If you advertise to people in the European Economic Area or the UK with Google Ads, or measure them with Google Analytics 4, Consent Mode v2 is no longer optional. Skipping it doesn’t produce an error message. Your remarketing audiences quietly stop growing, your conversion numbers drift away from reality, and automated bidding starts optimising on incomplete data. This guide explains what Consent Mode v2 actually does, what breaks without it, and how to set it up and check it properly.
What Consent Mode is (and what it isn’t)
Consent Mode is a signalling layer between your cookie banner and Google’s tags. When a visitor accepts or declines cookies, your consent management platform (CMP) passes that choice to Google’s tags, and the tags adjust their behaviour: they may set cookies or not, send full data or reduced pings, and allow or block ad personalisation.
Two things it is not:
- It is not a cookie banner. Consent Mode doesn’t ask anyone anything. You still need a CMP that collects consent in a way that meets the GDPR and the ePrivacy rules in your market.
- It only governs Google tags. The Meta Pixel, LinkedIn Insight Tag, TikTok Pixel, Hotjar and every other third-party script need to be blocked or released by your CMP separately. Consent Mode won’t do it for them.
Why “v2”, and why it became mandatory
The original Consent Mode had two signals, for advertising cookies and analytics cookies. In late 2023 Google added two more to reflect the EU’s Digital Markets Act, which requires large platforms to have explicit consent before they combine personal data across services for advertising. Since March 2024, Google has required advertisers to send these signals for EEA traffic if they want to keep using audience and personalisation features. The UK has since been brought into the same framework.
The four parameters are:
| Parameter | What it controls | Added in |
|---|---|---|
ad_storage | Whether advertising cookies (e.g. for conversion tracking) can be read or written | v1 |
analytics_storage | Whether analytics cookies (e.g. GA4’s _ga) can be read or written | v1 |
ad_user_data | Whether user data can be sent to Google for advertising purposes | v2 |
ad_personalization | Whether data can be used for personalised advertising, such as remarketing | v2 |
What breaks if you skip it
Nothing on your website visibly changes, which is why so many accounts run without Consent Mode for months. The effects show up in your advertising and analytics data:
- Remarketing audiences stop growing for EEA users. Without a valid
ad_personalizationsignal, Google won’t add those visitors to your audience lists. Over a few months your remarketing lists shrink, and so does the reach of any campaign built on them. - Conversion measurement degrades. Without
ad_user_data, Google limits how it uses conversion data from EEA users. Reported conversions drop even if your real sales don’t. - Smart Bidding optimises on a partial picture. Target CPA, target ROAS and Maximise Conversions all learn from conversion data. When a chunk of it is missing, bidding becomes more conservative or chases the wrong signals.
- You lose conversion and behavioural modelling. Google can estimate the conversions and GA4 sessions of people who declined cookies, but only if Consent Mode is running (in Advanced mode, explained below). Without it, those users are simply invisible.
- Your legal risk goes up, not down. Sites that drop Consent Mode often “fix” the data gap by firing tags before consent. That is exactly what regulators fine companies for.
Basic vs Advanced mode
Consent Mode comes in two implementations, and the choice is partly technical and partly legal.
| Basic | Advanced | |
|---|---|---|
| Before consent | Google tags don’t load at all | Tags load with all four signals set to “denied” |
| If the visitor declines | Nothing is sent to Google | Cookieless pings are sent (no identifiers, no cookies) |
| Modelling | Limited, general modelling only | Advertiser-specific conversion and behavioural modelling |
| Data recovered | Lowest | Highest |
| Privacy position | Most conservative | Requires a view on whether cookieless pings need consent in your market |
Our view: Advanced mode gives you noticeably better data, but some European data protection authorities take a strict view of any request to a third-party server before consent, cookieless or not. If you have a data protection officer or legal counsel, make this decision with them and write it down. If you don’t, Basic mode is the safer default, and you can move to Advanced once you’ve taken advice.
How to implement it correctly
1. Choose a CMP with built-in Consent Mode support
If you show Google ads on your own site (AdSense, Ad Manager or AdMob), Google requires a Google-certified CMP for EEA and UK traffic. If you only advertise on Google, certification isn’t strictly required, but a certified CMP is still the easiest route: it sends the Consent Mode signals for you, and it’s been tested against Google’s requirements.
2. Set the defaults before any Google tag runs
This is the step that most often goes wrong. The default consent state must be set before any measurement code runs. For a site that sets defaults with gtag.js directly, that looks like this:
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
// Deny everything by default for EEA countries and the UK
gtag('consent', 'default', {
'ad_storage': 'denied',
'analytics_storage': 'denied',
'ad_user_data': 'denied',
'ad_personalization': 'denied',
'region': ['AT','BE','BG','HR','CY','CZ','DK','EE','FI','FR','DE','GR','HU',
'IS','IE','IT','LV','LI','LT','LU','MT','NL','NO','PL','PT','RO',
'SK','SI','ES','SE','GB'],
'wait_for_update': 500
});
// Optional: keep click IDs in URLs and redact ad identifiers when denied
gtag('set', 'url_passthrough', true);
gtag('set', 'ads_data_redaction', true);
</script>
<!-- CMP script, then Google tag / GTM container, go below this -->wait_for_update gives your CMP up to 500 milliseconds to load and restore a returning visitor’s saved choice before tags fire. url_passthrough keeps ad-click identifiers in page URLs, so conversions can still be attributed without cookies. ads_data_redaction strips ad identifiers from requests while ad storage is denied.
If you use Google Tag Manager, don’t hand-code this. Use your CMP’s official GTM template and fire it on the Consent Initialization – All Pages trigger, which runs before everything else in the container.
3. Send an update when the visitor chooses
When someone accepts or declines, the CMP calls gtag('consent', 'update', {...}) with the new values. A good CMP also sends that update on every later page load, so a returning visitor’s choice is respected straight away.
4. Remove anything that bypasses the CMP
Old GA snippets pasted into a theme, plugins that inject their own Google tag, and developer test tags all run outside your consent setup. Audit the page source and your GTM container, and make sure there is exactly one path by which Google tags load.
How to check that it actually works
“The banner appears” is not a test. Check these four things:
- Tag Assistant. Open your site through Google’s Tag Assistant and look at the Consent tab. You should see a default event with all four parameters denied, followed by an update event after you make a choice.
- Cookies before consent. In a private window, open your site and don’t touch the banner. In your browser’s developer tools, check the cookies: there should be no
_ga,_gcl_auor similar Google cookies. - Network requests. In the Network tab, filter for
collectorgoogle. Requests carry agcsparameter that shows the consent state:G100means both storage types were denied,G111means both were granted. Declining should produceG100(or no requests at all in Basic mode). - Google Ads diagnostics. In Google Ads, open Goals → Conversions → Summary and check the consent mode status for each conversion action. It can take a few days after launch to show as active.
The most common mistakes
- Defaults set to “granted”. Some CMP configurations ship with defaults granted “for testing”, and nobody changes them. For EEA and UK visitors, defaults must be denied.
- Only the two v1 parameters are sent. Older setups send
ad_storageandanalytics_storagebut notad_user_dataandad_personalization. Google treats that as incomplete. - The banner loads after the tags. A CMP loaded asynchronously at the bottom of the page, with no
wait_for_update, lets tags fire before a choice is known. - Region list is wrong or missing. A missing region list applies EEA defaults worldwide, which isn’t wrong but costs you data elsewhere. A list that misses the UK, Norway, Iceland or Liechtenstein is a real compliance gap.
- Non-Google tags ignored. Consent Mode is set up perfectly, and the Meta Pixel fires for everyone regardless.
A short checklist
- A CMP is installed, and it collects consent before any non-essential script runs.
- All four Consent Mode parameters default to “denied” for EEA and UK visitors.
- Defaults are set before the Google tag or GTM container loads.
- The CMP sends a consent update on choice and on every later page load.
- No Google tags load outside the CMP-controlled path.
- Non-Google pixels are blocked until the relevant consent is given.
- Basic or Advanced mode has been chosen deliberately, and the decision is written down.
- Tag Assistant, cookies and network requests have been checked in both the accept and decline paths.
- Google Ads shows consent mode as active for your conversion actions.
Sources and further reading
- Google for Developers: Set up consent mode on websites
- Google Ads Help: About consent mode
- Google: EU user consent policy
This article is general technical guidance, not legal advice. Consent requirements differ between EU member states, so check your setup with your data protection officer or legal counsel.