Google Consent Mode v2, explained without the hand-waving

Consent Mode is plumbing, not a banner

Consent Mode v2 is not a cookie banner. It is a signaling layer. Google's tags — Ads, Analytics, Floodlight — read a consent state from the page and change their behavior based on it. Your banner collects the visitor's choice. Consent Mode carries that choice to the tags. If nothing carries it, the tags behave as though nobody was ever asked anything.

That distinction is where most implementations quietly break. A site can have a well-built banner, a published policy, and a granular preference center, and still hand full advertising identifiers to Google on the first pageview, because the tag never heard about any of it. The banner and the tag are separate systems. Something has to wire them together.

Consent Mode also does not supply a lawful basis for anything. It is a mechanism for honoring a decision, not a substitute for collecting one properly. You still need a real choice, offered before anything non-essential fires, and you still need to be able to show what was chosen and when.

The four signals and what they control

There are four signals. Two predate v2: ad_storage and analytics_storage. Two arrived with v2: ad_user_data and ad_personalization. Each one is either granted or denied, and each answers a different question. Treating all four as a single on/off switch is an easy way to get this wrong.

ad_storage governs whether Google's advertising tags may read or write storage on the device — cookies, identifiers, anything persistent. analytics_storage governs the same thing for measurement: whether an Analytics cookie is set and a returning visitor is recognized, or whether the hit arrives with no identifier attached to it at all.

ad_user_data is about transmission — whether user data may be sent to Google for advertising purposes in the first place. ad_personalization is about use — whether that data may drive personalized advertising, such as remarketing audiences. Storage, transmission, and use are three separate questions, and a single accept should map deliberately to all four signals rather than by accident.

Who is actually required to use it

Google has required Consent Mode v2 since March 2024 for its advertising and measurement features where those features cover users in the EEA and the UK. Skip it and the platform degrades: audience-based features stop working for that traffic, and conversion measurement thins out. This is a platform requirement enforced by Google, not a law with an inspector attached.

The legal duty underneath is a separate thing. GDPR plus ePrivacy is a prior opt-in regime: nothing non-essential fires before consent, withdrawal must be as easy as giving it, and Article 7(1) requires you to be able to demonstrate the consent you relied on. The rule that reject must be as easy as accept comes from regulator guidance, notably from the EDPB and national authorities, rather than the GDPR text itself.

In the UK it is UK GDPR plus PECR, overseen by the ICO and diverging through the Data (Use and Access) Act 2025, which raises PECR fines to UK GDPR levels. None of this is legal advice — how these rules land on your particular stack is a question for a lawyer who can look at it.

The United States works differently, and Consent Mode is not the tool for it. CCPA/CPRA is an opt-out regime: notice at collection, a working Do Not Sell or Share My Personal Information path, and mandatory honoring of Global Privacy Control. As of 2026, nineteen or more comprehensive state laws are in force, twelve of them requiring universal opt-out signals to be honored. Indiana, Kentucky, and Rhode Island joined in 2026, and Maryland bans the sale of sensitive data outright.

What default denied means in practice

Default denied means the defaults are declared before any Google tag runs — the consent default call sits ahead of the container, not after it. In Advanced mode, denied does not mean the tag is absent: it loads, writes no cookies, and sends no advertising identifiers. In Basic mode, denied means the tag never loads. When the visitor chooses, an update call flips the relevant signals and the queued hits proceed.

Defaults are usually region-scoped: denied where prior consent is required, granted elsewhere, so a visitor in Ohio does not sit behind a wall built for Frankfurt. Pair that with a short wait so the tag does not fire before the banner has an answer. Then verify the real thing — load the site cold, watch the network calls and the cookie jar, and confirm nothing advertising-shaped happens before you click.

Three failure modes come up again and again, and all three look fine from the admin screen. The banner renders, the tag manager reports healthy, and the consent state on the wire is wrong anyway. The check that matters is a network trace on a clean load, not a screenshot of the banner.

• Defaults declared after the tag fires — the first hit already wrote a cookie.
• A region list that covers the EEA and forgets the UK.
• A banner that updates its own UI but never sends the consent update.

Advanced mode and the part nobody markets

Consent Mode ships in two shapes. In Basic, Google's tags are not loaded at all until consent is granted; nothing leaves the page before the visitor decides. In Advanced, the tags load immediately and send cookieless pings before any choice is made, and those pings feed Google's conversion modeling. Advanced generally reports more, because it has more to model from.

That is the trade: better modeled numbers in exchange for a request to a third party before consent exists. Advanced is Google's recommendation, not a regulator's. Under a prior opt-in reading, non-essential transmission should not happen first, and a pre-consent ping still carries an IP address, a user agent, a page URL, and a timestamp. Basic is the conservative posture, though that call belongs to your counsel rather than a blog post.

Regulators look at mechanics rather than intent. Healthline settled at $1.55 million in 2025 for continuing to share data with advertising partners after people had opted out — a wiring failure, not a drafting one. That is the same class of gap Consent Mode is meant to close: the choice was recorded somewhere, and the tags never heard about it.

UserGuard is newly launched, so here is what it is built to do rather than a long track record. It is designed to set all four signals to denied by default in regions that require prior consent, push the update the moment a visitor chooses, and log that event against the site, banner version, region, and timestamp, exportable as CSV. It is not a Google-certified CMP and is not IAB TCF validated; TCF is roadmap. GPC and geo-targeting are never paywalled.

Go deeper: how the banner signals consent state · consent analytics you can export