# Google Consent Mode v2: a complete implementation guide

> How to implement Google Consent Mode v2: the four consent signals, gtag default and update commands, Tag Manager setup, regional defaults and testing.

Source: https://www.cookiesh.eu/blog/google-consent-mode-v2-guide  
Published: 2026-06-30

## Key takeaways

- Google Consent Mode v2 uses four core signals: ad_storage, analytics_storage, ad_user_data and ad_personalization.
- Set a denied consent default before any Google tag loads, then send an update as soon as the visitor makes a choice.
- Since March 2024, Google has required consent mode signals for EEA traffic to use its ads measurement and personalization features.
- Consent Mode only passes the visitor's choice to Google tags; it does not collect consent or gate other vendors' scripts.

Google Consent Mode v2 is a set of signals that tells Google tags whether a visitor has agreed to advertising and analytics storage, and whether their data may be used for ads. You implement it by setting denied defaults before any Google tag loads, then sending an update when the visitor makes a choice in your consent banner.

## What is Google Consent Mode v2?

Consent Mode is Google's API for passing a visitor's consent choices to Google tags such as Google Analytics 4 (GA4), Google Ads and Floodlight. It doesn't show a banner or collect consent itself. It adjusts how Google tags behave based on the state your consent management platform (CMP) reports.

Version 2 added two parameters to the original pair. These are the four signals you need to set:

| Parameter | What it controls |
|---|---|
| `ad_storage` | Whether cookies and similar storage can be used for advertising |
| `analytics_storage` | Whether storage can be used for analytics, such as visit duration |
| `ad_user_data` | Whether user data may be sent to Google for advertising purposes |
| `ad_personalization` | Whether data may be used for personalized advertising, such as remarketing |

Each parameter takes `'granted'` or `'denied'`. Google also defines `functionality_storage`, `personalization_storage` and `security_storage`, which are mostly useful for mapping consent to other tags in Google Tag Manager (GTM).

## Why does Consent Mode v2 matter?

Since March 2024, Google has required consent mode signals for traffic from the European Economic Area (EEA) to use its ads measurement and personalization features. If Google tags don't receive `ad_user_data` and `ad_personalization`, features like remarketing audiences and some conversion measurement are restricted for those visitors.

That is a Google policy, not a law. The legal duty to ask before storing or reading information on a device comes from Article 5(3) of the ePrivacy Directive and the national laws that implement it, combined with the GDPR's standard for [valid consent](/blog/valid-consent-checklist). Consent Mode is simply how you carry that decision into Google's systems.

## How do I set the consent default?

Call `gtag('consent', 'default', ...)` before the Google tag or GTM container loads, with every parameter set to `'denied'` wherever opt-in consent is required. Order matters: a default that arrives after a tag has already fired is too late.

```html
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag() { dataLayer.push(arguments); }

  gtag('consent', 'default', {
    ad_storage: 'denied',
    ad_user_data: 'denied',
    ad_personalization: 'denied',
    analytics_storage: 'denied',
    wait_for_update: 500
  });
</script>
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"></script>
<script>
  gtag('js', new Date());
  gtag('config', 'G-XXXXXXXXXX');
</script>
```

`wait_for_update` is the number of milliseconds Google tags wait for a consent update before proceeding with the default state. It gives your CMP time to load and apply a returning visitor's stored choice.

If you serve visitors in several jurisdictions, you can add a `region` array of ISO 3166-2 codes to a default command, for example to deny by default in the EEA and UK while using different defaults elsewhere. Keep a default without `region` as the fallback, and check with your legal team before granting anything by default.

## How do I update consent after the visitor chooses?

When the visitor accepts, rejects or saves preferences, call `gtag('consent', 'update', ...)` with the new state. Map your banner's categories to Google's signals in one place:

```js
// Call this whenever the visitor saves a choice in your banner
function applyConsent(choices) {
  const ads = choices.marketing ? 'granted' : 'denied';

  gtag('consent', 'update', {
    ad_storage: ads,
    ad_user_data: ads,
    ad_personalization: ads,
    analytics_storage: choices.analytics ? 'granted' : 'denied'
  });
}
```

Run the same update on every page load for returning visitors, as early as possible, using the choice your CMP stored. Without it, each new page falls back to the denied default.

When a visitor withdraws consent, send an update with `'denied'`. Under Article 7(3) of the GDPR, withdrawing must be as easy as giving consent, so keep a visible way to reopen the banner.

Mapping all three ad signals to one marketing category is a common, simple approach. If your banner offers separate toggles for ad measurement and ad personalization, map them individually instead.

## How do I set up Consent Mode in Google Tag Manager?

In GTM, use a CMP template, from the Community Template Gallery or your vendor, that fires on the Consent Initialization – All Pages trigger. The template calls GTM's `setDefaultConsentState` and `updateConsentState` APIs, so you don't write gtag code yourself.

Then work through these steps:

1. Enable the consent overview in your container settings so you can review consent settings tag by tag.
2. Confirm that Google tags (GA4, Google Ads, Floodlight) rely on their built-in consent checks.
3. Add additional consent checks to non-Google tags, such as a Meta or LinkedIn pixel, so they fire only when the matching consent is granted.
4. Remove old triggers that fire tags on all pages without any consent condition.
5. Publish, then test everything in Preview mode.

Step 3 is the one teams forget. Consent Mode only governs Google tags; every other vendor still has to be [blocked until consent](/blog/block-scripts-until-consent).

## How do I verify Consent Mode is working?

Open GTM Preview or Google Tag Assistant and check the Consent tab for each event. You should see the default state on page load and an update after you interact with the banner. In the browser's network panel, requests to Google carry consent parameters (`gcs` and `gcd`) that reflect the current state.

Test at least these scenarios:

- **First visit, no interaction:** all signals denied, no advertising or analytics cookies set.
- **Accept all:** signals switch to granted, and cookies appear only after the click.
- **Reject all:** signals stay denied, and no non-Google marketing tags fire.
- **Returning visitor:** the stored choice is applied within the `wait_for_update` window.
- **Withdrawal:** reopening the banner and rejecting flips the signals back to denied.

Google Ads and GA4 also show consent diagnostics in their admin screens. Check them a few days after launch to confirm signals are arriving for EEA traffic.

## Should I use basic or advanced Consent Mode?

There are two ways to implement Consent Mode. In basic mode, Google tags don't load at all until the visitor consents. In advanced mode, tags load with denied defaults and send cookieless pings that Google uses for modeling.

The choice carries real privacy and measurement trade-offs, which we cover in [basic vs. advanced consent mode](/blog/basic-vs-advanced-consent-mode). If you run a server-side GTM container, consent state also has to flow through it correctly; see [server-side tagging and consent](/blog/server-side-tagging-and-consent).

## Bottom line

Consent Mode v2 comes down to three habits: deny by default before any Google tag runs, update the moment the visitor decides, and gate non-Google tags separately. Test every path, including returning visitors and withdrawal, before you rely on the data. Tools like Cookiesh can automate much of this with built-in Google Consent Mode v2 support and a Google Tag Manager template.

*This article is general information, not legal advice. For decisions about your specific situation, consult a qualified privacy professional.*

## FAQ

### Is Google Consent Mode v2 a legal requirement?

No law names it. It is a Google requirement: without consent signals for EEA traffic, features such as remarketing and parts of conversion measurement in Google Ads are limited. The legal duty to ask for consent comes from the ePrivacy Directive and the GDPR.

### Do I still need a cookie banner if I use Consent Mode?

Yes. Consent Mode is only the channel that tells Google tags what the visitor decided. You still need a banner or consent management platform that asks the question, stores the answer and holds back non-Google trackers.

### What changed between Consent Mode v1 and v2?

Version 2 added ad_user_data and ad_personalization to the original ad_storage and analytics_storage. They tell Google whether user data may be sent for advertising and whether it may be used for personalized ads such as remarketing.

### How long should wait_for_update be?

Long enough for your consent platform to load and apply a returning visitor's saved choice, but no longer. Google's own examples use 500 milliseconds; measure how quickly your banner script initializes and adjust from there.

## Sources

- [Google: Consent mode overview](https://developers.google.com/tag-platform/security/guides/consent)
- [Google EU user consent policy](https://www.google.com/about/company/user-consent-policy/)
- [Directive 2002/58/EC (ePrivacy Directive), EUR-Lex](https://eur-lex.europa.eu/eli/dir/2002/58/oj)