By the Mayab Media Team
If you switched Google Signals off years ago to "be safe," we have bad news. That switch stopped protecting you in June.
Plenty of businesses still think it works the old way. Their privacy policy says so. Their cookie banner assumes it. Neither is true anymore.
What changed
Google spelled it out in its Analytics help article on data control updates. Starting June 15, 2026, Google Analytics uses Consent Mode in Google Ads as the single control over collecting and using Google Ads cookies and identifiers from the tag and SDK. Before that, those choices were split between the Google Signals setting and Consent Mode.
Now Google Signals does one job: linking GA4 data to signed-in Google user info for behavioral reporting inside Analytics. That's it. It no longer limits what flows to Google Ads.
Google's direction is that Ads settings will govern Ads data, including data shared from GA4, while Analytics settings will govern only reporting inside Analytics. And there's more coming. Google says the ad_personalization consent setting will become the only control over whether linked data gets used for personalization in Google Ads, later in 2026. Google also says IP addresses collected by the tag will be encrypted and sent to linked Google Ads accounts. No exact dates for those yet.
PPC Land's analysis puts the practical effect simply. Sites with a properly set up consent platform see no real change. Sites that leaned on Signals being off, with no consent platform, may now send ad cookies they weren't sending before. And it applies to linked GA4 properties globally, not just in Europe.
Why it matters in money terms
There are two ways this costs you.
Legal exposure. If your consent default is "granted" (or you never set one), ad_storage now opens the full advertising data flow. Many US states now have privacy laws with rules on targeted advertising and selling data. Connecticut, for example, lowered its threshold to 35,000 consumers on July 1, 2026. Your privacy policy probably describes Signals as a safeguard. That statement is now wrong. Wrong disclosures are the kind of thing regulators and plaintiffs' lawyers look for.
Bad data in the other direction. If your banner is set up badly and denies consent when it shouldn't (or never sends the "granted" update after someone clicks accept), your remarketing lists shrink and your conversion modeling gets weaker. PPC Land mentions one client whose Google Ads conversions fell about 90% after Google's 2025 consent enforcement in Europe. Only about 40% of that lost data could be recovered later. Broken consent setups don't just create risk. They throw away data you can't get back.
Your 7-step consent check
Most of this takes an afternoon. Grab whoever manages your cookie banner.
-
Load your site as a brand-new visitor. Use an incognito window and Google Tag Assistant. Look at the Consent tab on the first event. Write down the default state for all four signals:
ad_storage,ad_user_data,ad_personalizationandanalytics_storage. -
Decide what your defaults should be, by region. For visitors in the EEA, UK and Switzerland, defaults should be denied. Secure Privacy points out that people often forget to include Switzerland. For US visitors, talk to your lawyer about which states you sell into and set defaults to match.
-
Test "Reject all." Click reject and confirm the update shows all four as denied. Then test "Accept all" and confirm they flip to granted. You'd be surprised how often one of these is backwards.
-
Know whether you run basic or advanced Consent Mode. Advanced mode still sends cookieless pings when consent is denied. That's fine, but your privacy notice should say so.
-
Rewrite any line that mentions Google Signals as an ad-data control. Check your privacy policy, cookie policy and any internal data records. Replace it with an accurate description of how Consent Mode governs ad data.
-
Lock down Google Ads access. Since Ads settings will soon control personalization too, find out who can edit them. Remove old agencies and ex-employees.
-
Re-test monthly. Every new tag, plugin or banner update can break consent signals. Put a recurring 15-minute check on the calendar.
Our take
We think this change is actually cleaner. One control in one place is easier to manage than a toggle in GA4 plus a banner plus guesswork. But simpler only helps if the one control is set up right. For a lot of sites, it isn't.
Takeaway: Google Signals no longer protects your ad data, so your consent defaults are now the whole defense; test them this week.
Want us to check how this affects your tracking? Book a free audit.
