Consent Mode v2: Setup, Modes and How to Verify It

Consent Mode v2 is the way your cookie banner tells Google's tags what a visitor agreed to. If it is missing or broken, your ad platforms lose audience and conversion data, and you may be sending data you promised not to. This guide explains what the signals mean, the difference between basic and advanced mode, and exactly how to check yours.

This is a technical guide, not legal advice. What you must ask consent for depends on your visitors and your jurisdiction, so decide that with whoever advises you on privacy.

What Consent Mode v2 is

Consent Mode is a set of signals your site passes to Google tags. Each signal is either granted or denied, and Google's tags adjust how they behave to match. According to Google's developer documentation, there are four:

• ad_storage: whether advertising cookies can be set.
• analytics_storage: whether analytics cookies can be set.
• ad_user_data: whether user data can be sent to Google for advertising purposes. Added in v2.
• ad_personalization: whether data can be used for personalized advertising, such as remarketing. Added in v2.

Google introduced v2 in November 2023. The two new signals are why Google Ads and GA4 sometimes show warnings about missing consent signals even when a banner exists. If your banner or setup predates v2 and was never updated, it sends only the first two.

Consent Mode does not collect consent. Your consent banner, called a CMP, does that. Consent Mode is the pipe that carries the result to Google's tags.

Basic vs advanced mode

Google describes two ways to implement it in its consent mode overview.

Basic mode. Google tags do not load until the visitor interacts with the banner. If they decline, no data goes to Google, not even the consent status. Modeling in Google Ads then uses a general model.

Advanced mode. Tags load when the page opens, with consent defaulting to denied. While consent is denied, tags send cookieless measurements that carry limited, non-identifying information, such as the consent state. When the visitor grants consent, cookies are written and full measurement data is sent. Google says this enables an advertiser-specific model for conversion modeling instead of a general one.

The practical difference is how much you can recover from visitors who decline. Advanced mode gives Google something to model from. Basic mode gives it nothing. Whether advanced mode is acceptable for you is a privacy decision, so confirm it with your advisor before choosing.

Step 1: Set the defaults before anything else

Defaults must run before any tag measures. In GTM, this means a consent-aware banner template (most major CMPs have one in the Community Template Gallery) fired on the Consent Initialization - All Pages trigger, which runs before other tags.

If you set it by hand with gtag, the shape is:

gtag('consent', 'default', {
  'ad_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied',
  'analytics_storage': 'denied'
});

Set all four. Google's guide says to call this on every page, before any config or event command.

If your banner loads asynchronously, add wait_for_update, in milliseconds, so tags give the banner time to send its update:

gtag('consent', 'default', {
  'ad_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied',
  'analytics_storage': 'denied',
  'wait_for_update': 500
});

You can also set regional defaults using the region parameter. A more specific region overrides a broader one, and a default without a region applies to everyone not covered by a regional default.

Step 2: Send an update when the visitor chooses

When the visitor accepts, the banner must send an update:

gtag('consent', 'update', {
  'ad_user_data': 'granted',
  'ad_personalization': 'granted',
  'ad_storage': 'granted',
  'analytics_storage': 'granted'
});

The same command with denied handles a withdrawal. Google also says to store the choice, for example in a first-party cookie, so the right state applies on later page loads.

Inside Google Tag Manager, Google recommends consent APIs in templates (setDefaultConsentState and updateConsentState) instead of raw gtag commands, because gtag calls are queued and may not run before the next event. In practice, use your CMP's official GTM template.

Step 3: Require consent on your tags

In GTM, open Admin, Container settings and enable consent overview. Then check each tag's Consent settings. Google's own tags have built-in checks. For non-Google tags (Meta Pixel, LinkedIn Insight), set additional consent requirements manually, for example ad_storage, otherwise they fire regardless.

Step 4: Verify it in Tag Assistant

Google's guide to verifying consent mode gives this procedure, which we follow on every audit. Use Chrome with the Tag Assistant Companion extension.

1. Open Tag Assistant, enter your URL, connect, and load the page in a fresh incognito window so no earlier choice is stored.
2. Check the default. In the Summary, select the earliest Consent event. In the API Call tab, confirm all four parameters were set. Or open a tag's Output, then the Consent tab, and look at the On-page Default column.
3. Accept in the banner.
4. Check the update. Select the latest Consent event. Confirm the same four parameters changed. The On-page Update column shows the same.
5. Check tag behavior. In the Summary Tags tab, open a tag and confirm it behaved according to the consent state: held back before consent in basic mode, or sending cookieless measurements in advanced mode.
6. Repeat after declining, in a new incognito window. Confirm denied stays denied and that marketing tags did not fire.
7. If you use regional defaults, repeat with simulated locations.

You can also confirm in GA4 DebugView and in browser dev tools, Network tab, that Google requests carry a consent state parameter. Treat the Tag Assistant result as the primary evidence.

Common breakages

These come straight from the failures Google lists, plus ones we meet often:

• Empty Consent tab. Consent mode is not implemented on the page at all.
• Default not set, or set only for some signals. Set all four. A banner that only sets ad_storage and analytics_storage is a v1 setup.
• Default set too late. If a tag reads or writes a cookie before the default runs, Tag Assistant reports an error. The default code has to be first, on Consent Initialization.
• Defaults set asynchronously. Do not set defaults after a delay or from a script that loads late.
• Update cannot go both ways. Every signal with a default needs an update path that can set both granted and denied.
• Consent commands in a Custom HTML tag. Google advises against this in GTM. Use a consent template.
• Regional defaults that cover only some signals. Regional rules must cover all parameters.
• Non-Google tags ignoring consent. Meta and other pixels fire anyway unless you add requirements.
• Banner works but choice is not remembered. Visitors see the banner on every page, and tags run in a denied state for returning users who already accepted.
• Two banners. A theme plugin and a CMP both set defaults, and the last one wins unpredictably.

Optional settings worth knowing

Google documents two more commands. url_passthrough keeps ad click information in URLs when cookies are denied. ads_data_redaction removes ad click identifiers when ad_storage is denied. Both are set with gtag('set', ...), or gtagSet in a GTM template. Use them if your privacy advisor agrees.

A short checklist

• One CMP, one source of defaults
• Defaults for all four signals on Consent Initialization
• wait_for_update if the banner loads late
• Update on accept, on reject and on withdrawal
• Choice stored for return visits
• Non-Google tags have consent requirements
• Verified in Tag Assistant for default, accept and decline paths

If your Google Ads account is flagging missing consent signals, the cause is almost always one of the breakages above. If you also track Calendly bookings, see our Calendly guide to make sure those events respect the same consent state.