Google Consent Mode v2: Implementation Guide

Every visitor who clicks "reject" on your cookie banner is a conversion your Google Ads account may never see. According to Google, users who consent are typically two to five times more likely to convert than users who don't. That gap doesn't just distort your reports. Smart Bidding learns from whatever data arrives, so a leaky setup quietly trains your campaigns on a smaller, skewed sample. Google Consent Mode v2 is where you decide how big that gap gets.

Google Consent Mode v2 passes each visitor's consent choice to Google tags through four parameters: ad_storage, analytics_storage, ad_user_data and ad_personalization. In advanced mode, tags load with a default of "denied" and send cookieless pings when consent is refused, which Google Ads and GA4 use to model missing conversions and behaviour. In basic mode, tags stay blocked until consent is given, and Google Ads can only fall back on a general model.

One thing up front: this guide looks at Consent Mode through the lens of measurement quality and campaign management. It is not legal advice. Whether you may process any data after a refusal is a question for your data protection officer or legal counsel.

What Google Consent Mode v2 does and why it matters since 2024

Consent Mode is not a cookie banner. It is the layer between your banner, the consent management platform or CMP, and Google's tags. The banner asks the question, Consent Mode translates the answer into signals, and the tags change their behaviour accordingly.

In November 2023 Google added two parameters, ad_user_data and ad_personalization. From March 2024, Google began enforcing its EU user consent policy more strictly, including for measurement features. The policy protects end users in the European Economic Area, the UK and Switzerland. If you want to keep using measurement, ad personalisation and remarketing for those users, you need to collect consent and pass it on to Google. GA4 now flags missing signals in its consent settings, and Google states that without them, only users outside the EEA have been included in audiences for linked ad products since early March 2024.

In budget terms: missing v2 signals cost you remarketing lists and personalisation in the EEA. Misconfigured signals cost you reported conversions, and your bid strategies end up optimising on thinner, biased data.

The four parameters and what each one switches off

ad_storage governs advertising cookies. When denied, Google says no new advertising cookies are written and no existing first-party advertising cookies are read. IP addresses are truncated at collection.

analytics_storage governs analytics cookies. When denied, GA4 neither reads nor writes first-party analytics cookies, though in advanced mode cookieless pings still reach Google Analytics.

ad_user_data controls whether user data may be sent to Google for advertising. Google explicitly names enhanced conversions as a use case that depends on it. When denied, personal data is not used for online advertising and click-ID-based conversion export is limited.

ad_personalization controls personalised advertising. When denied, features such as Google Ads remarketing receive no data. Personalised ads need both ad_user_data and ad_personalization to be granted.

These two newer parameters explain why many older setups are leaking today. For EEA customers still on v1, Google ran a one-time automatic mapping that copied the ad_storage value into ad_user_data. It did not do the same for ad_personalization. If nobody upgraded the setup, audience features simply stop working, with no red warning in the main interface.

Basic vs advanced mode: the real budget decision

In basic mode, Google tags don't load until the user interacts with the banner. If they refuse, nothing reaches Google, not even the consent state. GA4 cannot fill gaps with modelled data, and Google Ads conversion modelling relies on a general model.

In advanced mode, tags load immediately with consent defaulting to denied. On refusal they send cookieless pings. Google's developer documentation lists what these contain: functional information such as timestamp, user agent and referrer, plus aggregate signals such as whether the URL carried ad-click information like a GCLID, a consent-state boolean and a random number generated on each page load. Google uses this to build an advertiser-specific model, which it describes as more detailed than the general one.

From a performance standpoint, advanced mode wins almost every time. Whether you are allowed to run it is a privacy and legal call that marketing shouldn't make alone. Make the decision deliberately and document it, rather than inheriting whatever your CMP ships as a default.

Conversion modelling: the thresholds many accounts miss

Modelling is not a toggle. It depends on volume.

For Google Ads conversion modelling, Google requires a correct Consent Mode implementation and 700 ad clicks over 7 days per country and domain grouping. That averages out to 100 clicks a day, per country and domain rather than per account. A B2B advertiser with 40 daily clicks per country won't qualify, however clean the tagging is.

For GA4 behavioural modelling, Google requires at least 1,000 events per day with analytics_storage denied for at least 7 days, and at least 1,000 daily users with analytics_storage granted on at least 7 of the previous 28 days. Consent Mode must run on every page, and tags must load before the banner appears. Even then, Google does not guarantee eligibility. You only see modelled data after switching the reporting identity to "Blended" under Admin › Data display › Reporting identity.

What this means for steering spend: below the thresholds, modelling won't rescue you. Enhanced conversions and clean offline conversion imports become your main levers.

Hands-on: audit your setup in six steps

Set the default first. The gtag('consent', 'default', …) call must run on every page before any config or event command. Google is blunt about it: if consent code runs out of order, defaults won't work. Set all four parameters explicitly.
Handle slow banners. If your CMP loads asynchronously, add wait_for_update with a value in milliseconds. Google's own example uses 500 ms. Without that buffer, tags may fire before the update lands.
Separate regions cleanly. The region parameter accepts ISO 3166-2 codes, so you can set defaults per country. The more specific region wins, and a default without a region applies to everyone else.
Update on every change. Revoking consent, from granted to denied, also runs through the update command, on the page where it happens and before navigation. In Google Tag Manager, use the setDefaultConsentState and updateConsentState APIs or your CMP's Consent Mode template, not gtag('consent','update').
Walk through Tag Assistant. Load the site in Tag Assistant and confirm that the earliest consent event sets all four parameters, with the "On-page Default" column showing Denied. Accept the banner and check that the latest consent event shows "On-page Update" as Granted. The Tags tab shows which tags fired and which were blocked by consent. Then repeat the test with "reject".
Read the status in Google Ads and GA4. In Google Ads, go to Goals › Conversions › Summary, open a website conversion action and select the Diagnostics tab. "Consent mode is implemented" means the setup is detected but thresholds aren't met. "Consent mode is implemented and modeling is active" means modelling is running. The status can take 48 hours to appear, occasionally up to two weeks. In GA4, Admin › Data collection and modification › Consent settings shows whether ads measurement and personalisation signals are arriving. Alerts there can take 48 to 72 hours to clear after a fix.

A quick formula helps you size the gap. If c is your consent rate and k is how much more likely consenting users are to convert, the share of real conversions you observe without modelling is roughly c × k ÷ (c × k + (1 − c)). Worked example with c = 50% and k = 2: 1 ÷ 1.5 ≈ 67%. A third of your conversions never reach the account, and that third is exactly what Smart Bidding can't learn from. Treat this as an estimate, not a substitute for the uplift data in Diagnostics.

Implementation mistakes that keep showing up

The most common one is a late default: the GA4 tag fires on page load and the CMP only sets the default afterwards. Almost as frequent is a missing ad_personalization signal in setups that date back to v1. Third, the CMP sends its update only on the next page, so the landing pageview carrying the GCLID is lost. Fourth, Consent Mode runs on the main domain while checkout or booking lives on another; Google notes that advertisers with multiple domains need Consent Mode across all of them. Fifth, url_passthrough is never switched on. With it, the Google tag passes ad-click and session information through URL parameters when cookies are denied, provided the link points to the same domain.

Enhanced conversions and server-side: what sits on top of Consent Mode

Enhanced conversions send hashed first-party data such as email addresses, using SHA-256, alongside the conversion. That sharpens attribution, but it depends on ad_user_data. Without that consent, no user-provided data flows. Enhanced conversions don't increase the number of measurable users. They increase accuracy within the consenting group.

Server-side tagging doesn't bypass consent either. Google explains that you only configure Consent Mode in the web container, because the signals travel with the request to the server container, and that Google's tags in the server container are consent-aware. For Google Ads conversions and Floodlight you also need the Conversion Linker tag in the server container, and if you use region-specific defaults, the tagging server must support them too. For third-party tags in the server container, the consent logic is your responsibility.

Put together: Consent Mode keeps refusals from becoming a blind spot, enhanced conversions make consenting users more precise, and server-side gives you control over data quality. Only the combination gives you a measurement system you can steer budget on with confidence. If you want to set that up end to end, take a look at our Tracking & Analytics service, and see Performance Marketing for how cleaner data turns into better bidding.

FAQ

Do I need Consent Mode v2 if I only advertise outside the EEA?

Google's Tag Manager help states that no action is needed if you don't advertise in the EEA. The EU user consent policy covers end users in the EEA, the UK and Switzerland. As soon as you use remarketing, personalisation or ads measurement for those users, you need the signals.

How long until modelled conversions show up?

Training starts only once the thresholds are met. Google describes training periods followed by gradual improvement, and the Diagnostics status can lag by up to two weeks. Once modelling starts, Diagnostics shows uplift by domain and country for four weeks.

Is a certified CMP plug-in enough?

It handles signal delivery, not quality assurance. Google says certified CMP partners update to the latest Consent Mode version automatically. You still need to test command order, regions, follow-up pages and secondary domains in Tag Assistant.

Sources

Want more of the attention you get to turn into customers? Let’s spend 15 minutes on your setup, free and without a pitch deck. Book your free call

Google Consent Mode v2 Implementation Guide: Limit Data Loss in Ads and Analytics