Audit GA4 Consent Gaps Before They Warp Your 2026 Remarketing Lists

The list can look healthy and still be wrong

In June 2026, I looked at a GA4 audience called “Viewed pricing, no demo” for a B2B SaaS account spending $42,000 a month across Google Search, YouTube, and Performance Max. GA4 showed 18,400 users in the audience. Google Ads Audience Manager showed enough size to run. On paper, nothing looked broken.

The BigQuery export told a different story.

Roughly 71% of the audience members with recent pricing-page activity had ad_personalization set to granted or effectively usable. The users denying consent were still showing product intent in aggregate reports, but they were falling out of the pool that could train remarketing. That is a quiet budget problem. By Q4 2026, the campaign would have been optimizing toward the people easiest to tag, not the people most likely to buy.

That is the audit I think every operator should run before 2026 planning locks. GA4’s newer Data Manager path gives teams a cleaner place to inspect event and destination wiring. Google announced Data Manager as a central workflow for data sources and destinations in 2026, with UI access across Google Ads, Search Ads 360, and Campaign Manager 360, and Analytics access listed as coming soon in Google’s own announcement. GA4 events also gained Data Manager API support on May 7, 2026, according to the Google Analytics release notes. The useful play is still in BigQuery: compare audience membership against consent signals before those audiences become the basis for spend.

Why Data Manager belongs in the audit

Marketing teams used to audit this stuff from three tabs and a spreadsheet. One person checked Google Tag Manager consent settings. Another checked GA4 Admin. Someone else looked at Google Ads Audience Manager and asked why the list was small. That workflow misses boring failures, which are the expensive kind.

Data Manager is worth using because it puts sources, destinations, and activation paths in one place. Google’s 2026 Data Manager announcement says the product is meant to connect website, app, store, and CRM data, then send those signals into Google’s advertising stack. It also names integrations like Mailchimp, ActiveCampaign, Klaviyo, Google Drive, Adswerve, Stape, Zapier, Treasure Data, and Zeotap. That matters for founders because consent drift often starts outside GA4. A Klaviyo email click, a Shopify checkout event, and a server-side purchase event may carry different consent states if nobody owns the data contract.

I would still treat Data Manager as the map, not the audit result. Maps are helpful. SQL catches the leak.

GA4’s BigQuery export gives you the raw event tables, usually under a dataset named analytics_<property_id>, with daily tables like events_20260824 and intraday tables when streaming export is enabled. Google’s GA4 BigQuery export schema documents that structure. The user-data export adds audience records, including audiences.id, audiences.name, membership_start_timestamp_micros, and membership_expiry_timestamp_micros, in the user-data schema. That is where the audit gets teeth.

The consent fields that decide activation

Consent Mode v2 added two advertising fields in November 2023: ad_user_data and ad_personalization. Google’s developer guide says ad_user_data controls whether user data can be sent to Google for advertising, while ad_personalization controls personalized advertising. The older fields, ad_storage and analytics_storage, still matter because they govern cookie and device storage. The full list is in Google’s Consent Mode overview.

For remarketing, ad_personalization is the field I check first. Google says when ad_personalization is denied, remarketing in Google Ads, Display & Video 360, and Search Ads 360 will not receive data for personalized advertising. That is not a reporting footnote. It changes who can enter the usable ad segment.

Then I check ad_user_data. If a team is sending user IDs, hashed emails, enhanced conversions, Customer Match updates, or server-side events through the Data Manager API, that flag needs to match the user’s actual consent. The Data Manager API consent object has adUserData and adPersonalization fields with granted, denied, and unspecified states. Unspecified is not a harmless blank in an audit. It means nobody can prove the event had a usable consent state at the point it entered the system.

Google’s GA4 consent settings page is blunt about the EEA. To keep using ad personalization and remarketing features for EEA users, advertisers must collect consent and share the consent signals. Google also says that if no action was taken, only end users outside the EEA would be included in audiences used by linked advertising products starting in early March 2024. That guidance is still live in the GA4 consent settings documentation.

The BigQuery comparison I actually run

Start with one audience that has money attached. I like “cart abandoners 7 days,” “pricing visitors 30 days,” or “demo started, no submit” because those segments usually feed Search RLSA, YouTube remarketing, or Performance Max audience signals. Avoid starting with “All users.” It hides the wound.

For a mid-market ecommerce client in August 2026, I would pull three numbers for the last 14 complete days: users entering the audience, users with ad_personalization = granted, and users with ad_personalization = denied or missing. Then I split by country, device category, browser, and source medium. The split matters. A 19% consent gap across the whole property can become a 44% gap on iOS Safari traffic from France.

The SQL depends on your export shape, but the logic is plain. Use the user-data export to unnest audience membership. Join or compare it with event-level consent signals from the event tables. Keep the date window short enough that site changes show up. I use 7 days for launch QA and 28 days for budget planning.

SELECT
  audience.name AS audience_name,
  consent.ad_personalization AS ad_personalization,
  consent.ad_user_data AS ad_user_data,
  COUNT(DISTINCT user_pseudo_id) AS users
FROM `project.analytics_123456789.events_202608*`,
UNNEST(audiences) AS audience
WHERE audience.name = 'Viewed pricing, no demo'
GROUP BY 1, 2, 3
ORDER BY users DESC

Your column names may differ if you are using event export, user-data export, or transformed report tables. Google Cloud’s GA4 transformation docs show an Audiences report table named p_ga4_Audiences, with audienceName as a field, but that report view is not a substitute for user-level QA. Use it to reconcile totals. Use the raw export to find the consent break.

One warning from experience: standard GA4 properties still have a daily BigQuery batch export limit of 1 million events. Google documents that limit in the BigQuery export setup guide. If your property is near that ceiling and someone excluded noisy events like scroll or view_search_results, confirm they did not also exclude the events that define your remarketing audience. I have seen a clean export because the broken rows were never exported.

What a gap looks like in real accounts

The first pattern is CMP timing. A Cookiebot or OneTrust banner loads after GTM, the default consent command arrives late, and the first GA4 page_view fires with the wrong state. Google’s consent setup guide tells developers to call gtag('consent', 'default', ...) before measurement commands and mentions wait_for_update, with a 500 millisecond example, for asynchronous banners. That tiny ordering issue can distort every audience based on landing-page behavior.

The second pattern is server-side optimism. A backend purchase event is sent through Measurement Protocol, a server-side GTM container, or the Data Manager API with consent hardcoded to granted because the CRM record has an email address. That is lazy plumbing. If the web session had ad_personalization = denied, the server event should not pretend otherwise. The customer did not become consented because Salesforce has a row.

The third pattern is regional drift. A U.S. founder looks at a blended GA4 report and sees a healthy remarketing pool. Germany, France, and the Netherlands are buried inside the total. Google Analytics consent settings show EEA traffic and conversion percentages at the data-stream level, which is exactly where this audit should start before a European campaign launch.

The fourth pattern is list-size confusion. Google says GA4 audiences are automatically exported to linked Google Ads accounts when ads personalization is enabled, and the audiences are available within 1 day on average. For search remarketing lists, Google’s Analytics help still lists a 1,000-cookie minimum and a maximum list lifespan of 540 days. A list can pass the minimum and still be skewed. Size is not representativeness.

The operating cadence

I like a monthly consent-audience audit for accounts spending under $25,000 a month, and weekly checks for anything above $100,000 a month or any account running heavy YouTube remarketing. The cost is tiny. A scheduled BigQuery query, a Looker Studio table, and a Slack alert through Zapier or Cloud Functions will catch most failures before the media team notices performance wobble.

Set thresholds that force a conversation. For example, if ad_personalization denied or missing exceeds 25% for a purchase-intent audience, pause expansion tests that depend on that audience until the tag owner signs off. If one country is 15 percentage points worse than the site average, inspect the CMP rules for that region. If Safari has twice the missing-consent rate of Chrome, check banner timing and GTM consent initialization on the first page load.

Founders should care because the bias compounds. In paid search, RLSA bid modifiers and audience observations change how budget is distributed. In Performance Max, audience signals nudge early learning. On YouTube, remarketing pools shape who gets sequenced into the next message. If the seed list tilts toward people who accept every banner, your budget learns from a convenience sample.

That does not mean consent-denied users should be chased. They should not. The audit is about seeing the shape of the missing data, then deciding whether your activation strategy still matches reality. Sometimes the right move is to rebuild the audience around server-confirmed, consented lifecycle events. Sometimes it is to separate EEA campaigns from U.S. campaigns. Sometimes it is to stop pretending a 30-day cart abandoner list tells the whole story.

A cleaner 2026 setup

My preferred 2026 setup has four owners. The analytics owner controls GA4 audiences and BigQuery exports. The tag owner controls GTM, the Google tag, and CMP timing. The paid owner controls Google Ads audience usage and exclusions. The lifecycle owner controls CRM and email sources flowing through Data Manager or partner connectors like Klaviyo and Stape.

Each owner gets one check. GA4 Admin confirms BigQuery links, Google Ads links, and ads personalization settings. Data Manager confirms sources and destinations. BigQuery confirms consent states by audience. Google Ads confirms usable segment size and campaign attachment. Four checks, one hour, no mystery spreadsheet.

The biggest mistake is waiting until remarketing performance drops. By then, Smart Bidding has already learned from the wrong slice of users, and the fix takes weeks because audience membership windows need time to refill. Run the audit before the 2026 budget is committed. Pick the three audiences that steer the most spend. Compare membership against ad_personalization and ad_user_data. Then fix the wiring where the numbers get weird.

The budget does not need a perfect identity graph. It needs a remarketing list that is honest about who can be reached, who cannot, and where consent gaps are bending the signal.