Google Consent Mode v2, explained

Consent Mode is a signaling layer

Consent Mode v2 is a signaling layer, and it doesn't replace your cookie banner. Google's tags (Ads, Analytics, Floodlight) read a consent state from the page and change their behavior based on it. Your banner collects the visitor's choice, and Consent Mode carries that choice to the tags. If nothing carries it, the tags behave as though nobody was ever asked anything.

Most broken implementations go wrong right here. A site can have a well-built banner, a published policy and a granular preference center, and still send full advertising identifiers to Google on the first pageview, because nothing told the tag about any of it. The banner and the tag are separate systems, and something has to connect them.

Consent Mode also doesn't supply a lawful basis for anything. It helps you honor a decision, and you still have to collect that decision properly. You need to offer people a choice before anything non-essential fires, and you need to be able to show what was chosen and when.

What are the four Consent Mode v2 signals?

They're ad_storage and analytics_storage, which predate v2, and ad_user_data and ad_personalization, which arrived with it. Each one is either granted or denied, and each answers a different question, so it's easy to get this wrong if you treat all four as a single on/off switch.

ad_storage governs whether Google's advertising tags may read or write storage on the device, including cookies, identifiers and anything else persistent. analytics_storage does the same for measurement. It decides whether an Analytics cookie is set and a returning visitor is recognized, or whether the hit arrives with no identifier attached at all.

ad_user_data is about transmission, meaning whether user data may be sent to Google for advertising purposes in the first place. ad_personalization is about use, meaning whether that data may drive personalized advertising such as remarketing audiences. Storage, transmission and use are three separate questions, so if a single accept sets all four signals, make sure you set it up that way on purpose.

Who is actually required to use Consent Mode v2?

Google has required Consent Mode v2 since March 2024 for its advertising and measurement features where those features cover users in the EEA and the UK. If you skip it, the platform gives you less. Audience-based features stop working for that traffic, and conversion measurement thins out. This is a platform requirement that Google enforces, and it isn't itself a law with an inspector attached.

The legal duty underneath is separate. GDPR plus ePrivacy is a prior opt-in regime, so nothing non-essential fires before consent, withdrawing must be as easy as giving consent, and Article 7(1) requires you to be able to demonstrate the consent you relied on. The rule that rejecting must be as easy as accepting comes from regulator guidance, notably from the EDPB and national authorities, and isn't in the GDPR text itself.

In the UK it's UK GDPR plus PECR, overseen by the ICO and diverging through the Data (Use and Access) Act 2025, which raises PECR fines to UK GDPR levels. None of this is legal advice. Ask a lawyer who can look at your particular stack how these rules apply to it.

The United States works differently, and Consent Mode isn't the tool for it. CCPA/CPRA is an opt-out regime with notice at collection, a working Do Not Sell or Share My Personal Information path, and mandatory honoring of Global Privacy Control. As of 2026, nineteen or more comprehensive state laws are in force, and twelve of them require universal opt-out signals to be honored. Indiana, Kentucky and Rhode Island joined in 2026, and Maryland bans the sale of sensitive data outright.

What default denied means in practice

Default denied means the defaults are declared before any Google tag runs, so the consent default call sits ahead of the container. In Advanced mode, denied doesn't mean the tag is absent. It loads, writes no cookies and sends no advertising identifiers. In Basic mode, denied means the tag never loads. When the visitor chooses, an update call flips the relevant signals and the queued hits proceed.

Defaults are usually set by region, denied where prior consent is required and granted elsewhere, so a visitor in Ohio isn't held behind a wall you built for Frankfurt. Add a short wait so the tag doesn't fire before the banner has an answer. Then test the live site. Load it cold, watch the network calls and the cookie jar, and confirm that nothing related to advertising happens before you click.

Three failure modes come up again and again, and all three look fine from the admin screen. The banner renders and the tag manager reports healthy, but the consent state being sent is wrong anyway. To check, run a network trace on a clean load, since a screenshot of the banner won't show you any of this.

• Defaults declared after the tag fires, so the first hit has already written a cookie.
• A region list that covers the EEA and forgets the UK.
• A banner that updates its own UI but never sends the consent update.

Advanced mode and pre-consent pings

Consent Mode runs in one of two modes. In Basic, Google's tags aren't loaded at all until consent is granted, so nothing leaves the page before the visitor decides. In Advanced, the tags load immediately and send cookieless pings before any choice is made, and those pings feed Google's conversion modeling. Advanced generally reports more because it has more to model from.

So with Advanced you get better modeled numbers in exchange for a request to a third party before consent exists. The recommendation to use it comes from Google and doesn't come from a regulator. Under a prior opt-in reading, non-essential transmission shouldn't happen first, and a pre-consent ping still carries an IP address, a user agent, a page URL and a timestamp. Basic is the conservative choice, though that call belongs to your counsel.

Regulators look at how things work in practice, whatever you intended. Healthline settled at $1.55 million in 2025 for continuing to share data with advertising partners after people had opted out, which was a wiring failure and had nothing to do with drafting. Consent Mode is meant to close the same sort of gap, where a choice gets recorded somewhere but never reaches the tags.

UserGuard is newly launched, so we can tell you what it's built to do but don't have a long track record to show you. It's designed to set all four signals to denied by default on every page, send the update as soon as a visitor chooses, and log that event against the site, banner version, region and timestamp, which you can export as CSV. It isn't a Google-certified CMP and it isn't IAB TCF validated, and TCF is on the roadmap. GPC and geo-targeting are never paywalled.

Go deeper: how the banner signals consent state · consent analytics you can export