İlkan Digital.

Blog · Consent Mode

Consent Mode v2 in Google Tag Manager, step by step

By İlkan Geldigitti ·

Consent Mode v2 is how your website tells Google tags what each visitor agreed to, using four consent types: ad_storage, analytics_storage, ad_user_data and ad_personalization. Google added the last two in November 2023 as part of stricter enforcement of its EU user consent policy, which requires advertisers to obtain consent from users in the European Economic Area, the UK and Switzerland for cookies and for using personal data to personalise ads. If you advertise to those users and want Google Ads measurement, remarketing and ad personalisation to keep working, your tags need to receive these signals.

In Google Tag Manager the setup has four parts: set every consent type to denied before any tag fires, update the state when the visitor answers your cookie banner, make each tag respect that state, and test it. The one-sentence difference between the two modes: in basic consent mode Google tags don't load until the visitor accepts, while in advanced consent mode they load straight away and, while consent is denied, send cookieless pings instead of nothing.

Checked against Google's documentation on 19 October 2026. Sources are linked in each step and listed at the end.

Step 1: Choose how the banner gets consent

Consent mode itself does not ask anyone anything. Google is explicit: "Consent mode doesn't provide a consent banner or widget" (About consent mode, Google Ads Help). You need a banner, either a consent management platform (CMP) or your own, that:

  • shows the choice before optional tags run,
  • lets the visitor accept or reject as easily as each other, and ideally choose by category,
  • stores the choice, because "consent mode doesn't save consent choices" (Set up consent mode on websites),
  • sends the choice to Google tags on the page where it is made and on every page after.

For Tag Manager sites, Google recommends a CMP that integrates with Tag Manager, or loading your own banner through the container with a consent mode template. The policy side also asks you to "retain records of consent given by end users" and to give clear instructions for withdrawing consent (EU user consent policy); most CMPs handle both.

Step 2: Set the defaults to denied, before anything else

By default "no consent mode values are set", so you have to set them. The rule that matters most is the order: the default must be in place before any tag sends data. Google's warning is blunt: "If your consent code is called out of order, consent defaults won't work."

In Tag Manager there are two ways to do this:

  • With a consent template (recommended by Google). Add your CMP's template, or a consent mode template from the Community Template Gallery, and fire it on the Consent Initialization - All Pages trigger. That trigger exists in every web container and "will always fire before all other tags, including any Initialization triggers" (Tag Manager consent mode support). Templates use the Tag Manager consent APIs setDefaultConsentState and updateConsentState.
  • With an inline snippet before the container. If you can't use a template, set the default with gtag('consent', 'default', …) in a script that runs before the GTM snippet.

Either way, the default for visitors who haven't chosen yet looks like this:

gtag('consent', 'default', {
  ad_storage: 'denied',
  analytics_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  wait_for_update: 500
});

wait_for_update gives an asynchronous banner time (here 500 milliseconds) to send an update before tags fire.

Two optional settings from Google's guide:

  • ads_data_redaction further redacts ads data while ad_storage is denied.
  • url_passthrough passes ad-click information through URL parameters across pages. In Tag Manager you can turn it on in the Conversion Linker tag with Enable linking on all page URLs.

Step 3: Send an update when the visitor chooses

When the visitor clicks Accept, Reject or saves their categories, the banner must send an update, and on later pages the stored choice must be applied again. Google's guide: "After a user grants consent, persist their choice and call the update command accordingly on subsequent pages."

Map your banner categories to the four types. A common mapping:

Banner category Consent types
Analytics analytics_storage
Advertising ad_storage, ad_user_data, ad_personalization

Withdrawing consent uses the same update with denied. If you use a Tag Manager template, use its updateConsentState call; Google notes that gtag('consent', 'update', …) should not be used in templates instead of it, because gtag commands are queued and "may not be processed before the next event begins".

Example: the setup on this site

This site uses its own banner and basic consent mode. The parts that matter:

  1. An inline script in the page <head>, before the GTM snippet, reads the stored choice and sets the defaults. With no stored choice, all four types are denied.
  2. The choice is kept in the browser's local storage under the key consent, as {"analytics": true|false, "ads": true|false}.
  3. Accept, Reject or Save sends the update and pushes an event that GTM can trigger on:
gtag('consent', 'update', {
  analytics_storage: analytics ? 'granted' : 'denied',
  ad_storage: ads ? 'granted' : 'denied',
  ad_user_data: ads ? 'granted' : 'denied',
  ad_personalization: ads ? 'granted' : 'denied'
});
dataLayer.push({ event: 'consent_update', consent_state: analytics || ads ? 'granted' : 'denied' });

The consent_update event is used as an extra trigger for the Google tag and the Conversion Linker, so measurement starts on the same page where the visitor accepts instead of on the next one.

Step 4: Make every tag respect consent

Turn on Consent overview first: Admin → Container Settings → Enable consent overview. It lists every tag as Consent Configured or Consent Not Configured, and lets you edit settings in bulk.

Then, per tag, open Advanced Settings → Consent Settings:

  • Built-in consent checks. The Google tag, Google Analytics, Google Ads, Floodlight and Conversion Linker tags already read the consent state and change their behaviour. Their checks are shown on the tag.
  • Additional consent checks. You can require consent for a tag to fire at all: Require additional consent for tag to fire fires the tag only if every listed type is granted when it triggers. This is how basic consent mode is built in Tag Manager. Without additional checks, Google tags run in advanced mode.
  • Other vendors' tags (non-Google pixels, chat widgets, heatmaps) have no built-in checks. Set Require additional consent on them, or your banner choice is ignored for those tags.

A typical basic-mode setup:

Tag Additional consent required
Google tag (GA4) analytics_storage
GA4 event tags analytics_storage
Conversion Linker ad_storage
Google Ads conversion ad_storage, ad_user_data
Other advertising pixels the advertising types they need

Which mode to choose is a business and legal decision. Google's overview notes that basic mode gives a general conversion model while advanced mode gives an advertiser-specific one (Consent mode overview). With basic mode, "no data is transferred to Google at all – not even the consent status" until the visitor consents.

Step 5: Test in Tag Assistant and GA4 DebugView

Tag Assistant (Preview). In the GTM workspace click Preview, enter your URL and Connect (Preview and debug containers). Use a private window so no earlier choice is stored, then check:

  1. Before any choice: select the first events in the left column. The Consent tab shows the default state with all four types denied. In basic mode, the Google tags are listed under Tags Not Fired.
  2. Reject: the update keeps everything denied; nothing new fires.
  3. Accept (new private window): the Consent tab shows the update with granted, and the tags that require consent now fire.
  4. On the next page: the stored choice is applied before tags fire, with no banner.

GA4 DebugView. In GA4, Admin → DebugView shows events from browsers in debug mode, which Tag Assistant switches on (Monitor events in DebugView). Expect nothing before consent: Google notes that events aren't visible in debug mode if consent mode is on and the user hasn't given consent for Analytics cookies. After Accept you should see page_view and your events.

Common mistakes

  • The default arrives too late. A default set by a tag on the normal All Pages trigger, or a CMP script loaded after GTM, lets tags fire before the state is known. Use the Consent Initialization trigger or put the default before the container snippet.
  • The update never comes. The banner saves the choice but doesn't send update, or sends it only on the page where the visitor clicked. Check the Consent tab on a second page.
  • Categories mapped wrong. "Accept analytics" granting ad_storage, or the two v2 types (ad_user_data, ad_personalization) never updated at all.
  • Region set incorrectly. The region parameter scopes a default to ISO 3166-2 codes, and the most specific region wins. A default meant for the EEA that lists the wrong codes, or a stray global default that overrides it, leaves visitors in the wrong state. Google recommends scoping defaults to the regions where you show a banner.
  • Non-Google tags ignored. A pixel or widget without built-in checks fires regardless of the banner unless you add Require additional consent.
  • Two banners or two defaults. A CMP plus a leftover inline default can contradict each other. Keep one source of truth.

FAQ

Is Consent Mode v2 the same as a cookie banner? No. The banner collects the choice; consent mode passes it to Google tags. You need both.

Do I need it if I don't advertise in Europe? Google's EEA update targets users in the EEA, and the EU user consent policy also covers the UK and Switzerland. Outside those regions it depends on local law and your own policy; many sites use it everywhere for one consistent setup.

Basic or advanced? Basic sends nothing to Google before consent; advanced sends cookieless pings while consent is denied and supports more detailed modelling. Choose with your legal advisor; Tag Manager supports both.

Does consent mode work for Meta or other platforms? No. It's a Google mechanism. Other platforms' tags need your banner's choice applied through Tag Manager's additional consent checks or the platform's own consent API.

Restricted categories add another layer on top of consent: the guide to Meta health and wellness restrictions in 2026 covers what Meta blocks even when consent is given.

Sources

Free first look

Stuck on this in your own account?

Send a short note with what you see. A reply arrives within 1 business day. No payment is requested before a written proposal.