Consent Mode v2 is a mechanism that passes the user’s decision from the cookie banner to Google tags. The tags adjust their behavior to match it. You already have a banner, but you see gaps in your Google Analytics data and Google Ads keeps throwing consent warnings?
Then the problem almost always sits where the banner meets the tags. Below we describe how Google’s consent mode works and which variant to choose. We also show how to set it up in GTM or in gtag.js and how to check that everything works.
Table of contents
What is Consent Mode v2 and what does it not take care of?
Consent Mode v2 is the channel through which the cookie banner passes the consent state to Google. Analytics tags, Ads tags and third-party tools change how they work based on it. This is how the Google Ads help page on consent mode describes it: the mechanism receives the choice from the banner or widget and dynamically adapts the behavior of tags that create or read cookies. The consent state also travels with the user to subsequent pages, so there is no need to set it again.
And this is where a misunderstanding often comes up. The banner and consent mode are two separate things: the banner collects the decision, and Consent Mode only delivers it to the tags. So Consent Mode alone will not make you GDPR compliant. You handle the legal basis, the banner wording and the consent log separately, and as a starting point I recommend reading what cookie consent under GDPR looks like.
Which consent signals does the cookie banner pass to Google tags?
Google tags read several consent parameters. For advertising, ad_storage matters most. Each parameter has the value granted or denied, nothing in between:
- ad_storage - storing and reading advertising cookies,
- analytics_storage - cookies for traffic measurement,
- ad_user_data - consent to send user data to Google for advertising purposes,
- ad_personalization - consent to personalized ads, including remarketing.
ad_storage denied: what does it mean in practice?
When consent is denied, no new advertising cookies are created. Previously stored third-party cookies from google.com and doubleclick.net are not used either (the exception is fighting spam and abuse). But watch out. As the Google guide for developers points out, the full page URL still reaches Google, along with the ad click parameters. Want to cut that off? Turn on ads_data_redaction. Then, when consent is denied, click identifiers disappear from Ads and Floodlight tag requests, and the requests themselves go through a domain without third-party cookies.
The same setting also decides what cookie consent means for Google Ads. ad_storage decides whether cookies and advertising identifiers collected by the Analytics tag can reach the advertising account at all.
Basic or advanced Consent Mode: which one to choose?
In basic mode, Google tags do not fire before consent. In advanced mode they load right away, and when consent is denied they send cookieless pings. Without consent, the basic variant passes nothing to Google, not even the status itself. Conversion modeling in Ads then relies on a general model.
In the advanced variant, the tags load the consent mode API when the user lands on the page. The user declines? The tags do not store cookies, they only send cookieless signals about the consent state and activity. Oh, and in the paid version of Google Analytics this does not add extra events or push up event-based billing.
In my opinion, the choice should follow from a legal assessment and from how the company approaches sending any data at all without consent. Not from the mere wish to get the statistics back. And nobody honest will tell you upfront what share of conversions will come back.
Setting up Consent Mode in GTM step by step
The whole setup comes down to two things: setting the default consent state before the tags load, and updating it the moment the user clicks in the banner. In Google Tag Manager the order looks like this:
- The Google tag on every page of the site.
- Default denied for all parameters, set before the other tags (the consent initialization trigger).
- The banner sends the update command right after the user’s decision.
- GA4 and Ads tags use built-in consent handling, and tags from other vendors get additional consent conditions in their settings.
- A test in preview mode, described in the next section.
It can be done without GTM too. The consent mode code then goes directly into gtag.js on every page. This is how the banner on web-systems.pl works: it is a custom solution that sets denied by default for gtag and changes the state only after the user makes a choice.
How to check that the cookie banner, Google Analytics and Ads work together?
You check this in GTM preview mode and in the browser’s developer tools, looking at the consent state before and after the click in the banner. Three things to tick off: default denied before the first interaction, a change to granted after acceptance, and zero new advertising cookies after a refusal.
Typical slip-ups? Default consent set only after the tags. A banner that does not send the update. Third-party tags fired without a consent condition. And you have to wait for the results in reports: according to the description of the consent mode impact report, Google Ads and Analytics can show an uplift after at least 7 full days, and only with enough data. If the warnings in your advertising account mean your conversions need tidying up, Google Ads campaign management by a team that knows both sides of the configuration will help.
What to do about gaps in statistics after adding the banner?
Less data in GA4 after adding the banner is simply the result of denied consent. Consent Mode v2 partly patches these gaps with modeling, but it will not restore the full picture. So the numbers in Analytics will drift apart from the sales system, which sees every order. And that is normal. The simplest approach is to agree within the company that the source of truth for revenue is the store or the CRM, and GA4 is for trends and the proportions between channels.
Companies that prefer to keep their data in-house look toward analytics without Google Analytics, for example a self-hosted Matomo instead of GA. The technical details are covered on the page about Matomo analytics implementation. Just remember that such a tool also has to be assessed under GDPR.
Where to start? With one thing: check whether the default consent state is set before all the tags. Without that, even a properly configured Consent Mode v2 will not work the way you expect.
Frequently asked questions
Is Consent Mode v2 enough to make a website GDPR compliant?
No. Consent mode only passes the user’s decision to Google tags. Collecting consent, its wording and documenting it are a separate obligation of the website’s data controller.
Does Google Analytics collect nothing when consent is denied?
It depends on the mode. In basic mode the tags are blocked and nothing reaches Google. In advanced mode the tags send cookieless pings with information about the consent state and activity.
Do I have to use Google Tag Manager?
No, you can set up consent mode directly in gtag.js on every page. GTM does come in handy when you have many tags, because it lets you manage them and their consent conditions in one place.
