Google Consent Mode v2: Complete Setup Guide for GDPR Compliance

In March 2024, Google began enforcing Consent Mode v2 for all websites in the European Economic Area. Without a properly configured implementation, your Google Ads remarketing audiences will stop populating, your Analytics data will have significant gaps, and your conversion tracking will degrade. At the same time, a misconfigured setup can violate GDPR consent requirements.

This guide walks through the technical and legal aspects of Google Consent Mode v2, explains the differences between basic and advanced mode, and provides concrete implementation instructions with CMP integration examples.

What Changed With Consent Mode v2

Google Consent Mode was originally introduced in 2020 as an optional framework for integrating consent management platforms with Google tags. Version 2, announced in late 2023 and enforced from March 2024, introduced two critical changes:

New Consent Parameters

GCM v2 added two new parameters that must be explicitly set:

Parameter	Purpose	New in v2
ad_storage	Controls advertising cookies (e.g., gcl*)	No (v1)
analytics_storage	Controls analytics cookies (e.g., _ga, _gid)	No (v1)
ad_user_data	Controls sending user data to Google for advertising	Yes
ad_personalization	Controls personalized advertising (remarketing)	Yes
functionality_storage	Controls functionality cookies	No (v1)
personalization_storage	Controls personalization cookies	No (v1)
security_storage	Controls security-related storage	No (v1)

The two new parameters — ad_user_data and ad_personalization — are required for compliance with the EU Digital Markets Act (DMA) and Google’s updated policies.

Enforcement Timeline

Date	Event
November 2023	Google announces GCM v2 requirement
January 2024	CMP vendors begin supporting new parameters
March 2024	Enforcement begins: websites without GCM v2 lose remarketing and audience features
Ongoing	Google continues to restrict data usage for non-compliant implementations

Basic Mode vs. Advanced Mode

This is the single most important decision in your GCM v2 implementation, and it has both legal and business implications.

Basic Mode

In basic mode, Google tags do not load at all until the user grants consent. No data is collected, no pings are sent, no cookies are set.

How it works:

1. Page loads. Google tags are not initialized.
2. User interacts with the cookie banner.
3. If consent is granted: tags load normally and collect full data.
4. If consent is denied: tags never load. Zero data collection.

Pros:

• Maximum legal safety — no data processing without consent
• Simple to understand and explain in a privacy policy
• No questions from DPAs about cookieless pings

Cons:

• No conversion modeling for unconsented users
• Potentially significant data gaps (30-70% of users may not consent)
• Remarketing audiences are smaller

Advanced Mode

In advanced mode, Google tags load immediately but operate in a restricted state until consent is given. Without consent, tags send cookieless, anonymized pings that Google uses for conversion modeling.

How it works:

1. Page loads. Consent defaults fire with all parameters set to 'denied'.
2. Google tags load and send cookieless pings (no cookies set, no user data stored).
3. User interacts with the cookie banner.
4. If consent is granted: consent update fires, tags switch to full data collection.
5. If consent is denied: tags continue in restricted mode (cookieless pings only).

Pros:

• Conversion modeling recovers 50-80% of lost conversion data
• Better signal for Google Ads bidding algorithms
• Remarketing audiences are modeled, not empty

Cons:

• Cookieless pings still involve data processing (IP address transmitted to Google servers, even if not stored)
• Requires clear disclosure in your privacy policy
• Some DPAs may consider cookieless pings as requiring consent (the legal interpretation is evolving)

Which Should You Choose?

Factor	Basic Mode	Advanced Mode
Legal risk	Lowest	Moderate (depends on DPA interpretation)
Data recovery	None	50-80% via modeling
Google Ads impact	Significant data loss	Manageable with modeling
DPA scrutiny	Unlikely	Possible
Privacy policy requirement	Standard	Must disclose cookieless pings
Best for	Privacy-first websites, low ad spend	Ad-dependent businesses, e-commerce

Technical Implementation

Step 1: Set the Default State

The consent default must fire before any Google tags load. Place this in the <head> of your page, before any gtag.js or GTM scripts:

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}

  gtag('consent', 'default', {
    'ad_storage': 'denied',
    'ad_user_data': 'denied',
    'ad_personalization': 'denied',
    'analytics_storage': 'denied',
    'functionality_storage': 'granted',
    'personalization_storage': 'denied',
    'security_storage': 'granted',
    'wait_for_update': 500
  });
</script>

The wait_for_update parameter (in milliseconds) tells Google tags to wait for a consent update before sending any data. Set it to the expected time your CMP takes to load (300-500ms is typical).

Step 2: Load Google Tags

After the default state is set, load your Google tags normally:

<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX"></script>
<script>
  gtag('js', new Date());
  gtag('config', 'G-XXXXXXX');
</script>

Or, if using Google Tag Manager:

<script async src="https://www.googletagmanager.com/gtm.js?id=GTM-XXXXXXX"></script>

Step 3: Update Consent on User Action

When the user grants or revokes consent via your cookie banner, fire a consent update:

// User accepts analytics and marketing
gtag('consent', 'update', {
  'ad_storage': 'granted',
  'ad_user_data': 'granted',
  'ad_personalization': 'granted',
  'analytics_storage': 'granted'
});

// User accepts only analytics
gtag('consent', 'update', {
  'analytics_storage': 'granted'
});

// User revokes all consent
gtag('consent', 'update', {
  'ad_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied',
  'analytics_storage': 'denied'
});

Step 4: Verify the Implementation

Use Google Tag Assistant (https://tagassistant.google.com/) to verify:

• Consent defaults are firing before tags load
• Consent updates are firing correctly on user interaction
• All seven consent parameters are being set
• Tags are responding to consent state changes

CMP Integration

Most consent management platforms now support GCM v2 natively. The CMP should:

1. Fire gtag('consent', 'default', {...}) on page load with all parameters denied
2. Map its consent categories to GCM v2 parameters
3. Fire gtag('consent', 'update', {...}) when the user makes a choice
4. Persist the consent state and restore it on subsequent page loads

Mapping Consent Categories to GCM Parameters

CMP Category	GCM v2 Parameters
Necessary / Essential	functionality_storage: granted, security_storage: granted
Analytics / Statistics	analytics_storage: granted
Marketing / Advertising	ad_storage: granted, ad_user_data: granted, ad_personalization: granted
Personalization / Preferences	personalization_storage: granted

Compliso’s cookie banner handles this mapping automatically. When a user grants consent to the “Analytics” category, the banner fires the correct GCM v2 update for analytics_storage. The “Marketing” category maps to ad_storage, ad_user_data, and ad_personalization.

Impact on Google Ads and Analytics

Google Analytics 4

Without consent, GA4 will not set cookies or collect user-level data. In advanced mode, GA4 receives cookieless pings and uses behavioral modeling to estimate metrics. In basic mode, unconsented sessions are simply missing.

Expect to see a “Consent mode” card in GA4’s Data Quality section showing the percentage of data that is modeled vs. observed.

Google Ads

The impact on Google Ads is more significant:

• Conversion tracking: Without ad_storage and ad_user_data granted, conversions from unconsented users are not directly tracked. Advanced mode enables conversion modeling.
• Remarketing: Without ad_personalization granted, users cannot be added to remarketing audiences. Advanced mode enables audience modeling.
• Smart Bidding: Algorithms rely on conversion data. Less data means less effective bidding. Advanced mode mitigates this through modeled conversions.

Common Mistakes

1. Consent Default Fires After Tags Load

If your gtag('consent', 'default', {...}) runs after gtag.js or GTM has already initialized, the default state is ignored. Tags will behave as if consent was granted.

Fix: Always place the consent default script before any Google tag scripts in your HTML.

2. Missing ad_user_data and ad_personalization

Many v1 implementations only set ad_storage and analytics_storage. Without the two new v2 parameters, Google treats your implementation as non-compliant.

Fix: Explicitly set all seven parameters in both the default and update calls.

3. Not Firing Consent Update on Reject

Some implementations only fire a consent update when the user accepts. If the user rejects, no update is fired. This leaves tags in the “waiting for update” state.

Fix: Fire a consent update with 'denied' values when the user rejects.

4. Consent State Not Persisted Across Pages

If the consent state is only stored in memory and not in a first-party cookie, every page load triggers a new consent default followed by an unnecessary wait period.

Fix: Store consent in a first-party cookie and restore the state on page load.

5. Using wait_for_update With Basic Mode

In basic mode, tags should not load until consent is granted. The wait_for_update parameter is only relevant for advanced mode.

Fix: Omit wait_for_update in basic mode or conditionally load tags only after consent.

Compliance Checklist

• Consent default fires before any Google tags load
• All seven GCM v2 parameters are set in the default call
• ad_user_data and ad_personalization are explicitly included
• Consent update fires on both accept and reject actions
• CMP consent categories are correctly mapped to GCM parameters
• Consent state is persisted in a first-party cookie
• Privacy policy discloses cookieless pings (if using advanced mode)
• Implementation verified with Google Tag Assistant
• GA4 Data Quality section shows consent mode is active
• Google Ads conversion tracking is functioning with the new parameters

Set Up GCM v2 With Compliso

Compliso’s cookie banner widget has Google Consent Mode v2 built in. It fires the correct consent default on page load, maps consent categories to all seven GCM parameters, and sends consent updates in real time. No manual gtag calls, no integration headaches.

Scan your website to check your current GCM v2 implementation, or get started with Compliso to deploy a fully compliant setup.