By Marc Alexander

On 15 June 2026 GA4 quietly changed who decides what Google Ads can do with its data. More follows later this year. Here's what it means for a Reject click, and what to check.

What Google changed.

Google's notice, "Updates to Google Analytics data controls", sets out a principle: each control moves to the product where the data is used. Google Ads settings will exclusively control Google Ads data from a linked property. Google Analytics settings will exclusively control data used inside Analytics for behavioural reporting.

The first step took effect on 15 June 2026. From that date, Consent Mode within Google Ads is the single control for how Google Ads cookies and IDs are collected from the Analytics tag. The visitor's consent choice, as your banner passes it on, governs collection and use.

Google Signals, which used to share that job, has been narrowed. The setting and its API now only govern whether Analytics data is linked to signed-in user information, and only for behavioural reporting.

What's still to come.

Two more changes are promised for later in 2026, with exact dates to be shared.

Ads personalisation, currently set in four places (account, property, the Ads link and individual events), will be controlled only by the Consent Mode ad_personalization setting. And IP addresses collected by the Google tag will be encrypted and flow to the linked Google Ads account, governed by Google Ads settings and terms.

What it means for a Reject click.

Before June, turning Google Signals off was a belt-and-braces way to stop Google Ads cookies regardless of what the banner did. That belt has gone. If your banner sends ad_storage as denied, no Google Ads cookies or IDs are collected. If it sends granted, they are, whatever the Signals switch says.

So the consent signal is now the only thing standing between a visitor's choice and Google Ads. A banner that sends granted by default, which the tracking checker finds more often than it should, now grants everything.

A banner that never sends an update at all leaves the tag on its defaults, and the defaults are whatever your setup declared, or nothing.

What to check.

  1. Is the property linked to Google Ads? Admin, then Product links. The notice is written for linked properties. If yours isn't linked, the Google Ads side has nothing to control, but the Signals change still applies.
  2. The four consent signals. ad_storage, ad_user_data, ad_personalization and analytics_storage should default to denied before a choice and update on the click. The testing guide shows how to prove it in the browser.
  3. Stop treating Signals as a privacy control. If your privacy notice or your internal records say "Google Signals is off, so no advertising cookies", that sentence is no longer true. The consent setup is the control, and the notice should describe it.
  4. Note your ads personalisation settings now. Account, property, link and event-level settings will be superseded. Knowing what you have makes the later change a check rather than a surprise.
  5. Watch for the IP address date. GA4 never showed you IP addresses, but the tag collected them. Soon they'll flow, encrypted, to the linked Ads account. If your data protection records describe where IP addresses go, that's an update to make when the date is announced.

The practical upshot.

None of this is new work for a site with Consent Mode v2 done properly: defaults denied, updates on the click, every tag inside the container. It's a problem for the sites that had a banner for show and a Signals switch for comfort. Those were always relying on the wrong control, and since June the comfort has gone.