Google Tag Manager and Consent Mode v2: integration guide

TL;DR

Google Tag Manager (GTM) lets you implement Consent Mode v2 without modifying your site's source code. Consent Mode v2 adjusts how Google tags (Analytics, Ads, Floodlight) behave based on the user's consent choice, using four key parameters: ad_storage, analytics_storage, ad_user_data, and ad_personalization. Implementation involves a "Consent Initialization" tag that sets the default state (denied), then an update mechanism (granted) triggered by your CMP after the user's choice.

What is Consent Mode v2 in GTM?

Consent Mode is a mechanism developed by Google that allows Google tags to adapt their behavior based on the user's consent choice. When a user rejects cookies, Google tags do not place cookies but can send anonymized signals (pings) in advanced mode, or do not fire at all in basic mode.

Consent Mode v2 introduced two additional parameters in November 2023: ad_user_data (collection of user data for advertising) and ad_personalization (ad personalization). These parameters have been mandatory since March 2024 for advertisers targeting users in the European Economic Area.

Google Tag Manager is Google's recommended tool for deploying Consent Mode v2. GTM includes a dedicated trigger ("Consent Initialization") and a built-in consent management interface that simplifies configuration.

Basic vs advanced mode: which one to choose?

Consent Mode v2 offers two implementation modes with different implications for compliance and data collection.

Basic mode (strict blocking)

In basic mode, Google tags do not fire until the user has given consent. No data is sent to Google before the choice. This is the most privacy-protective mode and the safest legally. The trade-off is that you lose all data on users who reject cookies.

Advanced mode (anonymized pings)

In advanced mode, Google tags load before consent and send cookieless "pings" if the user refuses. These pings allow Google to feed its conversion modeling to estimate missing conversions. This mode offers better analytical coverage but raises GDPR compliance questions, as data (even anonymized) is transmitted before consent.

The choice between basic and advanced depends on your legal risk tolerance. Basic mode is recommended if GDPR compliance is your priority. Advanced mode suits advertisers who need modeled conversion data to optimize their Google Ads campaigns.

How to implement Consent Mode v2 in GTM

Implementation in Google Tag Manager follows a specific sequence. Here are the key steps.

Step 1: enable Consent Overview in GTM

In your GTM container, go to Admin, then Container Settings. Check "Enable consent overview." This option activates the consent parameter visualization interface for each tag. It is not required for functionality but makes diagnosis easier.

Step 2: configure the default consent state

Create a tag that defines the default state of each consent parameter. For EEA users, the default state should be "denied" for all four parameters (ad_storage, analytics_storage, ad_user_data, ad_personalization). This tag must be triggered by the "Consent Initialization - All Pages" trigger, which fires before all other triggers in the container.

If you use a CMP that has a GTM template (most Google-certified CMPs offer one), the template handles this configuration automatically. You just need to install the template from the Community Template Gallery and enter your settings.

Step 3: configure the consent update

When the user makes their choice in the cookie banner, the CMP must send an update command to Consent Mode to switch the relevant parameters from "denied" to "granted." This update must happen before any navigation to another page, otherwise the signal is lost.

Google-certified CMPs handle this update automatically through their GTM template. If you implement manually, you need to use the gtag('consent', 'update', {...}) command in the dataLayer.

Step 4: configure Google tags

Google tags (GA4, Google Ads, Floodlight) have "built-in consent checks": they automatically adapt their behavior based on the consent state. You do not need to modify the triggering of these tags if you are in advanced mode.

In basic mode, you must add consent conditions to each tag. In the tag's advanced settings (Advanced Settings, Consent Settings), add the required consent type (for example, analytics_storage for GA4, ad_storage for Google Ads). The tag will only fire if the corresponding consent is set to "granted."

Step 5: manage non-Google tags

Third-party tags (Facebook Pixel, LinkedIn Insight, A/B testing tools, etc.) do not have built-in consent checks. For these tags, you must manually configure "Additional Consent Checks" in GTM. Open the tag, go to Advanced Settings, Consent Settings, and add the required consent types. The tag will be blocked until the corresponding consent is granted.

The four Consent Mode v2 parameters

Consent Mode v2 relies on four main parameters that control Google tag behavior based on the user's choice.

ad_storage controls data storage for advertising (ad cookies, identifiers). When this parameter is "denied," no advertising cookies are placed.

analytics_storage controls data storage for analytics (Google Analytics cookies). When this parameter is "denied," GA4 does not place cookies but can send anonymized pings in advanced mode.

ad_user_data controls sending user data to Google for advertising purposes. This parameter has been mandatory since March 2024 for users in the EEA.

ad_personalization controls using data for ad personalization (remarketing, similar audiences). This parameter has also been mandatory since March 2024 for the EEA.

Common mistakes (and how to avoid them)

Not using the Consent Initialization trigger. If the default consent tag fires on "All Pages" instead of "Consent Initialization - All Pages," other tags may execute before the consent state is defined. Fix: always use the Consent Initialization trigger for the tag that sets default values.

Forgetting the two new parameters. If you do not configure ad_user_data and ad_personalization, your Google Ads campaigns lose access to remarketing and audiences in the EEA. Fix: add these two parameters to your configuration, even if you do not use personalized advertising today.

Confusing Consent Mode with a CMP. Consent Mode is not a cookie banner. It is a signaling mechanism between your CMP and Google tags. You need both: a compliant CMP to collect consent, and Consent Mode to transmit that choice to Google tags.

Not blocking non-Google third-party tags. Consent Mode only manages Google tags. Third-party tags (Facebook, LinkedIn, TikTok, etc.) must be blocked separately through Additional Consent Checks in GTM, or through your CMP's blocking mechanism.

Testing only in GTM preview mode. GTM preview mode does not always correctly simulate consent behavior. Fix: also test in real conditions (private browsing, no extensions) and verify with a cookie scanner that cookies are not placed before consent.

Deploying advanced mode without legal analysis. Advanced mode sends data to Google before consent (even without cookies). Under French law, this may be considered data processing without a legal basis. Fix: consult your DPO or legal counsel before activating advanced mode for EEA users.

Checklist: Consent Mode v2 in GTM

1. Consent Overview is enabled in the GTM container settings (Admin, Container Settings).
2. A default consent tag is configured with all four parameters set to "denied" (ad_storage, analytics_storage, ad_user_data, ad_personalization).
3. This tag fires on the "Consent Initialization - All Pages" trigger (not "All Pages").
4. The CMP sends an "update" command to Consent Mode when the user makes their choice.
5. Google tags (GA4, Google Ads) have built-in consent checks active.
6. Third-party tags (Facebook, LinkedIn, etc.) have Additional Consent Checks configured.
7. In basic mode, each tag has an explicit consent condition (analytics_storage granted for GA4, ad_storage granted for Google Ads).
8. A cookie audit confirms no non-essential cookies are placed before consent.
9. The update command is sent before any navigation to another page.
10. Implementation is tested in private browsing, without extensions, on desktop and mobile.

Conclusion

Consent Mode v2 in Google Tag Manager is Google's recommended mechanism for reconciling GDPR compliance with analytics and advertising data collection. Implementation involves a default consent tag ("denied"), an update mechanism linked to your CMP, and correct configuration of built-in consent checks for Google tags and Additional Consent Checks for third-party tags.

The choice between basic and advanced mode has real legal implications. Basic mode is the safest. Advanced mode offers more data but requires prior legal validation.

To verify that your implementation correctly blocks tags before consent, scan your site for free with FlowConsent.