Google Consent Mode v2: the complete guide for your website

TL;DR

Google Consent Mode v2 is the mechanism that allows your Google tags (GA4, Google Ads, Floodlight) to adjust their behavior based on the consent choices made by your visitors through your cookie banner. Since March 2024, implementing it has been mandatory to retain remarketing and advertising measurement capabilities in the EEA and the UK. Two modes exist: basic (no data without consent) and advanced (cookieless pings to feed modeling). This article explains what it is, how it works, how to implement it, and which mistakes to avoid.

What is Google Consent Mode v2 (and why it matters to you)

Consent Mode is a feature developed by Google that adjusts the behavior of Google tags based on the consent choice expressed by the visitor on your site. In practice, it acts as the bridge between your cookie banner (managed by your CMP) and the Google services you use: Google Analytics 4, Google Ads, Floodlight, and Conversion Linker.

Google introduced the first version of Consent Mode in 2020. In November 2023, a major update was released, Consent Mode v2, featuring two new consent parameters and a formal distinction between two implementation modes (basic and advanced).

Since March 2024, implementing Consent Mode v2 has been required for all advertisers targeting users in the European Economic Area (EEA) and the United Kingdom. This requirement stems from the Digital Markets Act (DMA) and the enforcement of Google's EU User Consent Policy. Without Consent Mode v2, your Google tags stop collecting data on EEA visitors, which means no remarketing, no conversion modeling, and shrinking advertising audiences.

What it actually impacts

The absence of Consent Mode v2 affects three main areas.

Your Google Ads campaigns lose performance. Without consent signals sent to Google, conversion modeling does not work. Google can neither estimate conversions from users who decline cookies nor properly feed its automated bidding algorithms.

Your GA4 data becomes incomplete. Sessions, events, and user journeys from EEA visitors are no longer reported correctly if Consent Mode is not active.

Your remarketing audiences shrink. The ad_user_data and ad_personalization parameters must be explicitly sent with a granted status for Google to use the data for ad personalization.

Symptoms of a faulty implementation

Several warning signs should alert you: a drop in measured conversions in Google Ads for EEA traffic, warnings in the Diagnostics tab of your Google Ads conversions, missing modeling in your GA4 reports, or error messages in Google Tag Assistant indicating missing consent signals.

The fundamentals

The four Consent Mode v2 parameters

Consent Mode v2 relies on four main consent parameters, each of which can be set to granted or denied. The first two existed in v1: analytics_storage controls the storage of analytics-related cookies (visit duration, page views, device type) and ad_storage controls the storage of advertising-related cookies. The two new parameters introduced by v2 are ad_user_data (consent for sending personal data to Google for advertising purposes) and ad_personalization (consent for ad personalization including remarketing and similar audiences).

The distinction matters: ad_storage and analytics_storage govern data collection (which cookies are set), while ad_user_data and ad_personalization govern data usage (what Google can do with it). This is what makes Consent Mode v2 more granular than v1.

The key rule: basic vs advanced

In basic mode, Google tags are blocked until the user gives consent. If the user declines, no data is sent to Google at all. Google uses only consented user data to model the behavior of non-consenting users. Modeling exists but is less accurate.

In advanced mode, Google tags load before the user interacts with the consent banner. If the user declines cookies, cookieless pings are still sent to Google containing non-identifying information: timestamp, browser type, referral URL, and consent status. Google uses this aggregate data to feed its conversion and behavior modeling, making it more accurate than basic mode.

Advanced mode raises a legal question. Sending cookieless pings from users who have not consented may be considered a form of data processing. Before choosing this mode, it is essential to consult your legal team or DPO to assess compliance with the GDPR and the ePrivacy Directive in your context.

How to implement Consent Mode v2

Step 1: verify your CMP

Your CMP (consent management platform) is the central piece. It displays the banner, collects the user's choice, and transmits consent signals to Google tags. If you use a Google-certified CMP (such as FlowConsent, which natively handles consent signal transmission), the communication with Consent Mode is typically automatic. Verify that your CMP sends all four Consent Mode v2 parameters. To audit the cookies on your site, you can use a cookie scanner before configuring your CMP.

Step 2: set the default consent state

Before any user interaction with the banner, you must define a default consent state. For EEA visitors, the standard practice is to set all parameters to denied by default, in line with the GDPR. The execution order is critical: the consent default must fire before any Google tag loads.

Step 3: update consent after the user's choice

When the user interacts with the banner (accepts, declines, or customizes), your CMP must send a consent update command. Consent Mode does not store consent choices. Your CMP must handle persistence (cookie, local storage) and resend the correct states on every page load.

Step 4: enable complementary features

url_passthrough allows click identifiers (GCLID, DCLID) to be passed through the URL during internal navigation, even when ad_storage is denied. This helps with conversion attribution. ads_data_redaction, when enabled alongside a denied ad_storage, prevents any click identifier or third-party cookie from being transmitted in advertising pings.

Step 5: verify your implementation

Check Google Tag Assistant for the correct order of consent default and consent update events. In GA4, go to Admin > Data Streams and look for active advertising consent signals. In Google Ads, open the Diagnostics tab of your conversions to confirm Consent Mode status. For a detailed overview of cookie consent management, visit our dedicated page.

Common mistakes (and how to avoid them)

Forgetting the two new parameters. Many implementations send ad_storage and analytics_storage but ignore ad_user_data and ad_personalization. Without these, remarketing and ad personalization will not work, even if consent is granted.

Firing consent code in the wrong order. The consent default must fire before any Google tag loads. If a tag loads before the default state is set, it uses implicit values that may not match your consent policy.

Not persisting consent across pages. Consent Mode does not save choices. If your CMP fails to resend the correct states on each page load, Google receives inconsistent signals, which corrupts modeling.

Confusing Consent Mode with script blocking. Consent Mode only adjusts the behavior of Google tags. Third-party scripts (Facebook Pixel, TikTok, etc.) must be blocked by your CMP separately.

Using advanced mode without legal review. Consult your DPO before enabling this mode.

Duplicating the implementation. If your CMP, a plugin, and custom code all send consent states, the conflicting signals cause errors.

Basic vs advanced: which mode to choose

Basic mode is sufficient to comply with Google's requirements and retain remarketing. Advanced mode provides more accurate modeling but requires legal clearance. The choice depends on your risk tolerance and how much precision you need in your advertising data.

Implementation checklist

1. Verify that your CMP sends all four parameters: analytics_storage, ad_storage, ad_user_data, ad_personalization.
2. Set a default consent state to denied for EEA visitors, fired before any Google tag.
3. Configure the consent update when the user interacts with the banner.
4. Choose between basic and advanced after consulting your DPO or legal team.
5. Enable url_passthrough to preserve click attribution even without ad_storage consent.
6. Check Google Tag Assistant for the correct event order.
7. Confirm in GA4 (Admin > Data Streams) that advertising consent signals are detected as active.
8. Verify in Google Ads (Conversion Diagnostics) that Consent Mode is recognized and modeling is active.
9. Test the full journey: decline, partial acceptance, full acceptance, and verify that tags behave correctly in each scenario.
10. Make sure no other source (plugin, custom script) sends duplicate consent signals.

Conclusion and next step

Consent Mode v2 is a technical prerequisite for maintaining your measurement, remarketing, and ad optimization capabilities in the EEA. If you are unsure whether your site transmits consent signals correctly, start with a cookie and tracker audit. Visit our blog for more practical guides on cookie compliance and consent management.