Google Consent Mode v2: Implementation Guide for Developers (2026)

What is Consent Mode v2?

Consent Mode is a Google API that lets your website communicate user consent choices to Google tags (Analytics, Ads, Floodlight). Instead of blocking tags entirely when consent is denied, Consent Mode adjusts tag behaviour: cookieless pings replace full tracking, preserving some measurement while respecting the user's choice.

The original Consent Mode (v1) had two signals: ad_storage and analytics_storage. In November 2023, Google introduced Consent Mode v2 with two additional signals required for EU compliance.

The four consent signals

Consent Mode v2 requires you to declare four consent states before any Google tag fires. Two are from v1, two are new:

Step-by-step implementation for GA4 + GTM

There are two paths: direct gtag.js implementation (if you load GA4 directly) and GTM-based implementation (if you use Google Tag Manager). Choose the one that matches your setup.

Path A: Direct gtag.js implementation

<!-- Consent defaults — MUST come before gtag.js -->
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){ dataLayer.push(arguments); }

  gtag('consent', 'default', {
    ad_storage: 'denied',
    ad_user_data: 'denied',
    ad_personalization: 'denied',
    analytics_storage: 'denied',
    wait_for_update: 500  // ms to wait for consent banner response
  });
</script>

<!-- Now load gtag.js -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXX"></script>
<script>
  gtag('js', new Date());
  gtag('config', 'G-XXXXXXXX');
</script>

// User clicked "Accept All"
gtag('consent', 'update', {
  ad_storage: 'granted',
  ad_user_data: 'granted',
  ad_personalization: 'granted',
  analytics_storage: 'granted'
});

// User clicked "Accept Analytics Only"
gtag('consent', 'update', {
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  analytics_storage: 'granted'
});

// After gtag('consent', 'default', ...) runs:
const stored = localStorage.getItem('consent_state');
if (stored) {
  const consent = JSON.parse(stored);
  gtag('consent', 'update', consent);
}

Path B: GTM-based implementation

window.dataLayer.push({
  event: 'consent_update',
  // GTM reads consent from gtag calls, not this event directly.
  // Your CMP should call gtag('consent', 'update', ...) as in Path A.
});

How to verify it's working

Implementation without verification is guesswork. Here are the three methods, ranked by reliability:

1. Chrome DevTools (quickest)

1. Open your site in Chrome. Open DevTools (F12).
2. Go to the Network tab. Filter by google or collect.
3. Load the page without accepting cookies.
4. Find the collect?v=2 request (GA4 measurement protocol hit).
5. Check the query parameters: look for gcs= (Google Consent State). The value encodes your four consent signals:
   • gcs=G100 = all denied (correct default)
   • gcs=G111 = all granted
   • Any gcs=G1 prefix confirms Consent Mode is active
6. Now accept cookies and check the next request. gcs= should change to reflect the granted state.

2. Google Tag Assistant (most detailed)

1. Install the Tag Assistant Companion Chrome extension.
2. Open Tag Assistant and connect to your site.
3. Look for the Consent tab in the event timeline. It shows the consent state at each tag fire.
4. Verify that the initial state shows all four signals as denied.
5. Accept cookies and confirm the signals update to granted.

3. GA4 DebugView (most complete)

1. Enable GA4 DebugView: add ?debug_mode=true to your URL or set debug_mode: true in your gtag config.
2. Open GA4 → Admin → DebugView.
3. Watch real-time events. Each event shows a consent state icon. A shield icon indicates cookieless mode (consent denied).

Common mistakes (and how to fix them)

1. Defaulting to granted

gtag('consent', 'default', {
  ad_storage: 'granted',       // ❌ Violates GDPR — opt-out model
  ad_user_data: 'granted',    // ❌ Same problem
  ad_personalization: 'granted', // ❌ Same problem
  analytics_storage: 'granted'  // ❌ Same problem
});

2. Missing ad_user_data and ad_personalization

Many implementations from 2023 only set ad_storage and analytics_storage. That was Consent Mode v1. If you're missing the two new signals, Google treats your implementation as non-compliant. Both new signals must be present in both the default and update calls.

3. Consent defaults run after gtag.js loads

If gtag('consent', 'default', ...) runs after the Google tag script, the first page view has no consent context. Google tags fire once on load, and that first hit won't have your consent defaults applied. The default call must be the very first gtag call in the page, before any script tag that loads gtag.js or gtm.js.

4. Not handling banner dismissal

If a user closes the banner without clicking Accept or Reject, most implementations do nothing. Consent stays denied (which is correct), but the banner often reappears on every page, creating a poor UX. Worse: some implementations treat dismissal as acceptance.

Best practice: Treat dismissal as "denied". Suppress the banner for 24 hours (store a flag in localStorage). Show it again on the next visit. Never infer consent from inaction.

5. Missing geo-targeting

Consent Mode is only required for users in the EEA, UK, and Switzerland. For users outside these regions, you can default to granted (since there's no EU consent requirement). Google supports region parameter in the default call:

gtag('consent', 'default', {
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  analytics_storage: 'denied',
  region: ['AT', 'BE', 'BG', 'HR', 'CY', 'CZ', 'DK', 'EE',
           'FI', 'FR', 'DE', 'GR', 'HU', 'IE', 'IT', 'LV',
           'LT', 'LU', 'MT', 'NL', 'PL', 'PT', 'RO', 'SK',
           'SI', 'ES', 'SE', 'GB', 'IS', 'LI', 'NO', 'CH'],
  wait_for_update: 500
});

// Users outside listed regions get full tracking by default
gtag('consent', 'default', {
  ad_storage: 'granted',
  ad_user_data: 'granted',
  ad_personalization: 'granted',
  analytics_storage: 'granted'
});

6. Not re-firing tags after consent update

When gtag('consent', 'update', ...) runs, Google tags that were blocked will automatically re-fire if they use wait_for_update. But if you're using a custom implementation that blocks script loading (not just consent signalling), you need to manually reload those scripts after consent is granted. Consent Mode is about signalling, not script blocking.

How CookieGuard automates verification

Manual verification with DevTools works, but it doesn't scale. You can't check every page, every deploy, every new tag your marketing team adds. CookieGuard's scanner validates Consent Mode v2 implementation automatically:

Add it to your CI/CD pipeline and violations get caught before they ship. See our full compliance checklist for the GitHub Action setup.

Consent Mode v2 vs. blocking scripts entirely

A common question: why not just block all Google scripts until consent is granted? You can. It's simpler. But there's a trade-off.

With script blocking, you get zero analytics data from users who don't consent. In markets where consent rates are 30-50%, that's half your traffic invisible.

With Consent Mode, Google sends cookieless pings even when consent is denied. These pings don't set cookies and don't contain personally identifiable information. Google uses them for conversion modelling, which fills in estimated conversions from the unconsented traffic. This typically recovers 50-70% of the data you'd otherwise lose.

For most sites, Consent Mode v2 is the right balance: legally compliant, still useful data, and required by Google anyway.

Quick reference: the complete code

Here's the full implementation in one block. Copy-paste into your <head>, before any other scripts:

<!-- 1. Consent defaults (FIRST thing in <head>) -->
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){ dataLayer.push(arguments); }

  // Default: deny everything for EEA + UK + EFTA
  gtag('consent', 'default', {
    ad_storage: 'denied',
    ad_user_data: 'denied',
    ad_personalization: 'denied',
    analytics_storage: 'denied',
    wait_for_update: 500
  });

  // Restore previous consent if user already chose
  const stored = localStorage.getItem('cookie_consent');
  if (stored) {
    try {
      gtag('consent', 'update', JSON.parse(stored));
    } catch(e) {}
  }
</script>

<!-- 2. Load GA4 -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXX"></script>
<script>
  gtag('js', new Date());
  gtag('config', 'G-XXXXXXXX');
</script>

<!-- 3. Consent banner callbacks -->
<script>
  function acceptAll() {
    const consent = {
      ad_storage: 'granted',
      ad_user_data: 'granted',
      ad_personalization: 'granted',
      analytics_storage: 'granted'
    };
    gtag('consent', 'update', consent);
    localStorage.setItem('cookie_consent', JSON.stringify(consent));
    hideBanner();
  }

  function rejectAll() {
    const consent = {
      ad_storage: 'denied',
      ad_user_data: 'denied',
      ad_personalization: 'denied',
      analytics_storage: 'denied'
    };
    gtag('consent', 'update', consent);
    localStorage.setItem('cookie_consent', JSON.stringify(consent));
    hideBanner();
  }
</script>