Google Consent Mode v2: the two lines that decide whether your ads data survives a cookie banner

A cookie banner can fail in two opposite directions. It can let Google's tags run before anyone clicks anything, which is the classic pre-consent violation. Or it can block the tags so completely that Google never hears what the visitor chose, and your conversion data quietly thins out for every visitor in Europe. Google Consent Mode v2 sits between those two failures, and on most sites it comes down to two lines of JavaScript in the right order.

This post covers what those two lines do, the two ways a banner breaks them, how to tell from your own browser which situation you are in, and what changes if your traffic is US-only. For the banner design side (button weight, copy, layout), see cookie consent banners that pass GDPR without tanking conversion. This one is about the plumbing underneath.

What Google Consent Mode v2 changed

Consent mode is a small API built into Google's tag (gtag.js and Google Tag Manager). It lets your page tell Google what a visitor agreed to, and the tags adjust what they store and send. The signals do not block anything on their own. They describe a decision your banner already made.

The original version had two signals:

• ad_storage: whether advertising cookies may be read or written
• analytics_storage: whether analytics cookies may be read or written

Version 2 added two more:

• ad_user_data: whether user data may be sent to Google for advertising
• ad_personalization: whether that data may be used for personalized ads, such as remarketing

The new signals matter because of a deadline. Since March 2024, Google has required advertisers to pass consent signals for visitors in the European Economic Area under its EU user consent policy, which also covers the UK and Switzerland. When those signals are missing, Google has no record that an EEA visitor agreed to anything, and it limits what that traffic can do in Google Ads: audience building, ad personalization, and parts of conversion measurement.

The two lines

Line one sets the default. It has to run before the Google tag loads, which means it sits in your <head> above the gtag.js snippet or the Tag Manager container:

<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('consent', 'default', {
  'ad_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied',
  'analytics_storage': 'denied',
  'wait_for_update': 500
});
</script>

The line that matters is the gtag('consent', 'default', ...) call. wait_for_update gives your consent platform 500 milliseconds to apply a returning visitor's saved choice before tags fire.

Line two is the update. Your banner calls it when the visitor accepts, and again on later page views where a saved choice exists:

gtag('consent', 'update', {
  'ad_storage': 'granted',
  'ad_user_data': 'granted',
  'ad_personalization': 'granted',
  'analytics_storage': 'granted'
});

If the visitor accepts analytics only, grant analytics_storage and leave the other three denied. Most consent platforms make this call for you once their Google integration is switched on, so your job is usually confirming that it fires, not writing it.

Order is everything. A default that runs after the tag has loaded is too late, because the tag has already fired with no consent state at all.

If your traffic is global, you do not have to deny everyone. The default call accepts a region parameter with country codes, so you can set denied defaults for EEA countries and a different default elsewhere. Google's consent mode developer guide documents the parameter and every signal.

Two ways a banner breaks it

The banner does nothing to the tag

The Google tag is pasted into the theme header, the banner is a separate plugin, and the two never talk. Analytics and ad cookies are set on the first page load, before the visitor has clicked anything. This is the pre-consent violation, and the banner is decoration.

The banner blocks the tag but never sends the signal

This one looks responsible. The banner withholds the Google tag until the visitor clicks Accept, then injects it. No cookies before consent.

The problem is that Google never receives a consent state. Visitors who accept load the tag with no ad_user_data or ad_personalization grant, so for EEA traffic Google has no record of the consent it now requires. Visitors who decline load nothing, and their sessions and conversions disappear from your reports with no modeling to fill the gap. You lose the cookie and the measurement.

Consent mode gets some of that back, in one of two ways. In basic mode, the tag still waits for the visitor's choice, but the default and update calls are in place, so accepted visits carry the signals and Google applies a general model to estimate some declined conversions. In advanced mode, the tag loads right away with everything denied and sends cookieless pings, which Google uses to build a model specific to your account. Advanced recovers more; basic sends nothing before a choice. Which fits is a legal judgment as much as a technical one.

How to tell which one your site is in

You can work this out in about five minutes with a private browser window:

1. View the page source and search for 'consent', 'default'. If it is there, confirm it appears above the googletagmanager.com script. If a consent platform sets the default from inside Tag Manager, it will not show in the raw source, so move on to the next steps.
2. Open the network panel in a fresh private window, filter for google, and load the page without touching the banner. Requests to google-analytics.com or googleadservices.com at this point mean the tag is running before a choice.
3. Read the request parameters. Requests sent under consent mode carry a gcs value. G100 means ad and analytics storage are both denied. G111 means both are granted. Click Accept and watch it change.
4. Open Google Tag Assistant if your setup runs through Tag Manager. It shows the consent state at each event.

| What you see | Which state you are in | |---|---| | Google requests before any click, no gcs value | Banner does nothing to the tag | | No requests before a click, no consent default anywhere | Banner blocks the tag, sends no signal | | Requests before a click carrying gcs=G100 | Advanced consent mode, working | | No requests before a click, gcs=G111 after Accept | Basic consent mode, working |

What a US-only site needs instead

The Consent Mode v2 requirement is tied to European traffic. If nearly all your visitors are in the US, a full opt-in banner is not what most US state privacy laws ask for, since they generally work on an opt-out model. Two things matter more:

• A privacy policy link in your footer that discloses the analytics and advertising tags you run. Google Analytics' terms require that disclosure on their own, before any state law enters the picture.
• A "Do Not Sell or Share My Personal Information" link if you are covered by California's privacy law and your ad tags share data for cross-context behavioral advertising. Remarketing pixels usually count. Whether the law's thresholds apply to your business is a question for counsel, not your tag manager.

If you add the opt-out link, make sure clicking it changes what your tags do, not just what a cookie says. Consent mode can carry that choice too: an opt-out that updates ad_personalization to denied tells Google's tags to stop using that visitor for personalized ads.

What the scan checks

The privacy module in the AcuityScan full scan reads your homepage as it is served and reports:

• Which tracking scripts load, split into analytics and marketing
• Whether a consent mechanism is present, with a warning when trackers run and no banner exists
• Tracker scripts in the <head> of a page that also shows a banner, flagged as likely loading before consent
• Whether consent mode signals appear alongside a Google tag
• A privacy policy link, and a Do Not Sell or Share link

Because the scan reads page source, a default set from inside a Tag Manager container will not appear, so confirm that case in Tag Assistant. If you run advanced mode on purpose, your Google tag will be flagged as loading before consent. Check that the default-denied call sits above it: that ordering separates a deliberate setup from a violation. To see which tags your site runs in the first place, the tech lookup checks a URL against 60+ tech stack signatures.

---

Not sure which of the two broken states your site is in? Run a free scan at acuityscan.com to see your trackers, banner, and consent signals in one report, alongside 350+ checks across 8 modules.