Google Consent Mode v2: what it is, and what it is not

Since March 2024, sites that use Google's advertising features for EEA and UK audiences — remarketing, conversion measurement, personalization — must send Google consent signals via Consent Mode v2. It is one of the most-searched and most-misunderstood pieces of the consent stack, so let's be precise about what it does.

What Consent Mode actually is

Consent Mode is an API between your site and Google's tags. Your consent layer tells Google's scripts what the visitor decided, via four flags: ad_storage (advertising cookies), analytics_storage (analytics cookies), and — new in v2 — ad_user_data (may user data be sent to Google for advertising) and ad_personalization (may it be used for remarketing). Google's tags then adjust their own behavior to match.

// Defaults, set before any Google tag loads — everything denied:
gtag("consent", "default", {
  ad_storage: "denied",
  analytics_storage: "denied",
  ad_user_data: "denied",
  ad_personalization: "denied",
});

// Later, when the visitor accepts marketing in your banner:
gtag("consent", "update", {
  ad_storage: "granted",
  ad_user_data: "granted",
  ad_personalization: "granted",
});

Basic vs advanced mode

In basic mode, Google tags do not load at all until consent — the signals are only sent once the visitor agrees. In advanced mode, the tags load immediately but, while consent is denied, send only cookieless 'pings' that Google uses for aggregate conversion modeling. Advanced mode recovers more measurement, but it means Google code runs before consent — several EU regulators view even cookieless pings skeptically, so cautious legal teams choose basic mode.

What Consent Mode is not

• It is not a consent banner. Something still has to ask the visitor and decide what to send — that's your CMP.
• It is not blocking. Consent Mode governs Google's tags only; your Meta Pixel, TikTok pixel, and session-replay tool don't speak it and must be blocked the classic way.
• It is not proof. Google adjusting its cookies does not create the auditable consent record GDPR Article 7 expects — your consent log does.

Do you need it?

If you run Google Ads or use GA4 audiences for EEA/UK visitors: yes — without v2 signals, Google discards those users from remarketing and demographics, and your measurement quietly degrades. If you only use GA4 for basic analytics and no advertising features, Consent Mode is optional; consent for the analytics cookies themselves is still required either way.

How it fits a prior-blocking setup

1. Set Consent Mode defaults to denied in your page head, before any Google tag.
2. Let your consent banner collect the choice, with Reject as easy as Accept.
3. On consent, your consent layer releases the held Google scripts (prior-blocking) and fires the consent update mapping your categories to the four flags — analytics → analytics_storage, marketing → ad_storage, ad_user_data, ad_personalization.
4. Record the decision in your consent log; that log, not Google's flags, is your evidence.

Treat Consent Mode v2 as what it is — Google's side-channel for staying useful under consent — and keep the actual gatekeeping in your consent platform. The combination gives you lawful tags and usable measurement; either one alone gives you neither.