Ann Sukhachova's OrganizationVisit Website →
← Back to blog

Consent Mode v2 Explained for Site Admins and Marketers

August 22, 2026
Consent Mode v2 Explained for Site Admins and Marketers

Google Consent Mode v2 is the signaling layer that passes a visitor's cookie and privacy choices to Google's tags before they fire. Set default consent before any Google tag loads, confirm your CMP sends all four v2 signals, and choose Basic or Advanced only after legal has weighed in.

Here's what to do right now:

  • Set a default consent state (denied, typically) in the page head, before Google Tag Manager or gtag.js loads.
  • Confirm your consent management platform actually sends all four v2 parameters, not just the original two.
  • Pick Basic or Advanced mode after legal review, not before.

This affects every major Google measurement product you're likely running: GA4, Google Ads, and Floodlight. If any of those show up in your tag stack, this framework isn't optional. It's already reshaping how your conversion data gets reported.

Key Takeaways

Consent Mode v2 only works when defaults are set before tags load, all four signals are wired correctly, and Basic versus Advanced is chosen with legal input rather than convenience.

PointDetails
Four signals, not twoConfirm your CMP sends analytics_storage, ad_storage, ad_user_data, and ad_personalization, not just the original pair.
Sequencing decides everythingDefaults must load before any Google tag; a late-firing CMP update creates compliance and data gaps.
Modeling has thresholdsAdvanced mode's cookieless pings only produce modeled conversions once traffic clears Google's volume minimums.
Consent Mode isn't a CMPIt signals consent state to Google tags; a certified CMP still has to collect and store actual consent records.
Get implementation reviewedAtdigiagency audits Consent Mode and conversion tracking setups to catch sequencing and mapping errors before they cost you data.

Table of Contents

Consent Mode v2 is Google's framework for telling its own tags how to behave based on what a visitor consented to. It doesn't collect that consent itself. Your CMP does that job. Consent Mode simply reads the outcome and adjusts tag behavior accordingly, which is the detail most implementation guides skip past too fast.

The framework runs on four parameters. Two came from the original version; two are new:

  • analytics_storage — controls whether Google Analytics can write cookies for behavioral analytics.
  • ad_storage — controls whether advertising cookies (like those behind Google Ads remarketing) get set.
  • ad_user_data — a v2 addition governing whether user data can be sent to Google for advertising purposes at all.
  • ad_personalization — a v2 addition controlling whether that data can be used for personalized/remarketing ads specifically.

That split between storage and usage is the real shift in v2's four-signal structure. A visitor can allow analytics storage while denying ad personalization, and the tags need to respect that distinction precisely.

Mechanically, each parameter is just a "granted" or "denied" boolean. You set a default state before tags fire, and your CMP fires an update command the moment a visitor makes a choice. Consent Mode itself keeps no memory of past choices. It only reacts to whatever state it's told about right now.

The sequence matters more than almost anything else in this setup. Get the order wrong and you'll leak data or violate consent, sometimes both at once.

  1. Set defaults first. Before any Google tag container loads, your page needs to declare a default consent state, usually "denied" until proven otherwise.
  2. Wait for the CMP's update. When a visitor interacts with your banner, the CMP fires a consent update event that overwrites the default with the visitor's actual choice.
  3. Tags adapt in real time. Google's tags read the current consent state and adjust what they send, whether that's a full analytics hit or nothing at all.

When consent for advertising is denied, Advanced implementations don't go silent. They send anonymized cookieless pings, small signals with no cookie or identifier attached, that Google aggregates to build statistical conversion models. This is how advertisers partially recover conversion counts lost to consent refusals. But modeling isn't automatic charity from Google. It only activates once a property clears certain event volume and consented-user thresholds, meaning smaller advertisers sometimes implement everything correctly and never see modeled conversions appear.

Pro Tip: Loop legal into the sequencing conversation early, not just the consent categories for best conversion rate optimization tips. A CMP that fires its update event half a second after Google Tag Manager finishes loading tags creates exactly the same compliance gap as having no Consent Mode at all.

Hand setting timer on table

Basic Mode or Advanced Mode: Which One Fits Your Team

This decision splits legal caution from measurement ambition, and there's no universal right answer. It depends on your risk tolerance and how much your business leans on modeled data.

FactorBasic ModeAdvanced Mode
Tag loading behaviorTags stay blocked until consent is grantedTags load immediately, adjusting behavior per consent state
Data sent when deniedNothingAnonymized cookieless pings
Conversion modeling impactNoneFeeds Google's advertiser-specific modeling
Implementation complexityLowerHigher, requires careful tag configuration
Typical legal risk postureConservativeRequires closer legal validation

A quick decision framework:

  • Legal teams facing strict jurisdictional exposure, or without bandwidth to validate cookieless ping behavior, usually default to Basic.
  • Growth and paid media teams chasing measurement recovery push for Advanced, but only after legal signs off on exactly what data leaves the site pre-consent.
  • If your team can't clearly articulate what a cookieless ping contains, that's a signal you're not ready for Advanced yet.

Privacy specialists frame this as a genuine strategic trade-off rather than a technical checkbox, and that framing is the right one to bring into the room with legal.

Four layers typically touch Consent Mode, and each one owns a distinct piece of the job.

  • gtag.js — if you're running Google tags directly without a tag manager, this is where you write the default and update commands by hand.
  • Google Tag Manager — most implementations route consent through GTM's built-in consent settings, which then gate individual tags automatically.
  • Server-side tagging — for teams running server-side GTM, consent state has to be forwarded from the client, adding a coordination step many setups miss.
  • The CMP layer — this is the actual consent collection engine. Tools like CookieYes and Termly handle banner display, category mapping, and firing the update events GTM or gtag.js reads.

Google Ads and GA4 don't collect consent themselves. They just read whatever state Consent Mode reports and adjust reporting accordingly. If you serve visitors in the EEA or UK, a certified CMP is now a practical requirement for retaining personalized ad functionality, not just a nice-to-have.

Before touching any code, confirm three things: you have a working CMP, a clear list of Google products in play (GA4, Google Ads, Floodlight), and a full tag inventory covering every subdomain your visitors touch.

Once that's settled, work through this sequence:

  1. Add the inline default consent command to your page head, before any Google Tag Manager container or gtag.js snippet loads.
  2. Confirm your CMP persists the visitor's choice and fires an explicit update event GTM or gtag.js can read.
  3. Configure GTM's built-in consent settings so tags check consent state before firing.
  4. Mark your Google Ads and GA4 tags as requiring the additional v2 consent signals, not just the original two.
  5. Test on a fresh browser profile to confirm defaults apply before the banner even renders.

If you're upgrading from v1, three gaps typically need closing:

  • Add the two new parameters, ad_user_data and ad_personalization, anywhere your old implementation only referenced analytics_storage and ad_storage.
  • Update your CMP's category mappings so its consent buckets map correctly to all four flags, not the original two.
  • Re-test your sequencing. A v1 setup that worked fine can break silently once v2's extra parameters are added without re-verifying timing.

Setup steps outlined by FlowConsent mirror this order almost exactly, and it lines up with what Google's own documentation recommends for defaults and update sequencing.

Don't trust a "looks right" implementation. Verify it with a deterministic test sequence, ideally on a fresh profile with no prior cookies.

  1. Load the page without touching the consent banner. Inspect outgoing network requests and cookies; nothing should carry advertising identifiers yet.
  2. Accept all consent categories. Confirm previously blocked tags now fire and cookies get set.
  3. Reload and refuse consent instead. Confirm tags either stay blocked (Basic) or send only cookieless pings (Advanced).
  4. Change your choice mid-session and navigate to another page. Confirm the new state persists across pages and subdomains.

Useful tools for this: Google Tag Assistant, GTM's Preview mode, your browser's DevTools network tab, a cookie scanner, and the diagnostics panels inside Google Ads and GA4's debug view.

Watch for these recurring failures, which independent audits flag repeatedly:

  • Defaults set too late inside the container, after tags have already fired once.
  • A single-toggle banner that doesn't actually map to all four consent flags.
  • Partial coverage, where a checkout subdomain or blog subdirectory never loads the consent script at all.
  • A CMP that's technically installed but never sends the v2-specific parameters.

Governance and Best Practices Teams Often Skip

Consent Mode works best as a cross-functional process, not a one-time engineering task someone checks off and forgets.

Pro Tip: Keep a versioned log of your banner copy and consent categories. When legal asks "what did this visitor actually see and agree to in March?", you need an answer, not a guess.

Build these into your ongoing governance:

  • Assign explicit ownership of default consent settings; someone should be accountable when defaults drift during a site redesign.
  • Set a renewal cadence for stored consent, since indefinite consent validity is a common audit finding.
  • Document region-scoping rules if you serve different consent defaults to EEA/UK visitors versus other markets.
  • Test checkout and post-purchase flows specifically. Consent gaps here directly cost revenue attribution.

One clarification worth repeating to stakeholders: Consent Mode is a signaling layer only. It doesn't collect or store consent records for audit purposes. That job belongs entirely to your CMP, and no amount of correct gtag.js configuration substitutes for a certified consent platform or actual legal counsel reviewing your specific jurisdictional exposure.

Minimal Code Examples for gtag.js and GTM

A default consent command, set before any tag loads, looks like this:

gtag('consent', 'default', {
  'ad_storage': 'denied',
  'analytics_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied'
});

Once the visitor makes a choice, the CMP fires an update call:

gtag('consent', 'update', {
  'ad_storage': 'granted',
  'analytics_storage': 'granted',
  'ad_user_data': 'granted',
  'ad_personalization': 'granted'
});

In Google Tag Manager, this typically arrives as a dataLayer event your CMP pushes automatically:

dataLayer.push({
  'event': 'consent_update',
  'ad_storage': 'granted',
  'analytics_storage': 'granted'
});

Most CMP category labels map cleanly onto the four parameters: "Analytics" cookies typically correspond to analytics_storage, "Advertising" or "Marketing" cookies typically split across ad_storage, ad_user_data, and ad_personalization depending on how granular the CMP's categories are.

Advanced Debugging When the Basics Don't Explain the Problem

Sometimes a setup passes every standard test and still reports inconsistent numbers. That's usually a timing or scope issue hiding below the surface.

Check for race conditions first: if your CMP loads asynchronously and a marketing pixel fires from a third-party script before the CMP's default command executes, you get a brief window where tags fire with no consent state applied at all. Network tab timestamps, not just presence or absence of requests, will expose this.

Cross-domain and cross-subdomain consent persistence is another frequent culprit. A visitor consenting on your main domain but landing on a checkout subdomain with a separate cookie scope can effectively reset consent state without anyone noticing. Test each subdomain independently rather than assuming the parent domain's behavior applies everywhere.

Also check for duplicate consent commands firing from both a legacy hardcoded snippet and a newer CMP integration layered on top. This produces conflicting states where the last command to execute silently overwrites the intended one, and it's invisible unless you're logging every gtag('consent', ...) call in sequence.

Finally, if GA4 or Google Ads reporting looks off despite a clean implementation, check whether you're actually below the conversion modeling volume threshold. A technically perfect Advanced setup produces zero modeled conversions if your traffic doesn't clear Google's minimum event count, and that's not a bug worth chasing.

When to Bring in Outside Help

Most teams hit the same walls: sequencing issues across server-side tagging, low ad volume that undercuts modeling anyway, or no internal legal bandwidth to validate Advanced mode's data flows. I'd recommend outside help specifically when you're juggling multiple tag containers across domains, running server-side GTM, or lack someone who can sign off on legal risk in-house.

Hands connecting cables in server room

Getting Consent Mode v2 wrong doesn't just risk compliance exposure. It quietly breaks the conversion data your ad spend decisions depend on, and most teams don't notice until reporting numbers stop making sense. Atdigiagency's Google Ads management team reviews consent configurations as part of setting up conversion tracking correctly the first time, checking sequencing, CMP signal mapping, and Basic versus Advanced fit against your actual measurement goals. We also handle cross-platform setups, including Meta Ads accounts that need the same consent coordination. If your reporting has felt unreliable since your CMP went live, that's worth a second look. Request a configuration review and we'll tell you exactly where the gaps are.

Frequently Asked Questions

What is Consent Mode v2 in simple terms? It's a framework that tells Google's tags how to behave based on a visitor's consent choices, adjusting or blocking data collection accordingly without collecting that consent itself.

How is consent mode vs consent mode v2 different? The original version used two parameters, analytics_storage and ad_storage. Version 2 adds ad_user_data and ad_personalization, splitting data storage permissions from data usage permissions for advertising.

Do I need Consent Mode v2 if I'm not targeting the EEA or UK? Google Ads and GA4 features tied to remarketing and modeling still benefit from correct implementation everywhere, though certification requirements are strictest for EEA/UK traffic.

Can Consent Mode v2 replace my cookie banner? No. It only reads consent state your CMP, like CookieYes or Termly, collects and reports. You still need a functioning banner and consent storage system.

Does implementing Consent Mode v2 fully restore lost conversion data? No. Advanced mode's cookieless pings enable statistical modeling, but that modeling only activates once your traffic clears Google's volume thresholds, and it estimates rather than fully replaces lost data.

How does Consent Mode v2 affect PMAX campaigns and negative keywords? Consent signals don't directly control negative keywords in PMax, but reduced conversion visibility from denied consent can distort PMax's automated bidding signals, making accurate conversion tracking even more important for campaign performance.

Sources