Google Consent Mode v2 is now a requirement for any website running Google Ads, Google Analytics, or other Google marketing services in the European Economic Area. Without a proper implementation, your Google tags lose access to conversion modeling, remarketing audiences, and behavioral data, directly impacting your ad performance and measurement accuracy.

This guide walks through what Consent Mode v2 is, why it matters, and how to implement it correctly.

What Is Google Consent Mode v2

Consent Mode is a framework that lets your website communicate user consent choices to Google tags in real time. When a user interacts with your cookie banner, Consent Mode sends a signal to Google indicating which types of data collection are permitted.

Version 2, introduced in late 2024, added two new parameters and made the framework mandatory for EEA advertisers:

Existing parameters:

analytics_storage: Controls whether analytics cookies (like those from Google Analytics) can be set
ad_storage: Controls whether advertising cookies (like those from Google Ads) can be set

New in v2:

ad_user_data: Controls whether user data can be sent to Google for advertising purposes
ad_personalization: Controls whether personalized advertising (remarketing, interest-based ads) is enabled

All four parameters accept two values: granted or denied.

Why Google Requires It

Google's implementation of Consent Mode v2 is driven by two forces:

Regulatory compliance. The EU Digital Markets Act designates Google as a gatekeeper platform and requires it to obtain proper consent before processing user data for advertising. Consent Mode is Google's mechanism for receiving and respecting those consent signals from publishers and advertisers.

Data quality. When consent is denied, Google tags switch to a privacy-preserving mode that sends cookieless pings instead of full tracking data. Google uses this limited signal, combined with machine learning, to model conversions and fill gaps in your data. Without Consent Mode, Google receives no signal at all when consent is denied, resulting in worse conversion modeling and less accurate reporting.

How Consent Mode Works

The flow follows two stages:

Default State (Page Load)

When a page loads, before the user interacts with the consent banner, you set the default consent state. This tells Google tags how to behave initially:

gtag('consent', 'default', {
  'analytics_storage': 'denied',
  'ad_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied',
  'wait_for_update': 500
});

The wait_for_update parameter tells Google tags to wait up to 500 milliseconds for a consent update before firing. This gives your consent banner time to load and check for stored consent preferences from a previous visit.

Update State (After User Choice)

When the user makes a consent choice, accepting all, rejecting all, or customizing preferences, you fire an update command:

// User accepted analytics but rejected ads
gtag('consent', 'update', {
  'analytics_storage': 'granted',
  'ad_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied'
});

Google tags react immediately to this update. If analytics_storage changes to granted, the GA4 tag sets its cookies and starts collecting full behavioral data. If ad_storage remains denied, Google Ads tags send cookieless pings that feed into conversion modeling.

Implementation: Step by Step

Step 1: Set Up the Default State

The consent default must fire before any Google tags. In practice, this means placing it in the <head> of your page, above your Google Tag Manager or gtag.js snippet.

<script>
  // Set defaults before any Google tags load
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}

  gtag('consent', 'default', {
    'analytics_storage': 'denied',
    'ad_storage': 'denied',
    'ad_user_data': 'denied',
    'ad_personalization': 'denied',
    'wait_for_update': 500
  });
</script>

<!-- Google Tag Manager or gtag.js loads after -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX"></script>

Setting all parameters to denied by default is the safest approach for GDPR compliance. This ensures no tracking occurs until the user provides consent.

Step 2: Integrate with Your Consent Banner

Your consent management platform needs to fire the consent update command when the user makes a choice. The mapping from your CMP's categories to Consent Mode parameters typically looks like this:

| CMP Category | Consent Mode Parameters | |-------------|------------------------| | Necessary | No update needed (always allowed) | | Analytics | analytics_storage | | Marketing / Advertising | ad_storage, ad_user_data, ad_personalization |

When your CMP fires a callback after the user's choice, translate it into a consent update:

// Example: CMP callback after user choice
function onConsentUpdate(preferences) {
  gtag('consent', 'update', {
    'analytics_storage': preferences.analytics ? 'granted' : 'denied',
    'ad_storage': preferences.marketing ? 'granted' : 'denied',
    'ad_user_data': preferences.marketing ? 'granted' : 'denied',
    'ad_personalization': preferences.marketing ? 'granted' : 'denied'
  });
}

Step 3: Handle Returning Visitors

When a user returns to your site, their previous consent choice should be loaded from storage and applied immediately, ideally within the wait_for_update window. This prevents a flash where the consent banner appears again and Google tags wait unnecessarily.

// Check for stored consent on page load
const storedConsent = getStoredConsentPreferences();

if (storedConsent) {
  gtag('consent', 'update', {
    'analytics_storage': storedConsent.analytics ? 'granted' : 'denied',
    'ad_storage': storedConsent.marketing ? 'granted' : 'denied',
    'ad_user_data': storedConsent.marketing ? 'granted' : 'denied',
    'ad_personalization': storedConsent.marketing ? 'granted' : 'denied'
  });
}

Step 4: Enable URL Passthrough and Ads Data Redaction (Optional)

Two additional settings improve data quality when consent is denied:

gtag('set', 'url_passthrough', true);
gtag('set', 'ads_data_redaction', true);

URL passthrough appends ad click information (gclid, dclid) to outbound links, preserving attribution data across pages without cookies.

Ads data redaction ensures that when ad_storage is denied, ad identifiers in requests are redacted rather than just not stored, providing an additional privacy safeguard.

Testing Your Implementation

Proper testing is critical. A misconfigured Consent Mode setup either leaks data without consent or unnecessarily blocks data collection.

Google Tag Assistant

Google Tag Assistant (the Chrome extension or the Tag Assistant panel in GTM) shows you the current consent state and how each tag is responding. Look for:

The default consent state fires before any tags
The update consent state fires after banner interaction
Tag behavior changes correctly (cookies set only when granted)

Browser Developer Tools

Open the Network tab and filter for requests to google-analytics.com or googleads.g.doubleclick.net. With consent denied, you should see requests with the gcs parameter indicating consent status. No cookies should be set on the google-analytics.com domain.

Real-Time Reports

In Google Analytics 4, check the Real-time report. Before granting consent, you should see cookieless events arriving (if you have configured your GA4 tag to fire in consent-denied mode). After granting consent, you should see full events with user identification.

Common Pitfalls

Default state fires after Google tags. If your gtag or GTM snippet loads before the consent default is set, Google tags briefly operate without any consent signal. Always ensure the default command is in the HTML above any Google script tags.

Not updating all four parameters. Some implementations only update analytics_storage and ad_storage, forgetting the two new v2 parameters. Google checks all four, and missing parameters default to the last known state.

Using GTM's built-in consent without custom configuration. Google Tag Manager has built-in consent features, but they require proper trigger configuration. Simply enabling consent mode in GTM settings without configuring your tags to respect consent signals does nothing.

Not testing after CMP updates. When you update your consent banner text, categories, or styling, always re-test the Consent Mode integration. CMP updates can inadvertently change callback timing or parameter naming.

Forgetting about server-side tagging. If you use server-side GTM, consent signals need to propagate to your server container as well. The server-side client must forward consent parameters to Google endpoints.

Consent Mode and Conversion Modeling

When ad_storage is denied, Google Ads cannot measure conversions directly. Instead, it uses the cookieless pings from Consent Mode (combined with aggregated data from users who did consent) to build a statistical model of conversions.

This conversion modeling typically recovers 50-70% of the conversions that would otherwise be lost due to consent rejection. The accuracy improves with higher traffic volumes and higher consent rates. Without Consent Mode, the recovery rate is zero: those conversions simply vanish from your reports.

Getting Started with Conseto

Conseto handles Consent Mode v2 automatically. When a user interacts with the Conseto consent banner, all four consent parameters are updated in real time: no manual gtag configuration or CMP callbacks needed. One script manages your consent banner, analytics, and Google Consent Mode integration together. See it in action at conseto.io.

Google Consent Mode v2: Setup Guide for 2026