Google Consent Mode v2 and KVKK: How Cookie Consent Affects Your Ad Measurement

Setting up a cookie banner is not the same as rejected cookies actually not being written. A banner is an interface; Consent Mode is the technical layer that passes the choice made in that interface to Google tags. If the two are not connected, the banner stays decorative, and ad measurement is either lost unnecessarily or, legally risky, runs more than it should.

First, what does KVKK say?

The Personal Data Protection Authority's “Guide on Cookie Practices” is the main source on this subject in Turkey. In the July 2025 version of the guide, cookies are separated by purpose, and for each it explains which processing condition applies.

Cookies required for the service the visitor asked for to work, such as logging in, filling in a form or remembering the privacy preference, can be used without explicit consent. The guide also stresses separately that these cookies must not be used for marketing. The advertising side works the other way round: cookies used for behavioral advertising require explicit consent. The guide keeps this broad. Purposes tied to advertising, such as frequency capping, ad partnership, detecting click fraud, market analysis and product development, also fall within scope, because none of them relates to a function the visitor explicitly requested.

Analytics cookies are more nuanced. The guide says that first-party analytics used only to measure the site's own performance can, under certain conditions, rely on a processing condition other than explicit consent. The conditions are: the data processed must be limited and proportionate, unnecessary personal data must be anonymized (IP masking is given as an example), and the cookies must not be used for cross-site tracking. Whether a tool like Google Analytics, whose data goes to a third company, falls within this description depends on the configuration. It would be wrong to assume “analytics is free anyway” without clarifying this with a lawyer.

What should the banner look like?

As good practice, the guide indicates that a cookie management panel should appear the moment the site is entered, and that the “accept”, “reject” and “preferences” buttons should be presented equally in color, size and font size. It is also important that cookies requiring consent come pre-unticked, i.e. inactive, in the panel. It is not possible to obtain consent for advertising cookies by attaching it to the terms of use or the privacy notice. Consent is also expected to be easy to withdraw later; for this the guide suggests a small icon in a corner of the page or a thin bar. Instead of asking for consent again on every visit, reminders at intervals proportionate to the cookie's lifetime are considered appropriate.

There is also the matter of transfers abroad. If a site operating in Turkey uses the cookie of a company established abroad, the data transfer made through that cookie must comply with Article 9 of Law No. 6698 and the regulation dated 10 July 2024. The tags of ad networks headquartered abroad, such as Google and Meta, mostly fall within this description.

What does Consent Mode do?

Consent Mode is a mechanism that tells Google tags the choice made in your banner. According to Google's developer documentation there are four consent types:

• ad_storage: Controls whether advertising cookies are written.
• analytics_storage: Determines whether analytics measurement uses cookies.
• ad_user_data: Allows or doesn't allow advertising-related user data to be sent to Google.
• ad_personalization: Carries the consent for personalized advertising.

The last two are signals added with v2. Google's EU user consent policy requires these signals to be shared for users in the European Economic Area. For a site aimed only at Turkey this policy doesn't bind you directly; the obligation comes from KVKK. But the technical benefit is the same: for a visitor who rejects, what the tags do is not left to chance; they behave as Google documents.

The default value is the most critical line

The documentation wants the gtag('consent', 'default', ...) command to run before the measurement commands. In Google's own example all four types are denied at the start. When the visitor makes a choice in the banner, the new state is reported with gtag('consent', 'update', ...). If the banner loads on the page after the tags, the wait_for_update parameter, for example 500 milliseconds, makes the tags wait for the consent update.

One thing to watch: Google's support page says two of the consent types are treated as “granted” by default. In other words, if you configure nothing, the tags run on the assumption of permission. Since under KVKK cookies requiring consent must come switched off at the start, you need to deliberately set the default to denied. It is also possible to define different defaults by region, but for Turkish traffic covered by KVKK, starting with denied is in practice the simplest way.

Basic mode, advanced mode

Google describes two ways of implementing it. In basic mode, Google tags stay blocked until the visitor gives consent. If consent doesn't come, no data is collected and no modeled data is created on the Google Analytics side. In advanced mode, the tags load before the banner appears and, if consent is rejected, send cookieless “pings”. According to Google, these pings cannot directly identify a person on their own and carry coarse event information. On the advertising side, when consent isn't given, conversion modeling falls back on a general model built from general, non-identifying variables such as browser type and time of day.

In its own documentation Google recommends that tags load in every case, i.e. advanced mode, because modeling only works then. But in the parts of the KVKK guide we read, there is no separate provision for cookieless signals. Whether these pings count as being within the scope of explicit consent requires a legal interpretation. Our recommendation is to start with basic mode unless you are sure, and to move to advanced mode together with your legal adviser. Losing measurement is cheaper than the risk of writing the wrong cookie.

Does a visitor who rejects drop out of measurement?

Yes, and this has to be accepted from the start. The conversion of a visitor who doesn't give consent either doesn't appear at all in Google Ads and Analytics or is partly estimated through modeling. How many people reject varies with your site's audience and with the banner's design and language; we don't have a reliable rejection rate for Turkey, so we don't give a figure. You can see your own rate by watching it for a few weeks in Tag Manager or in the CMP panel.

For ad management the consequence is this: on a site with a high rejection rate, the conversions the platform reports fall short of real sales. Taking this into account when looking at ROAS is important so as not to cut ads unnecessarily. Comparing conversions with the orders and appointment records in your own system is the most reliable check. A similar distinction exists on the Meta side; consent management and server-side tracking are the subject of a separate post.

The three most common setup mistakes

First, the tag running unaware of Consent Mode. If there is a gtag.js or GA4 code pasted directly into the page source, the tag loads whatever the banner chooses and runs with the default behavior. You need to work through Tag Manager or put the default command before the tag. Second, not defining the default at all; as we saw above, Google then treats it as granted. Third, not testing. Pressing “Reject” in the banner and looking at the browser's cookie tab takes two minutes and often ends in a surprise, because banner settings and tag triggers are configured separately.

Setup order

In practice the order runs like this. First list which cookies and which third-party tags run on your site; the cookie tab of the browser developer tools is enough for this. Then set up the banner according to the KVKK guide: equal buttons, unticked categories, a link to the privacy notice. In the third step add the Consent Mode defaults as denied, running before the Google tags. In the fourth step test, in Tag Manager preview mode with reject and accept scenarios, that the choice in the banner is really being sent with the update command. Also verify from the browser that no advertising cookie is written in a session where Reject was pressed. Finally update your cookie policy and privacy notice, and write the transfer abroad there too.

For the equivalent of the same logic on the automation side, see our KVKK-compliant automation article; there we cover in which tool customer data sits and where.

FAQ

Sources: KVKK, "Çerez Uygulamaları Hakkında Rehber" (July 2025 version) · Google for Developers, "Manage consent settings" · Google Analytics Help, "Consent mode". This post is for general information and is not legal advice.