Google Consent Mode v2: what it is and when you need it

If your website runs Google Analytics or Google Ads, you've probably seen the "consent mode" warning in a Google dashboard. The name sounds technical, but the idea is simple: Google wants to know, for every visitor from Europe, what they chose in your cookie banner. Below is what it means, what you lose without it, what it doesn't fix, and whether it matters for US traffic.

What Consent Mode v2 is

Consent Mode is Google's mechanism for passing a visitor's choice to Google's tags (Analytics, Ads, Tag Manager). Google defines four signals:

Each signal is either "granted" or "denied". "v2" is the version that added the last two signals, ad_user_data and ad_personalization, at the end of 2023.

Do you need it?

It depends on your visitors and on which Google tags your site runs:

For visitors in the European Economic Area, Google has required consent signals since March 2024. Without them, remarketing audiences stop filling for those visitors, and conversion measurement loses exactly the people who decline cookies.

Basic vs advanced consent mode

Google explains that advanced mode gives better modelling of conversions from people who decline. On the other hand, it sends data to Google before consent, cookieless or not, and not every privacy professional in Europe agrees that this falls outside the consent rules. For a small site, basic mode is usually the safer choice; if your ad spend is large and every measured conversion counts, discuss advanced mode with whoever writes your privacy policy.

What Consent Mode doesn't do

Consent Mode isn't a banner and doesn't ask anyone for consent. It only passes on what the visitor chose. The obligations stay with you:

• Consent before cookies, in Europe. EU law requires consent before any cookie that isn't strictly necessary, and data protection authorities fine sites that set them anyway. More in our guide to website legal requirements.
• Google's own rules. Google's EU user consent policy requires you to name every party that receives data, keep records of consent and explain how people can withdraw it.
• Declining as easy as accepting. A banner without a visible Reject button doesn't become compliant because Consent Mode sits behind it.

What about US visitors?

Google doesn't require Consent Mode for US traffic, and most US state privacy laws work on opt-out rather than opt-in: you can set analytics cookies by default, but you must let people opt out of the "sale" or "sharing" of their data, which includes most ad targeting. California goes further and requires businesses to treat the Global Privacy Control browser signal as a valid opt-out. Consent Mode can carry those opt-outs to Google's tags too: set ad_user_data and ad_personalization to denied when someone opts out or their browser sends GPC.

How to set it up

Two routes:

1. A consent management platform (CMP) such as Cookiebot, Usercentrics, iubenda or Complianz. It shows the banner, keeps consent records, sends the signals to Google, and can apply different rules by region. Many are Google-certified.
2. Your own banner, built with the site, setting the signals through Google's code. The default state goes before any tag:

gtag('consent', 'default', {
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  analytics_storage: 'denied'
});

When the visitor accepts, the banner sends gtag('consent', 'update', {...}) with the signals set to granted. The default can be limited to European visitors with the region setting.

How to test it

1. Open your site with Google Tag Assistant and decline in the banner: every signal should show as denied, and no Google cookies should be set before the choice.
2. Reload, accept, and check that the signals change to granted.
3. In Google Ads conversion diagnostics and in Google Analytics data collection settings, check the consent status.
4. Test on a phone too, where banners have the most display problems.

Checklist

1. For EEA visitors, the banner asks before any non-essential cookie, with Reject as easy as Accept.
2. The default state of all four signals is denied for EEA visitors.
3. The banner's choice updates the signals, including when someone changes their mind later.
4. You chose basic or advanced mode deliberately.
5. Consent records are kept, and US opt-outs (including GPC) are honoured.
6. You tested with Tag Assistant on desktop and on a phone.

On the sites we build, the cookie banner, Consent Mode and the privacy policy are built together, and anything that doesn't need cookies doesn't get them. Details are on our web design page.