Google Consent Mode v2: a plain-language setup guide

Consent Mode is how Google Analytics, Google Ads and Floodlight tags learn whether a visitor agreed to cookies. Version 2 added two signals in late 2023, and Google began requiring it for advertisers using EEA traffic in March 2024.

The four signals

Each signal is either granted or denied. Your banner maps its categories to them: analytics to analytics_storage, and marketing to the three ad signals.

Basic and advanced mode

In basic mode, Google tags do not load at all until the visitor agrees. Nothing is sent before consent. In advanced mode, tags load with consent denied and send cookieless pings that Google uses for conversion and behaviour modelling. Advanced mode keeps more measurement, but it does send some data before a choice. Decide with your legal advisor which fits your regions. For Quebec visitors, many businesses choose basic mode to stay closest to off by default.

Step by step

1. Load your consent script first. It must run before gtag.js or the Google Tag Manager container.
2. Set all four signals to denied by default. Use region settings if you want different defaults outside the EU and Quebec.
3. Map banner categories to signals. Analytics goes to analytics_storage; marketing goes to ad_storage, ad_user_data and ad_personalization.
4. Send an update on every choice. When the visitor accepts, rejects or customizes, push a consent update with the new values.
5. Verify with Tag Assistant. Confirm the default appears before the first tag and the update after a click.

The code, if you set it up by hand

A consent platform like North Consent sets this for you. If you are doing it manually, the default must come first in the head:

<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('consent', 'default', {
  ad_storage: 'denied', analytics_storage: 'denied',
  ad_user_data: 'denied', ad_personalization: 'denied',
  wait_for_update: 500
});
</script>

After the visitor chooses, send an update with the new values: gtag('consent', 'update', {...}).

How to check it works

Open Google Tag Assistant, connect to your site and look at the Consent tab for the first event. You should see the default state set to denied before any tag fires, and an update after you click a button. In Google Ads and GA4 admin screens, Google also shows whether consent signals are being received.

Common mistakes

• Setting defaults after the Google tag, so the first page view goes out without them.
• Only sending the two original signals and forgetting ad_user_data and ad_personalization.
• Granting everything by default for all regions to keep numbers up.
• Firing a second copy of gtag from a plugin that ignores consent.

Using Google Tag Manager? Read the GTM setup guide.