Google Consent Mode v2 in practice: order, signals and checks

Most small business websites in Europe now show a cookie banner, and many of them also run Google Analytics or Google Ads. Between the two sits Google Consent Mode, the part that tells Google's tags what the visitor decided. When it is set up badly, nothing looks broken: the banner appears, the buttons work, and the reports still fill. The problems are invisible. Tags fire before the visitor has chosen, a returning visitor who said yes is counted as a no, or a "Reject all" never reaches the advertising tags. This guide explains how Consent Mode v2 works in practice, in what order things must happen, and how to check your own site in five minutes. It is a technical guide, not legal advice; for what the law asks of a small site, see our guide to GDPR and cookies.

#What Consent Mode is, and what it is not

Consent Mode is a small vocabulary that Google's tags understand. Your site tells the tags, for each purpose, whether storage is "granted" or "denied", and the tags change their behaviour. With analytics denied, Google Analytics sets no cookies. With advertising denied, Google Ads sets no advertising cookies and does not use the visit for personalised ads.

What Consent Mode does not do is ask anyone anything. It has no banner, it stores no choice, and it does nothing for tags that are not Google's, such as a Meta pixel or a heatmap script. Those still need to be held back by your banner until the visitor agrees. Consent Mode is the wire between your banner and Google; the banner is still your job.

#The seven signals

Version 2 has seven signals. The first four matter most:

• ad_storage: cookies for advertising;
• ad_user_data: whether data about the visitor may be sent to Google for advertising;
• ad_personalization: whether the visit may be used for personalised advertising, such as remarketing;
• analytics_storage: cookies for analytics, such as visit duration;
• functionality_storage and personalization_storage: storage for features and preferences, such as a chosen language;
• security_storage: storage for security, such as fraud prevention, which is normally always granted.

The "v2" in the name refers to ad_user_data and ad_personalization. Since March 2024 Google has asked sites that use its advertising features for visitors in the European Economic Area to send them; without them, those features stop using the data. A banner set up before 2024 often sends only the old two signals.

A simple banner with three categories maps onto them like this: "Marketing" controls the three ad signals, "Analytics" controls analytics_storage, and "Preferences" controls the two functionality signals.

#Order is everything

The single most common mistake is order. The default state must be set before any Google tag loads. If Google Analytics is hard-coded in the theme's header and the banner script comes later, the first hit of every visit leaves before anyone has said what is allowed.

The default goes inline at the very top of <head>. It should not be "denied for everyone, always": a returning visitor who accepted analytics yesterday should be counted correctly from their first page today. So the default reads the stored choice first, and only falls back to "denied":

window.dataLayer = window.dataLayer || [];
function gtag() { dataLayer.push(arguments); }

const stored = (() => {
  const m = document.cookie.match(/(?:^|; )consent=([^;]*)/);
  try { return m ? JSON.parse(decodeURIComponent(m[1])) : {}; } catch (e) { return {}; }
})();
const state = (on) => (on === true ? 'granted' : 'denied');

gtag('consent', 'default', {
  ad_storage: state(stored.marketing),
  ad_user_data: state(stored.marketing),
  ad_personalization: state(stored.marketing),
  analytics_storage: state(stored.analytics),
  functionality_storage: state(stored.preferences),
  personalization_storage: state(stored.preferences),
  security_storage: 'granted',
  wait_for_update: 500,
});

wait_for_update gives the banner up to 500 milliseconds to send an update before tags that are already waiting go ahead with the defaults. When the visitor makes a choice, the banner sends an update with the same signals and pushes an event, so Tag Manager triggers that depend on consent can fire at that moment:

function onChoice(choice) {
  gtag('consent', 'update', {
    ad_storage: state(choice.marketing),
    ad_user_data: state(choice.marketing),
    ad_personalization: state(choice.marketing),
    analytics_storage: state(choice.analytics),
    functionality_storage: state(choice.preferences),
    personalization_storage: state(choice.preferences),
  });
  dataLayer.push({ event: 'consent_updated' });
}

We ran both parts with a stored choice of "analytics yes, marketing no": the default sends analytics granted and the three ad signals denied, and a later "Accept all" sends an update with all of them granted, followed by the event.

#Basic or advanced

Google describes two ways to use all this:

• Basic consent mode: Google's tags are not loaded at all until the visitor agrees. Nothing is sent to Google before consent, and nothing is sent after a refusal.
• Advanced consent mode: the tags load straight away with the denied defaults. While consent is denied they set no cookies but send cookieless pings, which Google uses for modelling conversions and visits.

Advanced mode gives fuller reports; basic mode sends less. Which one fits your site is a decision for you and whoever advises you on privacy, not a technical detail. Technically, the difference is only whether the Google tag itself waits for consent like any other script.

Two optional settings are worth knowing. ads_data_redaction removes advertising identifiers from requests while ad_storage is denied. url_passthrough carries click identifiers in links instead of cookies, which some sites with ads want and others do not.

#How to check your own site

Open the site in a private window, with the browser's developer tools on the Network tab, and work through this list:

1. Before you click anything, type dataLayer in the console. The first entry should be the consent default, before any config or gtm.js entry.
2. Look at the requests to Google Analytics (they go to a google-analytics.com address). Each carries a gcs parameter with the state: G100 means both ad and analytics storage are denied, G111 both granted.
3. Check the cookies under Application. With nothing accepted, there should be no _ga cookie and no advertising cookies.
4. Click "Reject all" and reload. The defaults should still be denied, and no pixel or heatmap should load.
5. Accept analytics only, reload, and check that the first request already carries analytics granted. This is the returning visitor case most setups get wrong.
6. Withdraw consent from the banner's settings link. Analytics cookies should disappear, not just stop updating.

#Mistakes we see on small sites

• A tag in the theme or a second plugin that loads before the defaults.
• Only the two old signals, so advertising features get no consent for EEA visitors.
• "Reject all" hidden in a second layer or styled as a faint link, while "Accept all" is a big button.
• Pixels and embedded videos that load regardless of the choice, because Consent Mode was assumed to cover them.
• No way to change the choice later, and cookies that stay after a withdrawal.

#A banner that does it this way

We built these rules into Biskvitka, a cookie consent banner for small business websites, as a WordPress plugin and as plain JavaScript for any other site. "Reject all" sits next to "Accept all" and looks the same, and a dialog lets visitors choose by purpose. The Consent Mode defaults are printed first in <head> from the visitor's stored choice, and every choice sends an update with all six purpose signals and an event for Tag Manager. If you enter a Google Analytics or Tag Manager id, it loads right after the defaults; if you would rather keep Google's tag waiting for consent, you can hold it like any other script. Other trackers and embedded videos and maps wait until their category is allowed, cookies of refused categories are deleted, and a consent log keeps each choice without IP addresses. It is in English and Bulgarian, tested with an end-to-end run on WordPress 7.1.3 and browser tests in Chrome, and listed as Coming soon.

#Frequently asked questions

Does Consent Mode make my site compliant?

No. It only passes the visitor's choice to Google's tags. You still need a banner that asks properly, scripts that wait for consent, and a cookie policy. Check your obligations with someone who knows them.

Do I need Consent Mode if I do not use Google Ads?

If you use Google Analytics or Tag Manager, Consent Mode is how they learn about the choice, so it is worth setting up. If you use no Google tags at all, it does nothing for you.

Why are my visit numbers lower after adding a banner?

Because visitors who refuse are no longer counted with cookies. In advanced mode Google models part of the gap; in basic mode those visits are simply not measured.

Where should the consent default go if I use Tag Manager?

Either inline in <head> before the Tag Manager snippet, as above, or in a tag on Tag Manager's Consent Initialization trigger, which fires before other triggers.

#Sources

• Google: consent mode overview, basic and advanced
• Google: set up consent mode on websites