The symptom

Somebody installed the cookie banner. Probably the web build team, probably two years ago, probably on the strictest defaults the plugin offered, because nobody wanted to sign off on something loose. It went live, legal was satisfied, and nobody has opened it since.

Meanwhile the accept rate on that banner quietly scales the rest of your reporting. Sessions, conversions, audience sizes, remarketing lists, and the signals the bidding runs on. If a large share of visitors never lets a tag fire, the campaign work you are paid for is running on a thinned dataset, and nothing on the client's dashboard says so.

It surfaces as a question you cannot answer. The client asks why GA4 sits below the ad platform, and the honest answer is that the accept rate is a number nobody at the agency measures, owns, or reports. It is treated as a legal setting rather than a performance one, which is how a metric moves your results with nobody watching. What that costs an account is the subject of how much data your cookie banner throws away.

Why it happens

Three reasons, and only the first one is obvious.

The banner was built to reduce legal risk, not to be answered

The brief was "make us compliant". That is a sound instinct and it is half a brief. Under Article 5(3) of the ePrivacy Directive, storing or reading information on a visitor's device needs consent unless it is strictly necessary for a service the visitor asked for, which is why the banner exists at all. So the safest-looking build wins: ask for as little as possible, keep the wording defensive, ship it. Nobody in that chain was asked whether people could actually answer it, so the banner ends up legally defensible and commercially unmeasured at once.

Most of the loss is people who never answered

The European Data Protection Board's Cookie Banner Taskforce report restates the baseline plainly: by default no cookies that require consent may be set without one, and consent "must be expressed by a positive action on the part of the user".

So a visitor who scrolls past the banner or leaves before deciding has not refused anything. They did not answer, and your tags treat that identically to a refusal. That group is not a legal constraint, it is a comprehension, timing and layout problem, which makes it the one part of the accept rate you can move without touching the refuse path at all. Most agencies argue about the reject button and ignore the larger group that never read it.

The quick levers are the ones the authorities have already named

When accept rate does become a target, the first ideas on the whiteboard tend to be the ones the taskforce report addresses directly. On its reading of the rules, none of these produce valid consent:

• refusal offered only as a link buried in banner text, or placed outside the banner, without enough visual support to draw an average user's attention to it

• pre-ticked boxes on the settings layer, since recital 32 of the GDPR states that "silence, pre-ticked boxes or inactivity should not therefore constitute consent"

• a design that gives the impression consent is required to reach the content, or that clearly pushes the user towards consenting

• legitimate interest as the basis for placing or reading the cookies themselves

• reclassifying non-essential cookies as essential, where the controller has to be able to demonstrate that essentiality on request

The cost is not an abstract fine risk. The taskforce takes the position that where consent under Article 5(3) is not valid, the processing that follows cannot be GDPR-compliant either. You are not buying a slightly risky number, you are putting the dataset built on it in question.

The report is also candid that the authorities are not unanimous on the reject button itself. A vast majority treat the absence of a refuse option on any layer carrying a consent button as an infringement, a few will not, because Article 5(3) does not name a reject option in so many words.

What good looks like

Four moves, in this order.

Make the accept rate a reported number with an owner. Per client, per month, split by country and device, next to CPA in the report rather than in a compliance folder. The split matters: a drop in one market is usually a banner change or a translation problem, not a trend.

Work on the group that never answered. This is ordinary conversion work on a different surface: what the banner asks, when it appears, how fast it renders, whether it is in the visitor's language, and how many vendors you are asking permission for. A shorter, honest list is easier to say yes to. How much headroom exists depends on traffic mix, market and sector, so test it rather than chase a target.

Keep the refuse path clean on purpose. Not as a moral position, as a commercial one. It is what makes the consent you do collect worth building a measurement stack on.

Then decide what happens to the visitors who said no, which is the other half of the job and independent of the accept rate. Google's tag platform documentation is explicit: in basic consent mode "no data is sent before a user consents, not even the default consent status", while in advanced mode, when consent is denied, "consent state and measurements without cookies are sent". Modelling on top of that is not automatic. Google Ads documents the conditions as a correct consent mode or IAB TCF v2.0 implementation plus "a daily ad click threshold of 700 ad clicks over a 7 day period, per country and domain grouping". Below that volume no modelled conversions arrive, and the accept rate plus a solid server-side setup is what you have. Server-side is where the approved 15-40% recovery in measured conversions comes from.

Be honest about the ceiling. Even at a strong accept rate, ad blockers still strip 30-40% of events, which is why conversions go missing before they reach GA4 for reasons unrelated to the banner. Roughly 95% of events is a realistic ceiling, and it is a ceiling rather than a promise. The goal is closing most of the 15-30% of conversions a typical account never captures.

This is the work Archon Consent does, treating the banner as a measurement surface as well as a legal one, so the client stays compliant without discarding data they never had to. On the performance agency account in our case study, 38% of client traffic affected by tracking prevention is now recovered, measured conversions rose 26%, and the team saved 14 hours per project.

FAQ

Is trying to increase the consent rate even allowed?

Yes, as long as you improve the question rather than obstruct the answer. Nothing requires a banner to be confusing, slow, untranslated, or longer than it needs to be, and fixing those is legitimate. Making refusal harder to find or to use than acceptance is not. If a change only works because the visitor misunderstood it, it is the wrong change.

Do the accept and reject buttons have to look exactly the same?

Not according to the taskforce report. The authorities agreed that no general colour or contrast standard can be imposed and that each banner is assessed case by case. The one practice they named as manifestly misleading is a reject option whose text contrast is so minimal it is effectively unreadable. Identical styling is a safe default rather than a legal requirement.

Can we classify analytics cookies as essential and shrink the banner?

No. The taskforce addresses cookies inaccurately classified as essential or strictly necessary, and the controller has to be able to demonstrate that classification on request. Relabelling is not a consent-rate tactic, it is a finding waiting to happen. Reducing the number of non-essential vendors is the legitimate version of the same idea.

What is a good consent rate?

It depends, and any single benchmark quoted at you deserves suspicion. Published figures disagree widely because accept rates move with country, sector, traffic source, device and banner design, and most do not state their method. The useful comparison is your own account over time.

If Google models the missing conversions, does the accept rate still matter?

Yes, for two reasons. Modelling activates only once the documented click threshold is met, so smaller accounts and markets often get no modelled conversions at all. And modelled conversions are estimates in Google's reporting, not observed events you can segment or join to CRM revenue.

If you do not know your clients' current accept rates, that is the first thing a free tracking audit puts a number on, along with what the banner is costing the accounts underneath it.