Google Consent Mode: How It Works and How to Implement v2

Last updated: 22 October 2026

Google consent mode is the setting that tells Google tags what each visitor agreed to, so Google Ads and GA4 change how they store cookies and send data. This guide explains consent mode v2 in plain terms, compares basic and advanced mode, gives the gtag.js and Google Tag Manager setup steps, and shows how to prove it works. Every parameter, threshold and date below comes from Google’s own documentation, with a link at each claim.

Get Free Audit Worth $500

Quick Answer: what does Google consent mode do?

Google consent mode passes each visitor’s consent choices to Google tags. When a visitor denies consent, Google Ads and GA4 stop reading and writing cookies for that purpose. In advanced mode they still send cookieless pings that Google uses for conversion modeling. Version 2 adds two signals, ad_user_data and ad_personalization, that Google expects for EEA traffic.

The short version, in five points:

• Set defaults first: the default consent command must run before the Google tag sends anything.
• Send all four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization.
• Pick a mode: basic blocks tags until the choice, advanced loads them with denied defaults.
• Update on choice: your banner or CMP must send an update for both “accept” and “reject”.
• Verify: check Tag Assistant’s Consent tab, the gcs value in network hits and the Google Ads Diagnostics tab.

This summary table shows the main decisions at a glance. The sections below link each source.

What is Google consent mode?

Google consent mode is an API in the Google tag and Google Tag Manager that lets a site control how Google tags behave based on each user’s consent choices. Google’s consent mode overview describes it as a way for site and app developers to control Google tags and SDKs.

Consent mode does not ask for consent. Google Ads Help says consent mode does not provide a consent banner. It receives the choice from your banner or consent management platform (CMP), then passes it to Google Ads, GA4 and Floodlight tags.

Think of it as two layers that must agree:

1. The banner or CMP asks the visitor and records the answer.
2. Consent mode turns that answer into consent states (“granted” or “denied”) that Google tags read before they set cookies or send data.

If either layer is missing, the setup fails. A banner without consent mode leaves Google tags blind to the choice. Consent mode without a banner leaves every visitor stuck on the default.

What changed in consent mode v2?

Consent mode v2 is the same consent mode API with two extra parameters, ad_user_data and ad_personalization. Google’s website setup guide says consent mode was updated in November 2023 with these two parameters and tells existing users to upgrade to v2.

The update came with stronger enforcement of Google’s EU user consent policy. The Google Ads Help page on consent mode for EEA traffic says advertisers must collect consent from end users based in the EEA and share those signals with Google for measurement, ad personalization and remarketing.

Google Analytics gave the practical deadline. Its help page on verifying consent settings says that without action, audiences would only include end users outside the EEA from early March 2024.

Source: Set up consent mode on websites, Google for Developers.

What do the consent mode parameters control?

Consent mode has seven consent types. Four control Google Ads and GA4 data: ad_storage, ad_user_data, ad_personalization and analytics_storage. The other three, functionality_storage, personalization_storage and security_storage, label storage your own site uses. Google’s consent mode overview lists all seven.

This table shows what each parameter covers and what happens when it is denied:

Sources: consent mode overview, Google Ads consent mode reference, GA4 consent mode behavior.

Two details catch people out. First, the Google Ads consent mode reference says both ad_user_data and ad_personalization must be granted before personalized advertising is turned on. Second, Google’s EEA update page says that if the two parameters conflict, personalization is disabled.

Basic vs advanced consent mode: what is the difference?

Basic consent mode blocks Google tags until the visitor interacts with the banner, so nothing reaches Google from visitors who deny. Advanced consent mode loads Google tags straight away with your default states and sends cookieless pings when consent is denied. Google Ads then uses an advertiser-specific conversion model instead of a general one.

This comparison table is built from Google Ads Help and the developer overview:

Sources: About consent mode, consent mode overview, GA4 behavioral modeling.

What is in a cookieless ping?

A cookieless ping is a request a Google tag sends without reading or setting cookies. Google Ads Help lists the contents: functional data such as a timestamp, user agent, referrer and browser headers. It also includes coarse data such as whether an ad click ID appeared in the URL, a boolean consent state, a random number for each page load and consent platform details, per the consent mode help page.

Which consent mode should you choose?

Choose the mode your legal or privacy lead approves first, then weigh measurement. Google’s setup guide says to follow your company’s guidelines when choosing. Use this decision table as a starting point for that conversation, not as legal advice:

What changed in Google consent mode in 2026?

Google consent mode became the main control for Google Ads data that comes from GA4 in 2026. From June 15, 2026, Google Analytics uses consent mode ads settings to decide whether Google Ads cookies and identifiers are collected through the Analytics tag, according to Google’s Analytics data controls update. Google Signals no longer plays that role.

In practice, switching Google Signals off is no longer a way to hold back ads data. If your consent defaults or updates are wrong, the wrong data reaches linked Google Ads accounts. The table lists each 2026 change and what to check.

Source: Google Analytics Help, Updates to Google Analytics Data Controls, checked October 22, 2026.

For EEA, UK and Swiss traffic, the IP address change sits next to the EU user consent policy points in the next section. Google covers IP address use for other regions in a separate Analytics Help article.

Who needs Google consent mode v2?

Any advertiser with visitors in the EEA needs consent mode v2, or the IAB TCF, to keep personalized ads and full measurement for those users. Google’s EU user consent policy help page says advertisers with EEA traffic must pass consent choices to Google, for example through consent mode or TCF.

The scope is wider than many guides say. Here is what Google’s policy page states:

• Regions: the policy applies to end users in the EEA, the UK and Switzerland. The EEA means the EU member states plus Iceland, Liechtenstein and Norway.
• UK and Swiss advertiser traffic: Google says it does not expect advertisers to send a verified consent signal for UK or Swiss traffic. The consent and disclosure duties in the policy still apply.
• Records: the policy asks you to keep records of consent, including the text and choices shown to users.
• IP addresses: Google’s EU user consent policy page says that, beginning in August 2026, Google will begin launching IP-based ads measurement and personalization, and that banners should explain IP address use where it applies.

Publishers face a stricter rule. Google AdSense Help says AdSense, Ad Manager and AdMob publishers need a Google-certified CMP integrated with the TCF to serve personalized ads in the EEA and UK from 16 January 2024, and in Switzerland from 31 July 2024. Google’s policy page also says it does not require advertisers to use a CMP from its partner program.

A US-only business with no EEA, UK or Swiss visitors is outside this policy. You may still use consent mode for US state privacy laws. That is a question for your counsel, not something Google’s documents decide. This section is general information, not legal advice.

How to implement Google consent mode with gtag.js

To implement Google consent mode with gtag.js, set default consent states before the Google tag loads, then send an update when the visitor makes a choice. Google’s website setup guide warns that if consent code runs out of order, the defaults will not work.

1. Add the default command above the Google tag. It must run on every page before any config or event command.
2. Set region-specific defaults if you need them. Use ISO 3166-2 codes. The most specific region wins, so a US-CA default overrides a US default for California visitors.
3. Add wait_for_update if your banner loads asynchronously. The value is in milliseconds. Google’s example uses 500.
4. Load the Google tag, then your banner or CMP.
5. Send an update when the visitor chooses. Send it for both accept and reject.
6. Decide on url_passthrough and ads_data_redaction. See the notes below the code.

This is the default and update pattern from Google’s guide, with a regional default for a few EEA countries plus the UK (GB) and Switzerland (CH) as an example. Set the region list your own policy requires. A default without a region applies to every visitor not covered by a regional command, so add one if you want a rule for everyone else.

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}

  // Default for listed regions (example list, set your own)
  gtag('consent', 'default', {
    'ad_storage': 'denied',
    'ad_user_data': 'denied',
    'ad_personalization': 'denied',
    'analytics_storage': 'denied',
    'region': ['AT', 'BE', 'DE', 'FR', 'IE', 'IT', 'NL', 'ES', 'GB', 'CH'],
    'wait_for_update': 500
  });
</script>
<!-- Google tag (gtag.js) loads after this -->

<script>
  // Call this from your banner when the visitor accepts
  function allConsentGranted() {
    gtag('consent', 'update', {
      'ad_user_data': 'granted',
      'ad_personalization': 'granted',
      'ad_storage': 'granted',
      'analytics_storage': 'granted'
    });
  }
</script>

Two optional settings change what happens when ad_storage is denied. Google’s setup guide explains both:

• url_passthrough: when true, ad click, client ID and session data can pass through URL parameters such as gclid, dclid, gclsrc, _gl and wbraid when cookies are denied.
• ads_data_redaction: when true and ad_storage is denied, Google redacts ad click identifiers in Google Ads and Floodlight requests. It has no effect when ad_storage is granted.

Using a website builder? Google Ads Help links to consent mode guides for Shopify, Wix, Squarespace, BigCommerce, HubSpot and others, and lists CMPs with their own instructions.

How to set up consent mode v2 in Google Tag Manager

To set up consent mode v2 in Google Tag Manager, load your CMP through a consent mode template on the Consent Initialization trigger, then check the consent settings on every tag. Tag Manager Help says the Consent Initialization trigger always fires before all other tags.

1. Turn on consent overview. Go to Admin, Container Settings, and under Additional Settings select “Enable consent overview”. Tag Manager then groups tags into Consent Configured and Consent Not Configured.
2. Add your CMP’s template. Featured CMPs have templates in the Community Template Gallery that use Tag Manager’s consent APIs.
3. Fire it on “Consent Initialization – All Pages”. Web containers include this trigger by default. Set defaults for all four v2 signals in the template.
4. Review built-in consent checks. Google Ads, GA4 and Floodlight tags adjust to consent on their own, so in advanced mode they can load and follow the consent state.
5. Add additional consent checks to other tags. Under Advanced Settings, Consent Settings, choose “Require additional consent for tag to fire” and add the consent types the tag needs.
6. Use Tag Manager’s consent APIs, not gtag updates. Google’s guide says not to use gtag(‘consent’,’update’) in place of updateConsentState inside Tag Manager.
7. Preview, test in Tag Assistant, then publish.

The three additional consent options in Tag Manager do different jobs:

Source: Tag Manager consent help.

One trap from practitioners: tags blocked by an additional consent check do not fire again on their own when consent arrives later on the same page. Simo Ahava covers this, and how to handle it with a consent update event, in his basic consent mode guide.

If you run server-side tagging, consent still starts in the browser. Our guide to server-side GTM hosting covers where consent handling fits on Stape and Cloud Run.

How do you check that consent mode is working?

Check consent mode in three places: Tag Assistant for the default and update states, the browser network tab for the gcs parameter on Google hits, and the Diagnostics tab of a Google Ads conversion action. Google’s verification guide recommends Tag Assistant first.

Use this verification checklist after every banner, CMP or container change:

1. Default state: in Tag Assistant, open the earliest Consent event. Under API Call, all four signals should be set. The On-page Default column should read Denied where your policy defaults to denied.
2. Update state: accept the banner, open the latest Consent event and check that On-page Update reads Granted. Repeat with “reject” and confirm the states stay denied.
3. Tag behavior: in the Tags tab, click each tag and confirm it fired or held back as your settings say.
4. Network hits: in Chrome DevTools, open the Network tab and filter for “google”. Google’s integration guide says Google tags include the consent state in requests through the gcs parameter.
5. The gcd parameter: Google hits also carry a gcd value. Google’s consent mode overview says gcd is always sent to Google services, whether or not consent mode is active, and that these fields may change as the services evolve. Stape decodes it from its own testing, so treat Tag Assistant as the source of truth.
6. Regions: set a different visitor location in Chrome and repeat the checks for each region with its own defaults, as the debugging guide suggests.
7. Google Ads: go to Goals, Conversions, Summary, open a website conversion action and select Diagnostics. The status can take 48 hours, and up to 2 weeks, to appear.
8. GA4: in Admin, under Data collection and modification, open Consent settings to see advertising and behavior consent signals for EEA traffic, per Analytics Help.

Google Ads shows two consent statuses in Diagnostics. “Consent mode is implemented” means setup works but modeling thresholds are not met yet. “Consent mode is implemented and modeling is active” means modeling has started, with uplift data shown per domain and country for 4 weeks.

What should a consent mode test plan include?

A consent mode test plan should cover every path a visitor can take, not only “accept all.” Run each scenario below in a fresh private window with Tag Assistant open, and record the On-page Default and On-page Update values for all four signals. A setup can pass the accept test and still fail the reject, partial or next-page checks.

Sources: Google’s consent mode setup guide and Tag Assistant consent troubleshooting guide, checked October 22, 2026.

Save each run with the date, CMP version and container version. Repeat the same table after any banner, theme or container change, so you can see exactly when a check started to fail.

What are the consent mode modeling thresholds?

Google Ads conversion modeling for consent mode needs 700 ad clicks over 7 days per country and domain grouping, per Google Ads Help. GA4 behavioral modeling needs 1,000 events a day with analytics_storage denied for at least 7 days, plus 1,000 daily users with analytics_storage granted on at least 7 of the previous 28 days.

Sources: Google Ads consent mode modeling, Troubleshoot consent mode, GA4 behavioral modeling.

Modeled conversions appear in the Conversions column and in Conversion value when you track values. Google’s modeling page also notes that consented users are typically 2 to 5 times more likely to convert than unconsented users, which is why a simple scale-up of consented data overstates results.

An account with fewer than 700 ad clicks a week in a country will not get conversion modeling for that country. For those accounts, the gap from denied consent stays in the data. Plan bids and reports around observed conversions rather than waiting for modeling.

Why did conversions or GA4 data drop after consent mode?

Conversions and GA4 data drop after consent mode because Google tags stop using cookies for visitors who deny consent. In basic mode, Google tags do not measure them at all. Some drop is expected. A large or sudden drop usually points to a setup error, such as wrong defaults or a missing update, rather than to visitor choices alone.

Work through these causes in order:

• Basic mode: tags never load for visitors who deny, so there is nothing to model in GA4.
• Thresholds not met: modeling has not started, so denied traffic simply disappears from reports.
• Denied defaults outside the banner’s regions: Tag Assistant Help warns that visitors from regions without a banner can be left with a denied default and no way to change it.
• Update sends the wrong values: the same help page says low consent rates can come from an update call that does not pass the correct states.
• Personalization conflict: ad_user_data and ad_personalization set to conflicting values turn personalization off.

If GA4, Google Ads and Meta now disagree, our guide to why Google Ads, Meta and GA4 report different ROAS walks through the other causes.

Common Google consent mode mistakes

The most common Google consent mode mistakes are timing and coverage errors: defaults set too late, defaults missing for one of the four v2 signals, and updates that only fire on “accept”. Google’s troubleshooting page lists these first, and they are where we start in audits.

1. Setting defaults asynchronously or late. Google says the default must be set before any tag uses consent. Tag Assistant flags this as “A tag read consent state before a default was set”.
2. Leaving out ad_user_data or ad_personalization. Defaults should cover all four signals, not only the two from v1.
3. Only updating on accept. Visitors must be able to grant and deny, and both choices need an update.
4. Calling gtag updates inside GTM. Use the Tag Manager consent APIs so the update applies in order.
5. Two tools writing consent. A CMP and a separate custom template both setting defaults can conflict. Pick one.
6. Legacy conversion tags. Tag Assistant Help says to check for legacy AWCT tags and replace them.
7. Assuming server-side tagging removes the need for consent. It does not. Stape corrects this point in its consent mode v2 guide, and the consent state set in the browser still travels with each hit.
8. Blocking Google tags in the CMP while claiming advanced mode. Advanced mode needs the tags unblocked, per Google’s setup page.

How does consent mode affect Google Ads tracking and remarketing?

Consent mode affects Google Ads in three ways, per the consent mode reference. When ad_storage is denied, Google writes no new ad cookies, so conversions depend on cookieless pings and modeling. A denied ad_user_data signal stops user-provided data, which enhanced conversions rely on. A denied ad_personalization signal keeps that visitor’s data out of remarketing.

• Conversion tracking: our Google Ads conversion tracking guide covers tag setup, statuses and testing, with consent mode as one part of it.
• Enhanced conversions: the Google Ads consent mode reference lists ad_user_data as required for enhanced conversions. See our enhanced conversions and Meta CAPI setup guide.
• Remarketing: if lists stopped growing after v2, read our guide to Google Ads remarketing, which covers how denied consent keeps users off lists.

Does consent mode cover offline conversion imports and Customer Match?

No. Google consent mode only covers hits sent by the Google tag and Google Tag Manager on your site. Data you upload later, such as offline click conversions, Customer Match lists and GA4 Measurement Protocol events, carries its own consent fields. If those fields are empty, EEA data can go unused even when the website setup is correct.

This matters most for lead generation accounts that import qualified leads or closed sales from a CRM. The table shows the consent field each upload path uses.

A practical fix is to store the visitor’s consent state in your CRM next to the GCLID when the form is submitted. Your import or connector can then pass the real value instead of a blanket default. Before you rely on a connector or automation tool, confirm it has a consent field at all.

How we set up and audit consent mode

When we take over a Google Ads account with EEA, UK or Swiss traffic, consent mode is one of the first tracking checks. Our client work is covered by signed NDAs, so this guide shares the process we follow rather than client names or results.

1. Map the traffic. We check which countries send clicks and conversions, so defaults match the regions the banner actually covers.
2. Read the banner, then the tags. We open Tag Assistant, record default and update states for all four signals, and test both accept and reject.
3. Check the network hits. We confirm the gcs value changes after a choice and that the site writes no ad cookies before consent where defaults are denied.
4. Check Google Ads Diagnostics. We note the consent status on each primary conversion action and whether the account can reach the 700-click modeling threshold.
5. Write down the mode. The client’s legal or privacy lead signs off basic or advanced mode. We do not choose it for them.
6. Re-test after changes. Any CMP, theme or container update gets the same checks again.

Want this done for your account? Our PPC management service includes conversion tracking checks, and our Google Ads agency page explains how we work.

Get Free Audit Worth $500

Why choose Hustle Marketers for tracking work?

Hustle Marketers is a Google Partner, Meta Business Partner and Microsoft Advertising Partner founded in 2020 by Ishant Sharma, who has worked in Google Ads, Microsoft Ads and SEO since 2013. Our delivery team is in Zirakpur, India, and we serve clients worldwide.

• Pricing: PPC management is $600 to $800 per platform per month, month to month.
• Ownership: you own your ad accounts, GA4, Search Console and Google Business Profile.
• Reviews: 591+ reviews across Google, Trustpilot, Clutch, G2, DesignRush, Upwork and other platforms, and Clutch Award wins in 2023, 2024 and 2026.
• Free tools: try our free marketing tools, or read our open-source SEO and Google Ads code on GitHub.

Google consent mode FAQs

Is Google consent mode mandatory?

Google consent mode is a Google requirement for EEA traffic. Google asks advertisers to pass consent choices for EEA users, through consent mode or the IAB TCF, to keep ad personalization and measurement for those users. Whether you need consent at all is set by privacy law, so ask your counsel.

Is consent mode the same as a cookie banner?

No. A cookie banner or CMP collects the visitor’s choice. Consent mode passes that choice to Google tags. You need both, and Google’s consent mode does not provide a banner.

Does Google consent mode make my site GDPR compliant?

No tool makes a site compliant on its own. Consent mode only controls how Google tags behave after you collect consent. Google’s policy help page says adopting a Google-certified CMP does not guarantee compliance with its EU user consent policy.

What is the difference between consent mode and the IAB TCF?

Consent mode is Google’s API for passing consent states to Google tags. The IAB Transparency and Consent Framework is an industry standard for passing consent to many ad vendors. Google accepts either for advertisers, and its modeling page lists both as eligible.

Can I switch from basic to advanced consent mode later?

Yes. Switching means unblocking Google tags in your CMP and letting them load with default states. Get sign-off first, then re-run the verification checklist, because the data sent before consent changes.

How long does consent mode take to show in Google Ads?

The Diagnostics status can take 48 hours, and up to 2 weeks, to appear. Impact results need at least 7 full days of consent mode plus enough data in each country and domain slice.

Do I need consent mode v2 if I only advertise in the US?

Not for Google’s EU user consent policy, which covers the EEA, the UK and Switzerland. If you use consent mode for US visitors anyway, set region-specific defaults so US visitors are not left denied with no banner.

Does Google Signals still control what GA4 sends to Google Ads?

No. From June 15, 2026, consent mode ads settings control whether Google Ads cookies and identifiers are collected through the Analytics tag. Google Signals now only links Analytics data to signed-in users for behavioral reporting, according to Google Analytics Help.

Do Google Ads phone call conversions support consent mode?

Not yet in full. Google’s consent mode overview lists the Google tag, Google Analytics, Google Ads conversion tracking and remarketing, Floodlight and Conversion Linker as having built-in consent checks, but says support for phone call conversions is pending. Review call tracking separately when you audit consent.

How we created this guide

We rebuilt this guide on 14 October 2026 from Google’s developer documentation and Google Ads, Analytics, Tag Manager and AdSense Help pages, each opened and checked on that date. A person on our team checks every parameter, threshold and date before the guide goes live. Changes: added consent mode v2 signals, basic vs advanced comparison, gtag and GTM steps, verification checklist, modeling thresholds and common mistakes; removed claims we could not verify.

Need consent mode checked alongside your conversion tracking? Get Free Audit Worth $500