: what happens to your data when a visitor declines your cookie banner. Here’s what Google actually does about it, and what you need to set up.

Most guides on this topic still open with “third-party cookies are going away” and build a whole setup process on that premise. It stopped being true in 2025 — and it was never really about GA4 to begin with.

If visitors are declining your banner, you’re probably wondering how much traffic you’re missing — and whether GA4 is hiding that from you. It isn’t, but it only tells you in one place most people never check. This post shows you which of two tracks your site is on, and exactly what to do about it.

In This Article:

What Google Analytics 4 Cookieless Tracking Actually Means (and What It Doesn’t)

“Google Analytics 4 cookieless tracking” sounds like a feature you switch on. It isn’t. There’s no cookieless mode, no cookieless setting, and no button labeled “cookieless” anywhere in GA4’s admin panel.

Google Analytics 4 tracks with first-party cookies — mainly _ga and _ga_<container-id> — and it always has. It has never relied on third-party cookies, so the “cookies are disappearing” framing that opens most articles on this topic was never really about GA4 to begin with.

For a refresher on what a cookie actually is and how first-party and third-party cookies differ, see our guide to cookie basics.

What “cookieless tracking” really refers to is one specific scenario: what happens to your data when a visitor declines that consent banner. That’s the entire scope of the term, and it’s what the rest of this guide covers. Here’s a real example of the kind of banner in question, from an ecommerce site:

That “Decline” button is the entire trigger for everything the rest of this article covers. Click “Accept” and GA4 tracks that visitor normally. Click “Decline,” and you’re now in cookieless-tracking territory.

What Changed for GA4 Cookieless Tracking in 2025

On April 22, 2025, Google confirmed it’s keeping third-party cookie choice in Chrome — no forced phase-out, no new popup asking permission. Chrome’s existing privacy settings handle it, the same as before.

Then on October 17, 2025, Google shut down most of the replacement technology it had spent years building to make third-party cookies unnecessary in the first place. Only a few minor, low-profile pieces survived.

Most articles on this topic don’t mention either date — plenty are still repeating an older announcement from July 2024 that Google reversed nine months later.

None of this actually changes anything about GA4 itself, since it was never built on third-party cookies to begin with. But it does mean the whole premise behind most “cookieless tracking” advice was already out of date.

With that cleared up, here’s what actually happens the moment someone clicks “decline” on your site.

How GA4 Cookieless Tracking Works: What’s Actually in a Cookieless Ping

When a visitor declines your cookie banner, GA4 doesn’t just give up. If you’ve set up advanced consent mode, it still sends what Google calls a “cookieless ping” every time that visitor loads a page or triggers an event.

Here’s what’s actually inside one of those pings, according to Google’s own documentation:

• Timestamp, browser user agent, and referrer
• Whether the current page or an earlier page in that visit carried ad-click info in the URL
• A true/false flag for consent state
• A random number, regenerated on every single page load
• The Developer ID of whatever consent management platform (CMP) the site is using

Notice what’s missing from that list: no client ID, no user ID, nothing that persists from one page load to the next. A random number that resets every page load is the opposite of an identifier — which is exactly why GA4 can’t tell whether ten pageviews came from one visitor or ten without help from a modeling system.

One thing that ping doesn’t erase: your server still receives the visitor’s IP address, because that’s simply how HTTP requests work. Google publishes documentation on IP usage — the ping just doesn’t carry a persistent ID, which is the part that actually matters for measurement.

The Two Kinds of Modeling Behind GA4 Cookieless Tracking

Once GA4 has those pings, it has to turn them into something you can actually read in a report. That’s where modeling comes in — and mixing up how it works is an easy way to think your site is covered when it isn’t.

There are two separate systems here, not one. One runs automatically on every property, whether you’ve set anything up or not. The other might never switch on, no matter what you configure — and it’s the one most of this article is actually about. Most articles on this topic treat the two as interchangeable. They aren’t.

Modeled Key Events: Automatic Since 2021

GA4 has been modeling key events automatically since around the end of July 2021. There’s no setup, no toggle, and no published threshold — it just runs.

The catch shows up on low-traffic sites: when there isn’t enough data to model confidently, that credit doesn’t disappear. It lands in the Direct channel instead, which is one reason your Direct traffic numbers might look inflated.

Attributed key event data can also keep updating for up to 12 days after it’s first recorded, so don’t read too much into last week’s numbers shifting slightly this week.

Behavioral Modeling: GA4’s Gated Cookieless Tracking System

Behavioral modeling is the bigger system — it estimates users, sessions, and new users for the people who declined. Unlike modeled key events, it’s locked behind published thresholds, and most small WordPress sites won’t clear them.

The next section walks through exactly what those thresholds are. Worth keeping separate before you get there: one system is automatic and always on, and the other only switches on once your site is big enough.

GA4 Cookieless Tracking Requirements: The Thresholds Google Publishes

Here’s what’s actually riding on these thresholds: clear them, and GA4 quietly fills in the gaps left by visitors who declined. Miss them, and that traffic just disappears from your reports with no explanation — which is exactly the scenario this article opened with.

Behavioral modeling doesn’t switch on just because you have consent mode running. Google publishes four specific conditions, and your property has to clear all of them.

Here’s exactly what’s required, word for word:

• Consent mode is enabled across every page and app screen
• Consent mode is set up in advanced mode, so tags load immediately and send cookieless pings even when a visitor declines — basic mode blocks tags outright, so it can’t produce this data at all
• At least 1,000 events per day with analytics_storage set to “denied,” for at least 7 days
• At least 1,000 daily users sending events with analytics_storage set to “granted,” for at least 7 of the previous 28 days

Notice the units aren’t the same on both sides — one threshold counts events, the other counts users. Get that backwards and you’ll misjudge how close your site actually is.

Clearing all four doesn’t guarantee anything, either. Google’s documentation says plainly that meeting these numbers “doesn’t guarantee eligibility because the underlying machine learning model follows a set of eligibility criteria and data thresholds,” including things like the ratio of new to returning users.

Google goes further, in its own documentation: even hitting the threshold for more than 7 days, “it’s possible that even the additional data won’t be sufficient for Analytics to train the model.” In plain English — some sites will never qualify, no matter how long they wait.

How to Check If Your Site Qualifies for Cookieless Tracking in GA4

Before you set anything up, it’s worth finding out whether your site has any shot at qualifying. GA4 does tell you — but only in one spot, and only if you know to look there.

Head into your GA4 property, open Admin, and under Data display, click Reporting identity. Most sites default to “Observed,” which only shows data from visitors who consented.

Switch it to Blended, just temporarily — Google’s own guidance states this “does not affect data collection or processing,” and that you “can switch between the options at any time without making any permanent impact on data,” so nothing breaks if you flip it back later.

Once you’re on Blended, look at the data-quality icon on your report.

On a property that qualifies, it reads something close to “Including estimated user data” — a sign the modeling described above is actually running.

That’s the icon and tooltip straight from Google’s own documentation for this feature — yours will look the same, just with a different message if your property doesn’t qualify.

If your property doesn’t clear the thresholds, that same icon instead reads: “Your property doesn’t meet the eligibility criteria to use estimated data.” That’s the sentence you’re actually looking for — it’s GA4’s one honest admission that a chunk of your traffic isn’t being counted.

You might also notice a separate “Consent settings” surface under Admin → Data collection and modification. It’s worth checking that your consent signals are configured correctly there, but don’t mistake it for a second eligibility check — it reports setup status, not a count of denied events.

The data-quality icon under Blended is the only place in the standard GA4 interface that actually tells you whether you qualify.

One thing GA4 won’t hand you directly: an actual “X denied events per day” number. There’s no report or dimension for that anywhere in the standard interface.

The closest you can get is a rough estimate — take the decline rate your cookie consent tool reports, and multiply it by your average daily events. If that math clears 1,000 a day, your site is in the range worth checking the icon for.

Once you’ve read the icon, don’t leave your reporting identity sitting on Blended by accident. The next two sections walk through exactly where to leave it, depending on which track you’re on.

How to Set Up Cookieless Tracking in Google Analytics 4 (If You Qualify)

If your traffic clears the thresholds above, here’s what actually needs to be in place before behavioral modeling can turn on.

Start with your consent banner. Google’s own wording is explicit: “consent mode does not provide a consent banner or widget” — it works with whatever banner you already have. If you don’t have one yet, our consent banner guide covers the setup.

Next, confirm your consent mode implementation is set to advanced, not basic. Under basic mode, Google’s tags stay blocked until a visitor answers the banner, and “no data is transferred to Google at all, not even the consent status” — so there’s nothing for behavioral modeling to work with.

Advanced mode lets the tag load right away and send cookieless pings while consent is still pending, which is the entire mechanism this article is built around.

Not every consent plugin makes this obvious to check. However, WPConsent makes it easy — it ships with Google Consent Mode v2 already set to advanced mode by default, so if that’s what’s running your banner, there’s a good chance this box is already checked for you.

Here’s what that banner actually looks like on a live WPConsent install:

And here’s the Google Consent Mode toggle itself — one switch, on by default:

That single toggle is doing the work described above.

If you manage your GA4 tag through Google Tag Manager rather than through MonsterInsights, the WordPress analytics plugin, our guide on GA4 and Tag Manager covers where that setting lives.

Then set your reporting identity to Blended — the same screen from the previous section. That’s where modeled data actually shows up once your property qualifies.

This last check is more technical than anything else in this guide, so feel free to skip it if poking around your browser’s built-in tools isn’t your thing — the setup above already works without it. But if you want hard proof, here’s how to see it for yourself.

Every browser has a built-in inspector called DevTools. Right-click anywhere on your site and choose “Inspect” to open it, then click over to its Network tab. Browse your site in a private window, decline the banner, and look for a request to /g/collect — that’s the cookieless ping actually firing.

You don’t need to decode everything about that request. If you’re curious, though, it carries a parameter called gcs, and a value starting with G100 means both consent signals came back denied — exactly what you want to see after clicking “decline.”

Two more things worth a quick look, both optional: the Application tab should show no _ga cookie written for that request, and GA4’s DebugView should show the ping arriving as a live event, even with no cookie attached to it.

Once you’ve confirmed that, you’ve done everything on your end. Whether modeling actually turns on from here is Google’s call, not yours, and it can take longer than you’d expect.

What to Do If You’ll Never Qualify for GA4 Cookieless Tracking

If the math above doesn’t come close for your site, that’s not a failure on your part. It’s most WordPress sites. Here’s what’s actually worth doing about it.

Leaving advanced consent mode running is worth doing anyway. Even if behavioral modeling never turns on, modeled key events — the automatic system from earlier in this guide — still works on any amount of traffic. You lose nothing by leaving it on, and you keep the door open in case your traffic grows into the thresholds later.

Where you leave your reporting identity is worth deciding on purpose, instead of wherever the self-check left it. Observed keeps your reports stable — no sudden jump in numbers if modeling ever does switch on, and you’re only ever looking at real, consented visitors.

Blended keeps that eligibility message visible, so you’ll actually notice the day your property qualifies, but your reports will shift on that day without warning. Google says switching between the two doesn’t affect data collection either way, so there’s no wrong choice — just a tradeoff between stability and visibility.

Your numbers are more useful for direction than for headcount. Your sessions figure isn’t the complete picture, and never will be for a smaller site — so it’s the trend that’s worth watching, whether it’s moving up or down, rather than treating the total as a hard number.

Your UTM hygiene is worth fixing, too. A meaningful share of what looks like a “consent problem” is actually a tagging problem — campaign links without proper UTM parameters get credited to Direct for the same underlying reason cookieless pings do: GA4 can’t tell where the visit came from.

Our beginner’s guide to UTM parameters walks through tagging links correctly, and it’s one of the few fixes here that’s entirely in your control.

The reports you already trust are still worth leaning on. The traffic that did consent is still real, accurately counted, and worth acting on — that’s not a diminished version of your data, it’s simply the version you have.

None of this is a workaround for a legal requirement, and it isn’t meant to be. You still need a GDPR-compliant setup regardless of what GA4 can or can’t model.

What Cookieless Tracking Changes in Your GA4 Reports

Turning any of this on changes what your reports actually show — and if you don’t know to expect it, you’ll waste time chasing a “bug” that isn’t one, or worse, act on numbers that don’t mean what you think they mean.

Modeled data never reaches every part of GA4. Google’s documentation lists exactly what it skips:

• Audiences
• User explorer, cohort, and user lifetime explorations
• Segments that include a sequence
• Retention reports
• Predictive metrics
• Data export, including BigQuery export

That last one matters if you’ve ever built a Looker Studio dashboard on top of a BigQuery export — it will never contain modeled numbers, no matter how well your property qualifies.

In standard reports, modeling isn’t applied to event counts like page_view, first_visit, or session_start — so when GA4 can’t recognize a repeat visitor, it counts a fresh first_visit and session_start every time that person loads a page. That inflates those specific counts in your reports.

In a path or funnel exploration, though, modeling is applied to those same two events — so first_visit and session_start counts come out lower there than in your standard reports. If you’ve ever compared the two and found the numbers don’t line up, that’s usually why, not a tracking error worth chasing down.

Metrics like bounce rate shift for the same reason once you switch to Blended — you’re suddenly counting sessions from visitors who never consented, which changes the denominator behind that percentage. Expect a jump or a dip the day you flip the setting, not a sign something’s broken.

None of this means your data is wrong. It means GA4 is being upfront about which numbers include an estimate and which don’t, as long as you know where to look.

Why Every Cookieless Tracking “Data Recovery” Percentage Is Made Up

Search this topic and you’ll find a lot of specific-sounding numbers: recovers 20–40% of lost events, captures 70–90% of your data, 70% more accurate insights, results back within one to four weeks. None of them come from Google.

Google publishes exactly two things you can actually cite: the behavioral modeling thresholds above, and one consent-related figure. Consented users convert roughly 2 to 5 times more often than unconsented ones, with Google’s own caveat that “this varies widely depending on factors such as consent rates, industry, and conversion type.”

That’s it. There’s no published recovery rate, no published percentage for how much traffic modeling restores, and no timeline for how long it takes to kick in.

Any number more specific than that is someone’s guess dressed up as a statistic. If a claim about cookieless tracking comes with a suspiciously precise percentage attached, it’s worth double-checking before you build a decision on it.

Cookieless Tracking Methods to Avoid

A few methods show up repeatedly in cookieless tracking advice. They’re worth naming specifically, because each one creates a real compliance risk while sounding like a technical fix.

Fingerprinting and Manufactured Client IDs

Some guides suggest generating a fake identifier for visitors who decline — something like hashing their user agent, IP address, and a timestamp together to create a consistent ID GA4 can track. That’s a shortcut worth skipping entirely.

Google’s own documentation is direct about it: “Google doesn’t allow fingerprint IDs or other attempts to identify individual users.” That’s not a competitor’s opinion — it’s the platform policy you agreed to the moment you started using GA4.

Server-Side Tagging Isn’t Cookieless Tracking

Server-side tagging gets pitched as a cookieless workaround constantly. It isn’t one — it just moves who sets the cookie, from the visitor’s browser to your own server. The cookie still exists, and it’s still subject to the same consent rules.

If you’re weighing a server-side setup against a simpler no-code alternative, our MonsterInsights vs Tag Manager comparison covers the tradeoffs — but this isn’t the section to get into that setup.

Local Storage Isn’t a Consent Workaround

The same logic applies to localStorage and sessionStorage. A persistent ID stored there needs the same consent a cookie does, because consent law applies to storing or accessing information on someone’s device — not to the specific mechanism you use to do it.

Whichever method you’re evaluating, the same question applies: does it identify someone who told you not to identify them? If yes, it’s not a fix — it’s the exact thing you’re supposed to avoid. If you need to stay compliant regardless of what GA4 can or can’t model, see our guide to keeping your analytics CCPA compliant.

GA4 Cookieless Tracking on WordPress: What MonsterInsights Handles

Everything above is Google’s job — GA4 owns cookieless pings, both modeling systems, and the eligibility thresholds. None of it is something a plugin can turn on or speed up. What a WordPress-specific tool like MonsterInsights actually handles is the setup around it.

Getting GA4 connected to WordPress without touching code is where MonsterInsights starts. You connect your property once, and everything covered in this guide works the same way it would with a hand-coded install. Our GA4 WordPress setup guide covers that connection step by step.

Privacy Guard automatically strips personally identifiable information out of your data before it ever reaches Google Analytics, with no manual configuration required. It’s a Plus-plan feature, and it’s worth pairing with our guide on removing PII from GA4 if you want the full picture of what counts as PII in the first place.

If you need broader coverage than PII stripping alone, the EU Compliance Addon adds general GDPR and CCPA compliance support on top of it.

Neither of these replaces your CMP — they don’t decide whether a tag fires, and they’re not a substitute for the banner and CMP setup covered earlier in this guide. They handle what happens to your data on the WordPress side once it’s already collected.

If you’re running GA4 through Google Tag Manager rather than through MonsterInsights, check that Advanced Tracking Settings is set to “Not Active” in Insights → Settings. That’s the correct default for most sites — it just means MonsterInsights isn’t duplicating anything your GTM container is already doing.

And if you’d rather ask a question than dig through your reports yourself, Charlie Chat lets you type something like “why is my Direct traffic so high” in plain English and get a specific answer back, along with a recommended next step. It’s available on every plan.

None of this requires touching GA4’s admin panel at all — it’s all sitting inside the WordPress dashboard you already use.

FAQs About GA4 Cookieless Tracking

Now you know exactly what happens to your data the moment a visitor declines your cookie banner — and what, if anything, is worth doing about it on your end. If you liked this article, check out the following beginner-friendly guides:

• Google Analytics Reports: The Ultimate Guide (GA4)
• Your Ultimate Guide to MonsterInsights Dashboard Reports
• Best WordPress GDPR Plugins to Ensure Your Site is Compliant
• How to Add Google Analytics 4 to WordPress (Best Way)

Follow us on Twitter, Facebook, and YouTube for more Google Analytics tips.