Since September 22, 2023, Quebec’s Law 25 requires cookies and other technologies that identify, locate or profile a visitor to stay off until the visitor turns them on. Google’s Consent Mode v2 passes that choice on to Google Analytics and Google Ads. One is a legal obligation, the other a technical mechanism: your website needs both.
Two rules, one banner
You installed a cookie banner for Law 25. Then someone told you that you also had to “turn on Consent Mode v2”. Are they the same thing? No. And mixing them up is costly, either way.
Law 25 is a Quebec law. It sets out what you owe your visitors: tell them before you track them, and let them choose.
Consent Mode v2 is a Google mechanism. It tells your Google tags what the visitor chose, so they can comply. Google asks advertisers to pass on this consent for traffic from the European Economic Area, under its EU user consent policy. In Quebec, the law is what requires you to respect a refusal. Consent Mode is the cleanest way to make Google Analytics and Google Ads respect it.
The banner collects the choice. Consent Mode passes it on. You need both.
What Law 25 requires of your website
Section 8.1 of the Act respecting the protection of personal information in the private sector covers any technology that can identify, locate or profile a person. Anyone who uses one must inform the person beforehand of its use and of the means available to activate those functions. Activate: the functions are off to begin with. That is how lawyers have read the provision since it came into force on September 22, 2023 (McCarthy Tétrault).
Quebec’s privacy regulator, the Commission d’accès à l’information (CAI), sets the ground rules in its Guidelines 2023-1. Consent must be manifest, free, enlightened and given for specific purposes. Giving consent must be as easy as declining it. Pre-checked boxes, or consent inferred from a person’s silence, do not count.
In practice, your website must:
- set no analytics or advertising cookies before the visitor chooses;
- show a “Reject” button as visible as the “Accept” button;
- allow a choice by category, explaining what each cookie is for;
- let visitors change their mind at any time, for example through a footer link.
The penalties are real. Administrative monetary penalties can reach 10 million dollars or 2% of worldwide turnover for the preceding fiscal year, and penal fines 25 million dollars or 4%, whichever is greater (McCarthy Tétrault, September 22, 2023).
One clarification: we are measurement specialists, not lawyers. For your own situation, check your choices with your legal counsel.
What Consent Mode v2 does
Consent Mode sends Google four signals, each granted or denied:
- ad_storage: cookies related to advertising;
- analytics_storage: cookies related to analytics, such as visit duration;
- ad_user_data: sending user data to Google for advertising purposes;
- ad_personalization: personalized advertising.
Google asks that your website load a default state for these four signals before any tag runs. In Quebec, that default state is “denied”.
There are two ways to implement it, and they do not have the same consequences.
- Basic mode. Until the visitor accepts, Google tags do not load. According to Google, no data is sent at all, not even the consent status.
- Advanced mode. Tags load, but without cookies while consent is denied. They send Google cookieless signals, which Google uses to model what it cannot see.
Basic mode is the most cautious. Advanced mode gives better numbers, but it sends data to Google even after a refusal. Make this choice with your legal counsel, knowing what each option costs in data.
A recent change makes this more pressing. Since June 15, 2026, Google Analytics uses Consent Mode as the single control for the data used by Google Ads, according to Google Analytics Help. Google has announced the same consolidation for ad personalization later in 2026. A misconfigured Consent Mode now weighs directly on what Google Ads receives from your Analytics property. Learn more: our performance marketing approach.
What your data no longer tells you
When a visitor declines, they partly drop out of your reports. Google fills part of the gap with modeling, but not for everyone.
- In Google Analytics 4, behavioral modeling requires at least 1,000 events per day with analytics_storage denied, for at least 7 days, and at least 1,000 daily users with consent granted, for at least 7 of the previous 28 days (Google Analytics Help). Even then, Google does not guarantee eligibility.
- In Google Ads, conversion modeling requires 700 ad clicks over a 7-day period, per country and domain grouping (Google Ads Help).
If your website does not reach these thresholds, your reports only show visitors who accept. And those visitors are not representative: according to Google, consenting users are typically 2 to 5 times more likely to convert than others. A conversion rate calculated on them alone does not describe your traffic as a whole.
Three habits to adopt:
- Write down the date your banner went live. A drop in users from that day on is a drop in measurement, not necessarily a drop in traffic.
- Keep benchmarks that do not depend on your cookies. Google Search Console clicks, your store’s orders and your CRM’s sales are counted without analytics cookies on your website.
- Compare like with like. A month before the banner and a month after are not comparable unless you say so.
Check your website in 15 minutes
- Open your website in a private browsing window. Before clicking anything, look at the cookies in your browser’s developer tools: no Google Analytics cookie (those starting with _ga) should appear.
- Run Google’s Tag Assistant on your website. The first consent event should show the four signals, with their default state, before any tag.
- Click “Reject”, then check the update event and the tags tab: tags should behave according to that choice.
- Compare the two buttons on the banner. If rejecting takes two clicks and accepting takes one, declining is not as easy as accepting.
- If your store runs on Shopify, set up the customer privacy settings by region. Shopify states that data sent to Google is not used for personalized advertising unless Consent Mode v2 is activated and valid consent is obtained. Learn more: our eCommerce services.
The way we see it
We would rather have a smaller number that is true than a flattering dashboard. A compliant banner lowers the numbers you see in your reports. It is your reports that change, not necessarily your business.
Our job: wire consent properly, document what your reports now measure, and base your decisions on solid sources, such as your orders, your leads and your revenue. That is how we see things, and we will not change. Learn more: our analytics approach.
Compliance. Rigor. Results.
Frequently asked questions
Is Consent Mode v2 mandatory in Quebec?
Law 25 does not name any tool: it requires technologies that identify, locate or profile to stay off until the visitor turns them on. Google, for its part, asks advertisers to pass on consent for traffic from the European Economic Area. In Quebec, Consent Mode is therefore the simplest way to make your Google tags respect the visitor’s choice.
Basic or advanced mode: which should you choose?
Basic mode loads no Google tag before the visitor accepts: it is the most cautious. Advanced mode sends Google cookieless signals even after a refusal, which enables modeling. The right choice depends on your legal reading and your traffic volume: below Google’s thresholds, modeling does not kick in.
Why did my users drop in GA4 after adding the banner?
Because visitors who decline are no longer counted the same way. In basic mode, they disappear from your reports. In advanced mode, they only come back if your property reaches the modeling thresholds: at least 1,000 events per day with consent denied and 1,000 daily users with consent granted.
How do I check that my Consent Mode works?
With Google’s Tag Assistant. The first consent event should load a default state for all four signals (ad_storage, analytics_storage, ad_user_data, ad_personalization) before any tag. Then click “Reject” and check that the update follows your choice, and that tags behave accordingly.
What if my website runs on Shopify?
Shopify offers customer privacy settings and a consent banner that can be configured by region. According to Shopify, data sent to Google is not used for personalized advertising unless Consent Mode v2 is activated and valid consent is obtained. So configure these settings correctly, then check the result with Tag Assistant.
This article provides general information and does not constitute legal advice.
Further reading
- Analytics
- CRO: conversion rate optimization
- Performance marketing
- HubSpot AEO: how to read mentions, citations, sentiment and share of voice
Further reading: what Quebec’s Law 25 requires when an AI agent makes a decision on its own, in What is an AI agent, and what it really does for a small business.
