Implementing Google Consent Mode v2 via Google Tag Manager: Step-by-Step Technical Guide

Executive Summary: Why Consent Mode v2 is Mandatory

In response to the European Union's Digital Markets Act (DMA) and enforcement guidelines from privacy authorities, Google introduced Consent Mode v2. For advertisers and website publishers utilizing Google Ads, Google Analytics 4 (GA4), and Floodlight tags targeting users in the European Economic Area (EEA) and the UK, Consent Mode v2 is mandatory.

Without valid Consent Mode v2 signals, Google Ads ceases collecting attribution data for remarketing campaigns, and audience lists in GA4 stop populating for European traffic. In this technical walkthrough, we break down the four core consent parameters, review Google Tag Manager (GTM) architectural patterns, and implement both Advanced and Basic consent modes.

The Four Core Consent Mode v2 Signals

Consent Mode v2 expands upon original consent parameters (analytics_storage and ad_storage) by introducing two new granular flags:

• analytics_storage: Grants permission to store cookies and device identifiers for Google Analytics tracking.
• ad_storage: Grants permission to store cookies and device identifiers for Google Ads conversion tracking and retargeting.
• ad_user_data: (New in v2) Controls whether user personal data (such as hashed email or phone number in enhanced conversions) can be transmitted to Google for advertising attribution.
• ad_personalization: (New in v2) Controls whether collected event data can be leveraged for personalized remarketing campaigns within Google's ad networks.

Basic Consent Mode vs Advanced Consent Mode

1. Basic Consent Mode Architecture

In Basic Consent Mode, Google tags are completely blocked from executing until the user interacts with your Consent Management Platform (CMP) and clicks "Accept". If the user denies consent, no network pings or data packets are dispatched to Google servers. While simple, this architecture forfeits all conversion modeling.

2. Advanced Consent Mode Architecture

In Advanced Consent Mode, Google tags load immediately upon page initialization, but their behavior dynamically adapts based on initial consent states. When consent is denied, tags transmit cookieless, state-less pings (pings without cookie identifiers) to Google servers. Google's machine learning models utilize these cookieless pings to recover up to 70% of lost conversion data through statistical modeling while preserving user privacy.

Step-by-Step Implementation Guide via GTM

Step 1: Define Default Consent State via Inline Script

To avoid race conditions where tags fire before your CMP evaluates regional rules, inject a default consent declaration in your HTML <head> before the GTM container script:

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}

  gtag('consent', 'default', {
    'ad_storage': 'denied',
    'ad_user_data': 'denied',
    'ad_personalization': 'denied',
    'analytics_storage': 'denied',
    'wait_for_update': 500
  });
</script>

Step 2: Connect a Google-Certified CMP (Consent Management Platform)

Google requires publishers to deploy a Google-Certified CMP (such as Cookiebot, OneTrust, Didomi, or Iubenda) that supports TCF v2.2. Install the certified CMP Community Template directly into your Google Tag Manager workspace.

Step 3: Enable Built-In Consent Checks in GTM Tags

1. In Google Tag Manager, open Admin > Container Settings.
2. Check the box Enable consent overview and click Save.
3. Navigate to Tags > Consent Overview (shield icon).
4. Verify that your GA4 Configuration, GA4 Event tags, and Google Ads Conversion Tracking tags display "Built-in Consent Checks" for analytics_storage and ad_storage.

You can configure event payloads using our Google Analytics 4 Tracking Hub and format telemetry JSON with our JSON Formatter Tool.

Step 4: Verify Consent Updates via GTM Preview Mode

Launch GTM Preview Mode via Tag Assistant. In the left execution timeline, inspect the Consent tab for each event. Verify that when you accept cookies on your banner, a consent > update event fires with status granted across all four flags.

Common Pitfalls & Troubleshooting

• Firing Tags Before Consent Initialization: If GTM tags trigger on "Initialization" before the default consent state script runs, tags may read granted status inadvertently. Always place default scripts above GTM.
• Failing to Pass ad_user_data on Enhanced Conversions: When passing customer data parameters to Google Ads, ensure ad_user_data is explicitly evaluated. If denied, strip user identifier objects before transmission.

Frequently Asked Questions

Is Consent Mode v2 required for sites outside Europe?

Consent Mode v2 is legally enforced for users located in the EEA and UK. However, international brands adopt it globally to comply with emerging privacy regulations across California, Canada, and Australia.

Does Consent Mode v2 affect Google AdSense?

Yes. AdSense publishers serving ads to European users must implement a Google-Certified CMP that integrates TCF v2.2 and passes consent signals to Google's programmatic ad exchange.

What happens if I don't implement Consent Mode v2?

Google Ads remarketing lists for EEA traffic will completely stop recording new users, and smart bidding algorithms will experience degraded performance due to lost conversion attribution signals.

Advanced Implementation: Custom Tag Sequencing and DataLayer Consent State Management

While turnkey Consent Management Platforms (CMPs) automate basic consent collection, high-traffic web applications frequently require custom tag sequencing architectures to ensure zero data loss while remaining strictly compliant with EU/EEA privacy mandates.

The Consent State Lifecycle in the Browser

Understanding the exact sequence of browser execution events is critical to prevent race conditions:

1. Inline Default Script: Executes synchronously before GTM container loads. Declares default denied states for ad_storage, analytics_storage, ad_user_data, and ad_personalization.
2. GTM Container Initialization: GTM scripts load and evaluate the built-in consent status of all active tags.
3. CMP Script Evaluation: The Consent Management Platform loads stored user preferences from localStorage or cookies.
4. gtag('consent', 'update') Dispatch: The CMP fires an update command passing the user's explicit selections.
5. Tag Assistant & Consent Trigger Firing: GTM evaluates waiting tags and triggers authorized tracking pings.

Step-by-Step Debugging via Chrome DevTools & Tag Assistant

To verify Consent Mode v2 in real time:

1. Open your website in Chrome and open Developer Tools (F12 > Network tab).
2. Filter network requests by collect?v=2 to inspect Google Analytics 4 tracking pings.
3. Inspect the query string parameters of the outgoing request:
   • gcs: Indicates Google Consent Status (e.g., G111 indicates consent granted for both Ads and Analytics, while G100 indicates denied).
   • gcd: Represents the granular Consent Mode v2 string containing encoded values for ad_storage, analytics_storage, ad_user_data, and ad_personalization.

Use our Google Analytics 4 Tracking Hub to format testing payloads and confirm event parameters.