Google Consent Mode v2 Explained: Signals, Modes and Limits

Published: 10 January 2025 · Updated and last reviewed: 29 August 2026

It is not a cookie banner, a legal basis, or a finding that a website complies with privacy law. A consent-management platform (CMP) collects and records a visitor's choice; Consent Mode can then make Google tags respond to that choice. The site owner still has to decide which technologies need consent, configure the banner and tags accurately, and assess applicable law.

In Basic Consent Mode, Google tags are blocked until consent. In Advanced Consent Mode, a Google tag loads with a denied state where consent is absent and may send consent-state and cookieless measurement pings. Google describes modelling as an attempt to estimate otherwise unobservable conversions or behaviour; it is not a replacement for observed, user-level data and is subject to eligibility, data thresholds, configuration, and product limitations.

For traffic covered by Google's EU User Consent Policy, Google requires the relevant consent signals for certain advertising features. That policy applies to end users in the EEA, the UK, and Switzerland—not simply “the EU.” Start with a truthful regional default, send an update after a choice, and verify the live result in Tag Assistant and Google product diagnostics.

What Google Consent Mode v2 is—and is not

Consent Mode lets a website tell Google tags the consent state associated with a visitor. Tags that support it adapt their behaviour based on those signals. In practical terms, it is a small protocol: the site establishes a default state, then sends an update when the visitor makes or changes a choice.

The “v2” name matters because Google introduced two advertising-related signals in late 2023. The four signals are now commonly discussed together:

The first two concern storage behaviour for relevant Google tags. The latter two are downstream advertising permissions. They are related, but they are not interchangeable. For example, a visitor could allow analytics storage while declining advertising purposes. Treating an “accept all” click as the only possible state loses that distinction and may not reflect the choices a banner presents.

Google's documentation calls these consent types. They are values sent to Google systems, not a universal taxonomy for every script on a page. A Meta pixel, a video embed, a chat tool, and a Google tag each need their own technical and legal review. Consent Mode does not automatically prevent a non-Google tag from setting a cookie.

Important boundary: a Google signal records what the site has instructed Google tags to do. It does not establish that consent was valid, that all tracking is blocked, or that the site's privacy notice and contracts meet a particular jurisdiction's rules.

For the underlying device-access question in Europe, see our explanation of the ePrivacy Directive and cookie law. For a broader review of consent choices and blocking, read cookie consent best practices.

Why the four v2 signals matter

Google's EU User Consent Policy requires advertisers to obtain legally valid consent where required and to use consent signals for certain features when serving end users in the EEA, UK, or Switzerland. Google's policy and product documentation, rather than a generic claim that “EU ads stop working,” are the right place to check which products and features are affected.

The operational impact depends on the feature and the consent state:

• When ad_storage is denied, Google advertising tags should not read or write advertising storage.
• When analytics_storage is denied, Google Analytics tags should not read or write analytics storage.
• When ad_user_data is denied, Google says user data should not be sent to Google for advertising purposes. This signal is relevant to features such as enhanced conversions where applicable.
• When ad_personalization is denied, Google says data should not be used for personalised advertising; this can affect remarketing and personalised-ad use.

That does not mean a denied signal is an error. It may be the correct outcome of a visitor's choice. It also does not mean every granted signal leads to reporting or advertising outcomes. Account linking, tag configuration, Google product eligibility, audience rules, policies, and available data all affect what appears in Google Ads or Analytics.

Avoid a common shortcut: “Consent Mode v2 is legally required everywhere.” Google can make its own product-policy requirements for covered traffic and features. Privacy and communications laws are separate questions that depend on the technology, purposes, locations, and facts. A business can need a consent-aware implementation even when it does not buy ads; conversely, transmitting four granted values does not resolve the legal assessment.

Default and update: the two messages behind Consent Mode

Conceptually, Consent Mode has two stages.

1. Establish a default before Google tags act

A default tells supported Google tags what to do before the visitor has expressed a choice. It needs to be available before the relevant Google tag runs. If the default is sent after a tag has already acted, it cannot reliably rewrite the earlier event.

For an EEA-, UK-, or Switzerland-facing journey where a site relies on opt-in consent for optional Google technologies, a denied default is often the practical technical starting point. It tells the tag not to use the associated storage while the banner is awaiting a choice. It is not a universal legal preset. A site must define its regions and purposes based on its own assessment.

Google supports region-specific defaults using the region parameter. This lets a website apply different initial states by visitor region. The region code is a configuration input, not proof of a visitor's actual location or legal status. Maintain the country list deliberately, document why it exists, and test each relevant route rather than assuming a regional rule applies worldwide.

2. Send an update after a visitor chooses

An update changes the state after the visitor accepts, refuses, saves granular preferences, or later withdraws a choice. A well-integrated CMP maps the choices shown in its interface to the appropriate Google parameters and can send an update when preferences change.

The update should reflect the actual decision—not the decision the marketing team hoped for. If a visitor rejects advertising but allows analytics, the advertising signals should remain denied while the analytics signal may be granted if that matches the implementation and assessment. If the visitor later withdraws permission, update the affected signals and ensure non-Google technologies respond too.

Google documents wait_for_update as an optional timing control on a default consent command. It can instruct Google tags to wait for an update for a limited number of milliseconds before sending data. It can be useful when a consent platform is expected to resolve a stored choice promptly, particularly on a returning visit. It is not a substitute for a pre-tag default, a banner, or proper blocking. Setting a long delay to hide a race condition can harm measurement without curing an incorrect consent flow.

This article intentionally explains the model rather than reproducing an installation snippet. If you manage tags yourself, use Google's current Consent Mode implementation documentation and validate the sequence in your own container. A site with multiple containers, hard-coded tags, or asynchronous CMP loading may need engineering review.

Basic vs Advanced Consent Mode

Google describes two implementation approaches. The meaningful difference is not a “compliant versus non-compliant” label; it is what the Google tag does while consent is denied or unknown.

Basic Mode: hold the tag until permission

In Basic Mode, the site prevents the Google tag from loading until a visitor grants the relevant consent. A refusal means that tag does not send data. This can be easier to explain operationally: no Google-tag request from the blocked tag precedes an opt-in.

The trade-off is measurement coverage. When visitors refuse or never make a choice, there is no tag data from that population for Google to use through Consent Mode. Reports can therefore represent only the people whose consent permitted the tags, alongside any other lawful measurement methods a business uses.

Basic Mode still needs careful work. A tag blocker must cover every route, template, plugin, consent category, and direct gtag.js insertion. Blocking a Google Tag Manager container but leaving a separate Google Ads script in a theme can undermine the intended design. Use a new browser profile to test the first visit, refusal, acceptance, and later withdrawal.

Advanced Mode: adapt a loaded tag to the signal

In Advanced Mode, the Google tag loads with the default consent state. If consent is denied, Google says the tag adjusts its behaviour: it does not use the relevant storage, and it can send cookieless pings. These may contain items such as consent state, timing, conversion-related information, page URL, or an indication of whether a prior page was visited in the same session, as Google documents for the product and configuration.

“Cookieless” is not a synonym for “anonymous,” “risk-free,” or “outside the law.” It primarily describes the absence of the storage governed by the denied parameter. A network request still occurs. Whether that request, its fields, its purposes, or associated device access is permissible is a question for the controller's assessment under applicable law and guidance. Do not select Advanced Mode solely because it promises more reporting.

Choose the mode after involving the people responsible for privacy, analytics, and implementation. Document the intended tag behaviour and test it. The correct choice can differ by region, service, and risk assessment.

What cookieless pings and modelling can—and cannot—do

Advanced Mode is often described as “measurement recovery.” That phrase needs limits. Google can use eligible consented and unconsented data to model conversions or behavioural data where its product conditions are met. The aim is to produce aggregate estimates for gaps caused by consent choices; it is not to recreate a named person's browsing history.

Google's conversion modelling documentation explains that modelling is used only when sufficient data is available and that availability depends on the account and setup. Google Analytics documentation likewise distinguishes observed data from modelled data. Thresholds, reporting identities, traffic volume, configuration, and later Google product changes can all affect whether modelled results appear.

Accordingly, do not promise a recovery percentage, campaign uplift, or audience size from Consent Mode. Google does not publish one result that applies to every website. A small site may not meet conditions for modelling; a larger site may see modelled reporting but still cannot treat it as user-level evidence.

For sound interpretation:

1. Label modelled and observed reporting correctly in internal discussions.
2. Compare like periods only after noting changes to consent rates, tags, campaigns, attribution settings, and site behaviour.
3. Do not use a modelled total to infer that a particular visitor consented or converted.
4. Keep a separate record of consent choices if your accountability process requires one; reporting is not a consent log.

The CMP's role: choice, evidence, and tag coordination

A CMP is not merely a banner design tool. At its best, it provides a preference interface, retains a record of the choice, makes the choice available to the site, and coordinates supported tags. Consent Mode handles only the Google-facing portion of that broader task.

For an advertiser using Google Ads or Google Analytics, a CMP may map consent categories to the four parameters and send default/update states. Verify that mapping. “Analytics” and “marketing” labels vary between CMPs, and an organisation must decide whether its descriptions, vendors, purposes, and signals match reality.

Publishers have an additional distinction. Google states that publishers using AdSense, Ad Manager, or AdMob to serve ads to EEA, UK, or Swiss users must use a Google-certified CMP integrated with the IAB Europe Transparency & Consent Framework (TCF) when required by Google's policy. That publisher requirement should not be casually applied to every advertiser website, nor should an advertiser assume that an ordinary banner automatically meets publisher requirements. Check the current Google certified CMP list and requirements for the product in use.

ConsentEase can help teams present choices and coordinate consent-aware tag behaviour. It should be treated as an implementation tool, not as a legal opinion or a guarantee that every script, jurisdiction, or marketing practice is compliant. A website cookie audit and a live tag review remain useful after installation.

Regional defaults without false certainty

Regional configuration is useful because privacy rules and Google's policy scope are not identical around the world. It is also easy to oversimplify.

Start with a written matrix: the countries you target, the Google products and features used, the legal basis and device-access assessment for each purpose, the banner categories, and the initial signal state. The EEA, UK, and Switzerland deserve particular attention for the EU User Consent Policy. For country-level context, see our cookie consent by country guide.

Do not use a visitor's presumed geography as a reason to turn on every tag by default. US state privacy laws, sector-specific rules, contracts, and user expectations can still matter. Equally, do not call a single denied default “global compliance.” A regional configuration is only a technical expression of a policy decision; review it when markets, vendors, or laws change.

Diagnose measurement without mistaking diagnostics for compliance

When reporting drops after a consent change, first establish whether the behaviour is expected. A refusal population will often reduce directly observed analytics and advertising data. The right question is not “How do we override the refusal?” but “Are the site's choice, signals, and tags behaving as designed?”

A practical verification sequence

1. Inventory tags. List Google tags, containers, direct scripts, plugins, and server-side tagging components. Identify the purposes each one serves.
2. Test a first visit. In a clean browser profile, load a representative page before touching the banner. Use Tag Assistant or browser developer tools to inspect the consent state and requests.
3. Test each meaningful choice. Repeat for reject, accept, granular preferences, and withdrawal. Confirm the Google parameters change as expected and non-Google tags follow their own rules.
4. Check Google diagnostics. Review Google Ads and Google Analytics consent-related messages, but read them as implementation signals. A green diagnostic is not legal clearance.
5. Test regional paths. Where defaults differ by region, use a reliable test method appropriate to the system and verify the configured country codes.
6. Retest after releases. New themes, plugins, campaigns, containers, and CMP updates can change load order or introduce tags.

Tag Assistant can help expose tag firing and consent state. Google Analytics Admin and Google Ads may surface setup or eligibility notices. These tools cannot inspect every third-party request, validate banner wording, or decide whether a lawful basis applies. Pair them with a browser-level review and the guide to blocking cookies before consent.

Legal and governance boundaries

Consent Mode is a technical control, not a compliance certificate. In the EU/EEA, storing or accessing non-essential information on a device commonly engages national rules implementing Article 5(3) of the ePrivacy Directive. Where personal data are processed, GDPR can apply as well. The UK and Switzerland have their own frameworks. The analysis can vary with the technology, purpose, recipients, and country.

That leads to several practical boundaries:

• A granted value should follow a choice that was properly obtained for the relevant purpose; it should not be set merely because a banner was displayed.
• A denied value does not necessarily block every request or every data flow. Review the tag's actual behaviour and the entire page.
• A Google policy requirement is not a regulator's legal conclusion, and satisfying one does not prove satisfaction of the other.
• A CMP cannot determine whether a technology is strictly necessary, whether a particular international transfer arrangement is adequate, or whether a controller's full processing operation is lawful.

This is general information, not legal advice. Obtain advice suited to the services, jurisdictions, and data flows that matter to your organisation.

Sources

• Google tag documentation — Consent mode
• Google Ads Help — EU user consent policy
• Google Ads Help — Consent mode for websites
• Google Ads Help — Conversion modelling through Consent Mode
• Google Ad Manager Help — Certified CMP requirements
• EUR-Lex — ePrivacy Directive, Article 5
• EUR-Lex — GDPR