If you sell online to Canadians, two things meet on your site. Canadian privacy law, PIPEDA federally and Law 25 in Quebec, decides when you may collect data about visitors, and Google’s Consent Mode v2 decides how Google’s tags behave once a visitor has said yes or no. Owners often treat these as one thing, or assume the banner app handles both. Usually it handles one of them, partly.

This article explains how the tools work and how the rules are commonly read. It is not legal advice. Ask a privacy lawyer to review your banner, privacy policy and data flows for your situation.

Consent Mode is a way for your site to tell Google’s tags what the visitor has agreed to. It does not show a banner and it does not decide anything. Your banner collects the choice, and Consent Mode passes it to GA4, Google Ads and Floodlight so they adjust what they store and send.

Version 2 uses four main signals:

Signal What it controls
analytics_storage Whether analytics cookies (such as GA4’s) may be read or written
ad_storage Whether advertising cookies may be read or written
ad_user_data Whether user data may be sent to Google for advertising
ad_personalization Whether data may be used for personalized advertising, such as remarketing

The last two were added in v2. Google requires them for traffic from the European Economic Area and the UK if you want to keep using audiences and conversion measurement there. For a Canadian or US store the requirement is not enforced the same way, but setting all four properly is still the clean way to make Google’s tags follow your visitor’s choice.

Default denied, then update

Consent Mode works in two steps. Before any Google tag loads, your site sets a default state. When the visitor makes a choice, the banner sends an update. For a store that needs opt-in consent, the default for all four signals is denied, and only the visitor’s “accept” switches them to granted.

Order matters. If GA4 loads before the default is set, it may write cookies before anyone has agreed. This is one of the most common faults we see: the banner looks right, but the default arrives a moment too late.

Basic mode and advanced mode

Google describes two ways to run Consent Mode.

Basic mode blocks Google’s tags completely until the visitor agrees. Nothing is sent before consent, and nothing is sent for people who decline. Google can still estimate missing conversions, but only from general patterns rather than your own site’s data.

Advanced mode loads Google’s tags straight away with consent denied. While consent is denied, the tags do not set cookies, but they do send short cookieless pings (for example, that a page was viewed or a conversion happened). Google uses those pings to model conversions from people who declined, which usually recovers more of the gap in your reports.

Which one to choose is partly a legal question. Advanced mode still sends some information to Google before or without consent, even if it carries no cookie. Under a strict reading of opt-in rules, some advisers prefer basic mode for visitors in Quebec or for stores that want the most cautious setup. Others are comfortable with advanced mode. Put the choice to your privacy lawyer, with a description of what each mode sends.

What Canadian law expects

PIPEDA

PIPEDA is the federal private-sector privacy law that applies to most online stores outside Quebec, British Columbia and Alberta (those provinces have their own laws for many businesses). It requires meaningful consent, which means people must understand what you collect, why, and who you share it with. The federal privacy commissioner’s guidance allows implied consent in some low-risk situations, and has accepted opt-out for some online advertising if the notice is clear and the opt-out is easy and takes effect right away.

In practice, many stores outside Quebec use a banner that explains tracking clearly, offers a real “decline” choice and remembers it.

Quebec Law 25

Quebec’s Law 25 modernized the province’s private-sector privacy act, with most obligations in force since September 2023. Several parts matter for an online store:

  • Off by default. Technology that can identify, locate or profile a person must be switched off by default, and the person must be told about it and how to turn it on. Most readings put ad pixels and many analytics setups in that category.
  • Privacy by default. Settings for a product or service offered to the public must give the highest level of privacy by default.
  • A person in charge. Each business has a person responsible for the protection of personal information, which by default is the most senior executive, and their title and contact details must be published.
  • A published privacy policy in clear, simple terms.

The practical result is that a store serving Quebec visitors should expect to use opt-in for tracking cookies and pixels. That means nothing that profiles the visitor runs until they agree.

Some stores set opt-in only for visitors located in Quebec and the EU. Location detection by IP is approximate, and many Canadian stores choose opt-in for all of Canada because it is simpler to run and to explain.

What a good banner does

A banner that respects both the law and the way Google’s tags work does these things:

  1. Loads before any tracking and sets the Consent Mode default to denied where opt-in applies.
  2. Gives “Accept” and “Decline” equal weight, with no pre-ticked boxes and no decline link hidden in small grey text.
  3. Explains in plain words what each category does, and links to your privacy policy.
  4. Sends a Consent Mode update when the visitor chooses, and stores the choice so the banner does not keep coming back.
  5. Lets visitors change their mind later, usually through a link in the footer.
  6. Blocks non-Google tags too. Consent Mode only controls Google’s tags. Your Meta pixel, TikTok pixel and other scripts need to be held back by the banner or your tag manager until the right consent is given.

That last point catches a lot of stores. The banner updates Consent Mode, GA4 behaves, and the Meta pixel fires on page load regardless.

On Shopify

Shopify has its own customer privacy settings and a Customer Privacy API that apps and pixels can read. App pixels added through Settings, Customer events respect the visitor’s consent when your banner is connected to that API. Custom pixels and theme scripts need to be checked one by one, because a script pasted into the theme years ago will ignore all of it.

How to check yours in ten minutes

Open your store in a private window with your browser’s developer tools on the Network tab. Before clicking anything on the banner, look for requests to Google Analytics, Google Ads, Meta or TikTok. Then click “Decline” and browse a few pages. Then clear the site data, reload and click “Accept”.

With opt-in done properly, you should see no tracking requests with cookies before a choice, none from non-Google pixels after “Decline”, and normal tracking after “Accept”. If you use advanced mode, cookieless Google pings before a choice are expected; Meta requests are not.

What to do next

Run the ten-minute check above on your homepage and on a product page, and note any request that fires before you click. If anything does, or if you serve Quebec and your banner defaults to “on”, send your store URL through our free tracking check and we will tell you what we see. If you already know the setup needs work, our Tracking Implementation service sets up Consent Mode v2, banner wiring and tag blocking, and flags the legal questions for your adviser.