What Is Google's Advanced Consent Mode? Is It Defensible Under CIPA?

What Is Consent Mode, and How Do Its Two Modes Differ?

Consent Mode is how Google's tags learn what types of web tracking the visitor has agreed to. The tags receive consent signals, such as whether analytics and advertising storage are granted or denied, and adjust their behavior. Consent Mode has two implementations, and Google's documentation describes both.

The main difference is tag-firing timing. In Basic mode, Google tags do not load until consent is granted. In Advanced mode, the tags load immediately, and if consent is denied (either by default or by explicit preference) they send cookieless pings that Google uses to model the conversions it can no longer directly observe.

Behavior per Google's Consent Mode documentation, as of September 2026.

The Pen Register Problem

CIPA wiretapping letters sometimes lean on Section 631(a), the interception provision, which requires reading or learning the contents of a communication to support a claim. Advanced mode holds up well there. A cookieless ping carries no form input, no search terms, and no identifier tied to a person.

However, some CIPA claims lean on Section 638.51, the pen register provision, which focuses on routing and addressing information rather than contents. The theory is that a script capturing a visitor's IP address and device details is a pen register installed without consent.

The pen register theory fits Advanced mode closely. The ping is a request to Google carrying the visitor's IP address and user agent, and it is sent before the visitor has agreed to anything. Courts have split on whether ordinary web requests can be pen registers at all, but some have allowed the theory to proceed. Plaintiffs rely on that case law, often attaching a network log showing a request to Google on first load, with consent denied and the tracking running in Advanced mode.

What Does Google Say About IP Addresses?

For what it's worth, Google says that it does not keep the IP address. Google Analytics documentation states that in Google Analytics 4, IP addresses are not logged or stored. For the advertising tags, Google's consent mode documentation says that when advertising storage is denied, IP addresses are used to derive a country, are never logged by its Google Ads and Floodlight systems, and are deleted immediately upon collection.

Regardless, these facts are not highly relevant at the demand letter stage. A pen register claim is about the capture of routing information, and the capture happens when the request leaves the browser. What Google does after it arrives is unverifiable to the plaintiff. Google's internal handling of IP addresses is an incomplete and imperfect defense to rely upon.

What to Consider

The use of Advanced Consent Mode should be a business decision. It cannot be made without understanding the business value of the modeling Advanced mode enables and the perceived risk of litigation.

• The value of the modeling. If campaigns depend on modeled conversions, Basic mode has a clear downside. If you do not get business value from the modeled numbers, Advanced mode adds risk without benefit.
• Where the visitors are. California traffic drives CIPA exposure. Other states with all-party-consent wiretap statutes and statutory damages add to it.
• Whether the privacy notice describes the pings. Advanced mode is more defensible when the notice states that Google tags load before consent and what they send when consent is not granted.
• Whether the site works correctly in either mode today. Many sites I review set Google cookies during unconsented states, which is not how either mode is meant to work.

Basic mode, enforced at the script level, is the most defensible position. Advanced mode is a legitimate choice when the modeling is worth it, the notice is accurate, and the business accepts the litigation risk.