What consent mode v2 requires and how to verify it works

Consent mode v2 adds two signals, ad_user_data and ad_personalization, to the ad_storage and analytics_storage you probably already send. The choice that changes your numbers is whether you run it in basic or advanced mode, and whether the default is set before any Google tag fires. By the end of this post you will know what each signal switches off, what each mode does to GA4 and Google Ads modeling, and how to check your implementation in Tag Assistant.

Why a banner that "has consent mode" still loses data

Most broken implementations pass a quick look: the banner appears, the user clicks, tags fire. The failures sit in the order and completeness of the signals.

The default arrives too late. Google's instructions are to call gtag('consent', 'default', ...) on every page before any config or event command (Google, set up consent mode, as of October 2026). If a tag reads or writes cookies before the default exists, Tag Assistant reports it as an error (Google, debug consent mode, as of October 2026). In Tag Manager this usually means the consent tag is not on the Consent Initialization trigger.

A signal is missing. Many setups were built for v1 and send only ad_storage and analytics_storage. Google's debugging guide asks for defaults and updates for all four parameters, and warns that a regional default set for one parameter but not another can cause inconsistent behavior.

Tags are blocked instead of informed. In basic mode, Google tags don't load until the user interacts with the banner. If the user declines, nothing reaches Google, not even the consent state (Google, consent mode overview, as of October 2026). Google says that blocking tags until the banner is answered means it can't verify user consent choices, which may lead to data loss (Google Ads, EEA consent mode update, as of October 2026).

For example, a site whose CMP fires the default from a custom HTML tag after the GA4 configuration tag will show consent working in the banner and still set GA4 cookies for users who later decline. Google says not to call the gtag consent command from a custom HTML tag in Tag Manager, and to use a consent template instead.

What v2 requires and what each mode changes

What the two new signals do. Google added them to consent mode to enforce its EU user consent policy for traffic from the European Economic Area. To keep using Google tags for measurement, ad personalization and remarketing, advertisers must collect consent from EEA users and pass those signals to Google. The requirement also covers Google Analytics data used in Google Ads, Search Ads 360 or Display & Video 360 (Google Ads, EEA consent mode update, as of October 2026). Google announced on January 18, 2024 that it would strengthen enforcement of the policy that year (Google Ads, consent mode announcement), and EEA audiences started to depend on the new signals in early March 2024 (Google Analytics, consent for EEA audiences).

• ad_user_data denied: personal data collection for advertising is off, including user_id and enhanced conversions with hashed first-party data.
• ad_personalization denied: remarketing in Google Ads, Display & Video 360 and Search Ads 360 receives no data (Google, consent mode overview, as of October 2026).

Basic and advanced mode, side by side.

Sources: Google, consent mode overview and GA4, consent mode, as of October 2026.

What changes in GA4. With analytics_storage denied, GA4 sets and reads no analytics cookies but still receives cookieless pings in advanced mode. Behavioral modeling uses them to estimate users and sessions, but only if the property qualifies. Google lists at least 1,000 events per day with analytics_storage denied for 7 days, and at least 1,000 daily users with it granted on 7 of the previous 28 days. It also applies unpublished criteria. Modeling needs the Blended reporting identity, covers users and sessions rather than event counts, and is not included in the BigQuery export (GA4, behavioral modeling, as of October 2026). If you analyze in BigQuery, the warehouse and the GA4 interface will diverge by design.

What changes in Google Ads. Conversion modeling for consent mode requires 700 ad clicks over 7 days per country and domain grouping. Modeled conversions appear in the Conversions and Conversion value columns, so bidding uses them (Google Ads, consent mode modeling, as of October 2026).

How to implement it: default first, four signals, one owner

1. Decide the mode with legal, in writing. Advanced mode sends cookieless pings before consent; basic mode sends nothing. Which one your legal basis allows is not an analytics decision. The artifact is a short note that names the mode, the regions it applies to and who approved it.

2. Set the default for all four parameters, per region, before any tag. With gtag.js, the default call goes above every tag snippet. With Tag Manager, use a consent template, from your CMP or the Community Template Gallery, on the Consent Initialization trigger (Google, set up consent mode, as of October 2026). Use the region parameter with ISO 3166-2 codes when the default differs by market. A default without a region applies to everyone else. Add wait_for_update if your CMP loads asynchronously.

3. Send the update the moment the user chooses. The update covers every parameter you set a default for, on the page where the choice happens. The choice is stored and applied on later pages. Google advises against sending it as the page unloads, because the browser may cancel the request.

4. Decide on url_passthrough and ads_data_redaction. The first carries ad click and session identifiers in URLs when cookies are denied. The second redacts ad click identifiers when ad_storage is denied (Google, set up consent mode, as of October 2026). Both are set before config, and both deserve a line in the note from step 1.

5. Map the non-Google tags. Google tags (Google tag, GA4, Google Ads, Floodlight, Conversion Linker) have built-in consent checks. Other tags only respect consent if you add it in Tag Manager under Advanced > Consent Settings (Google Ads, about consent mode, as of October 2026). List every non-Google tag and the consent type it requires. This list belongs in your tracking specification.

6. If you run server-side Tag Manager, configure consent in the web container. Google says the Google tag forwards consent to the server container, and that Google product tags there are consent-aware. The server container needs a GA4 client, and Conversion Linker for Google Ads. Region-specific settings must also be supported on the tagging server (Google, server-side tagging and consent mode, as of October 2026). Google does not say non-Google tags in the server container read that state, so check each one. Meta's Conversions API Tag is one that doesn't: its template code has no consent check (facebookincubator, template source), so you gate it yourself, for example with a trigger condition on the consent state the GA4 client receives, or with a transformation that uses it.

How you know it is right

Run these checks before each release that touches the banner, the CMP or the container, and once a month otherwise.

• Default before tags. In Tag Assistant, select the earliest Consent event in the summary. The API call should set ad_storage, ad_personalization, ad_user_data and analytics_storage. No tag should read or write cookies before it (Google, debug consent mode, as of October 2026).
• Update after the click. Accept, then repeat with a decline. The latest Consent event should update the same four parameters, both to granted and to denied. In a tag's Consent tab, the On-page Default and On-page Update columns show both states.
• Tags obey the state. In the Tags tab, open each tag and check it respected the consent state, including the non-Google tags from step 5.
• Every region you set a default for. Simulate the location in Chrome and repeat the three checks.
• Google Ads diagnostics. On the conversion action, the tracking status should say conversion modeling for consent mode is active. The Diagnostics tab shows the uplift per domain and country, refreshed weekly, and can show results about 7 days after implementation. Pairs under 1% uplift are not shown (Google Ads, consent mode impact, as of October 2026).

For a head of performance, the question to ask the analytics team is short: "Is conversion modeling for consent mode active on our main conversion actions, and when did we last test the decline path?"

Consent mode is one more thing a release can break silently. The tools in how to detect implementation errors in GA4 catch part of it. The consent template and trigger order belong in your Google Tag Manager audit.

When this advice doesn't apply

• No EEA traffic and no personalized advertising. Google says sites that already use consent mode and don't use personalized advertising, such as remarketing, need no action for v2 (Google Ads, EEA consent mode update, as of October 2026). Other regulations may still apply to you.
• Properties below the modeling thresholds. Advanced mode will not fill gaps in GA4 or Google Ads if you never reach the volume Google lists. The case for it then rests on the consent state reaching Google, not on modeling.
• Consent through the IAB TCF. Google says GA4 properties can't model data when users deny consent through a TCF-based solution (GA4, consent mode, as of October 2026).
• Server-side collection as a workaround. Moving tags to a server does not remove the need for consent. If you are weighing it, read what server-side tracking does and doesn't solve first.

What to check this week

• Open Tag Assistant on your main landing page and confirm the default sets all four parameters before the first tag fires.
• Decline consent and check that no non-Google tag still fires.
• In Google Ads, check whether conversion modeling for consent mode is active on your primary conversion action, and write down the mode you run and who approved it.