Consent Mode v2: basic vs advanced mode, which one to choose?

TL;DR

Consent Mode v2 offers two implementation modes: basic and advanced. In basic mode, Google tags do not fire until the user has consented (strict blocking). In advanced mode, tags load before consent and send anonymized signals (cookieless pings) even if the user refuses. Basic mode is the safest legally. Advanced mode allows Google to use conversion modeling to estimate missing data, but raises GDPR compliance questions as data is transmitted before consent.

What is Consent Mode v2?

Consent Mode v2 is a Google mechanism that adjusts how Google tags (GA4, Google Ads, Floodlight) behave based on the user's consent choice. It relies on four parameters: ad_storage, analytics_storage, ad_user_data, and ad_personalization.

Consent Mode is not a cookie banner. It is a signaling mechanism that works alongside a CMP. The CMP collects consent, Consent Mode transmits that choice to Google tags.

Since March 2024, implementing Consent Mode v2 is mandatory for advertisers targeting users in the European Economic Area (EEA). Without Consent Mode, remarketing and conversion measurement features are limited or disabled.

How does basic mode work?

In basic mode (also called "hard blocking"), Google tags do not load and send no data until the user has given consent. This is the most restrictive behavior.

In practice, if the user arrives on the site and makes no choice in the banner, no Google tag fires. If the user refuses cookies, no Google tag fires. If the user accepts, tags fire normally and send "granted" consent signals to Google.

In basic mode, you only have data on users who explicitly accepted cookies. Users who refuse or do not interact with the banner are invisible to Google Analytics and Google Ads.

Basic mode is the recommended mode if GDPR compliance is your absolute priority. No data is transmitted to Google before consent, which corresponds to the strict interpretation of Article 82 of the French Data Protection Act and the ePrivacy Directive.

How does advanced mode work?

In advanced mode (also called "soft blocking"), Google tags load as soon as the page opens, before the user interacts with the banner. If the user refuses cookies (or does not interact), the tags send anonymized "pings" without placing cookies.

These pings contain limited information: timestamp, functional data (user agent, screen resolution), a temporary non-persistent identifier, and consent signals ("denied"). They do not contain advertising identifiers or tracking cookies.

Google uses these pings to feed its statistical models (conversion modeling). Based on data from users who consented, Google extrapolates the likely behavior of users who did not consent. This partially fills the data gap caused by cookie refusals.

Advanced mode offers better data coverage. According to Google, conversion modeling can recover a significant portion of missing conversions. However, this modeling relies on statistical estimates, not actual data.

What are the concrete differences between basic and advanced?

The two modes differ on three main axes: when tags load, what data is transmitted when consent is refused, and the impact on analytical coverage.

In basic mode, tags only load after consent. No data is sent upon refusal. Analytical coverage is limited to consenting users. In advanced mode, tags load immediately. Anonymized pings are sent upon refusal. Analytical coverage is extended through conversion modeling.

From a legal perspective, basic mode transmits no data before consent, which complies with the strict interpretation of the GDPR. Advanced mode transmits data (even anonymized) before consent, which may be considered processing without a legal basis under some interpretations.

From a technical perspective, basic mode requires configuring explicit consent conditions on each tag in Google Tag Manager. Advanced mode uses the native built-in consent checks of Google tags and does not require additional triggering conditions.

Is advanced mode GDPR compliant?

This is the most debated question. The answer depends on the legal interpretation adopted.

Google argues that pings sent in advanced mode do not constitute personal data processing because they contain no cookies or persistent identifiers. Google considers these pings equivalent to standard HTTP requests transmitted by any browser when visiting a site.

Some legal experts and data protection authorities adopt a different interpretation. They consider that any data transmission to a third-party server (even without cookies) before consent constitutes access to the user's terminal under the ePrivacy Directive. The IP address, user agent, and other information transmitted in pings could constitute personal data under the GDPR.

The CNIL has not published a specific official position on Consent Mode's advanced mode. In the absence of clarification, the precautionary principle recommends basic mode for sites targeting users in France and the EEA.

Which mode to choose based on your situation

The choice depends on your profile, data needs, and legal risk tolerance.

Choose basic mode if

GDPR compliance is your absolute priority. You do not use personalized advertising (remarketing, audiences). Your site primarily targets users in France or the EEA. Your DPO or legal counsel recommends the most restrictive approach. You prefer partial but legally solid data over statistical estimates.

Choose advanced mode if

You need modeled conversion data to optimize your Google Ads campaigns. Your advertising budget is significant and data loss directly impacts your performance. You have obtained prior legal validation from your DPO or legal counsel. You understand that conversion modeling provides estimates, not exact data.

Common mistakes (and how to avoid them)

Confusing Consent Mode with tag blocking. Consent Mode is a signaling mechanism, not a blocking tool. Even in advanced mode, if you want to block third-party tags (Facebook, LinkedIn), you must configure blocking separately in your CMP or through Additional Consent Checks in GTM.

Activating advanced mode without legal validation. Advanced mode sends data to Google before consent. Without prior legal validation, you risk non-compliance. Fix: consult your DPO before activating advanced mode for EEA users.

Thinking basic mode = no Consent Mode. Not implementing Consent Mode at all and not loading tags before consent is not the same as basic mode. Basic mode still sends "granted" consent signals to Google when the user accepts, which allows Google to verify consent exists. Without Consent Mode, Google cannot verify consent.

Overestimating conversion modeling accuracy. Conversion modeling is a statistical estimate. It works better with high traffic volume and a sufficient consent rate (typically 20% minimum). On a small site, estimates may be unreliable. Fix: evaluate modeling reliability by comparing modeled data with actual data over a test period.

Using the same mode for all countries. Consent Mode allows defining behaviors by region. You can use basic mode for the EEA and advanced mode for countries with less strict regulations. Fix: configure regions in your GTM implementation to adapt behavior by geographic zone.

Forgetting to test actual behavior. GTM preview mode does not always correctly simulate Consent Mode. Fix: test in private browsing, verify with a cookie scanner, and inspect network requests to confirm no cookies are placed before consent in basic mode.

Checklist: choosing and configuring the right mode

1. Define your priority: strict compliance (basic) or extended data coverage (advanced).
2. Obtain legal validation from your DPO if considering advanced mode for the EEA.
3. Set the default state to "denied" for all four parameters in GTM.
4. In basic mode, add explicit consent conditions to each Google tag.
5. In advanced mode, verify that built-in consent checks are active on Google tags.
6. Configure regions if using different modes for different countries.
7. Block third-party tags (Facebook, LinkedIn, etc.) separately, regardless of the chosen mode.
8. Test behavior in private browsing and with a cookie scanner.
9. Verify that conversion modeling activates correctly in advanced mode (minimum 700 clicks over 7 days per country).
10. Document your mode choice in your processing register.

Conclusion

The choice between Consent Mode basic and advanced is not a technical detail. It is a decision that affects your GDPR compliance and the quality of your marketing data. Basic mode guarantees no data is transmitted before consent. Advanced mode offers more data through conversion modeling but requires legal validation.

The default rule for sites targeting the EEA should be basic mode. Advanced mode can be considered after legal validation and if advertising data needs justify it.

To verify that your implementation correctly blocks tags before consent, scan your site for free with FlowConsent.