Do Not Sell or Share: Configuring GA4 to Honor Opt Out Signals

Almost every US state privacy law gives consumers some version of an opt-out right, from “sale” to “share” to “targeted advertising,” and almost every site handles it the same superficial way: a footer link that opens a modal, records a preference in a cookie, and changes nothing about what Google Analytics actually does. That gap between the visible control and the technical behavior is the single most common GA4 compliance failure across CCPA, CDPA, CPA, and the rest.

What “honoring” an opt-out actually requires

An opt-out request isn’t satisfied by recording a preference, it’s satisfied by the underlying data flow actually stopping. For a GA4 setup, that means the opt-out mechanism needs to actually control:

1. Google Signals — the feature that enables cross-device tracking and links GA4 data to Google’s ad ecosystem. This has to be disabled, not just left running with a preference cookie set alongside it.
2. Any Google Ads / Search Ads 360 linking that shares GA4 audiences into ad platforms.
3. Conversion tracking tied to ads personalization, as distinct from basic aggregate conversion counting, which typically doesn’t require the same treatment.
4. Any custom audiences or remarketing lists built from GA4 data.

If a visitor clicks “Do Not Sell or Share” and none of the above changes, the link is cosmetic. This is precisely the kind of gap regulators and plaintiffs’ attorneys check for, by opening dev tools and watching whether GA4 requests still fire with the same parameters after opting out.

Two ways to actually wire this up

Consent Mode-gated tags. Using Google’s Consent Mode (v2) inside Google Tag Manager, you can set ad_storage, ad_user_data, and ad_personalization to denied when an opt-out is recorded, which suppresses the ads-linked behavior in GA4 without necessarily blocking basic analytics measurement (analytics_storage can remain a separate, less restrictive control if your legal basis supports it). This is the approach most consent management platforms build around.

Server-side suppression. For teams running GA4 through a server-side Tag Manager container, the opt-out state can be checked before any hit reaches Google’s servers at all, giving you a stronger technical guarantee than a client-side flag that a determined visitor could bypass. This is more engineering effort but leaves less room for a client-side gap.

Testing that it actually works

Don’t take your consent platform’s word for it. After configuring:

1. Open your site in an incognito window and trigger the opt-out.
2. Open browser dev tools, Network tab, filter for google-analytics.com/g/collect or analytics.google.com.
3. Confirm the request either doesn’t fire, or fires with ad_storage=denied and no ads-linked parameters, depending on which model you’re using.
4. Repeat with a GPC signal set instead of a manual click, since several states require honoring GPC as equivalent to an explicit opt-out; see our GPC and GA4 guide for how to simulate this in testing.

Why this matters more in some states than others

California’s CCPA/CPRA, Colorado’s CPA, and a growing list of others treat a non-functional opt-out mechanism as its own violation, separate from any underlying privacy harm. See our state-by-state guide for which jurisdictions your visitors fall under and how their specific opt-out requirements differ.

This guide is educational and not legal advice. Confirm your specific Consent Mode and tag configuration with a developer familiar with your GTM/GA4 setup, and confirm legal requirements with a privacy attorney.