Google Consent Mode v2 Explained (and How to Set It Up in GTM)

Consent Mode v2 changes how Google's tags behave based on whether a visitor has agreed to analytics and ads cookies, and since 2024 it's effectively required to use Google's advertising features in the EEA and UK. The good news: the concept is simple once you stop thinking of consent as just "block the tag." Here's what it is and how to set it up in Google Tag Manager.

What is Consent Mode v2?

The key mental shift: Consent Mode doesn't just stop tags, it changes how they behave. Under denial, Google tags can still send anonymous, cookieless signals, and Google uses conversion modeling to estimate the activity it can no longer observe directly. That's how you keep some measurement while honoring a "no."

The four consent signals

Consent Mode v2 is built on four signals your tags read:

• analytics_storage, analytics cookies (GA4 measurement).
• ad_storage, advertising cookies.
• ad_user_data, whether user data may be sent to Google for ads (new in v2).
• ad_personalization, whether data may be used for personalized ads / remarketing (new in v2).

Each is either granted or denied. The two ad_* data signals are what "v2" added and what Google now requires for EEA/UK advertising.

Defaults and updates: the whole model

Consent Mode works in two beats. You set defaults before anything loads (usually everything denied for regulated regions), then your CMP pushes an update once the user chooses.

How to set up Consent Mode v2 in GTM

The cleanest path uses a certified CMP that integrates with GTM. The shape is always the same:

1. Set denied defaults first. Most certified CMP templates inject the default command on an Initialization - All Pages trigger, which is guaranteed to run before other tags. If you do it manually, it looks like the code below.
2. Let the CMP push the update. When the user accepts or rejects, the CMP calls gtag('consent', 'update', {...}) with the new states.
3. Mark tags' consent settings. Google tags (GA4, Google Ads) are consent-aware automatically. For non-Google tags, set Additional consent checks in the tag's Consent Settings so they wait for the right signal.
4. Verify in Preview. Use the Consent tab in Tag Assistant to see each tag's consent state before and after the user chooses.

// Conceptual default, your CMP template normally does this for you,
// on Initialization (All Pages) so it runs before everything else.
gtag('consent', 'default', {
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  analytics_storage: 'denied',
  wait_for_update: 500
});

// Later, when the user accepts, pushed by the CMP:
gtag('consent', 'update', {
  ad_storage: 'granted',
  ad_user_data: 'granted',
  ad_personalization: 'granted',
  analytics_storage: 'granted'
});

Basic vs. advanced Consent Mode

Advanced mode generally recovers more measurement because Google has cookieless signals to model from. Basic mode collects nothing until consent, simpler, but you lose the denied-traffic estimates.

Common Consent Mode mistakes

• No default before tags fire. If GA4 fires before the denied default, cookies are already set. The default must be first.
• Forgetting the two new ad_* signals. "v1" setups that only set ad_storage and analytics_storage aren't v2-compliant.
• The CMP never pushes the update. Then tags stay held forever and your data flatlines, verify the update actually fires.
• Sending PII regardless of consent. Consent Mode governs Google's storage signals; it doesn't make it okay to push raw emails or phone numbers into analytics.