Features

Google Consent Mode V2: Complete Setup Guide for 2026

·8 min read

Since March 2024, Google requires Consent Mode V2 for any website running Google Ads or Analytics in the European Economic Area. Without it, your remarketing audiences shrink, conversion data becomes unreliable, and your ad campaigns lose effectiveness. Here's how to set it up correctly.

What Is Google Consent Mode V2?

Consent Mode is a Google API that adjusts how Google tags (Analytics, Ads, Floodlight) behave based on user consent. When a user declines cookies, instead of losing all data, Consent Mode sends "consent pings" — cookieless signals that Google uses for conversion modeling.

V2 introduces two new required parameters:

  • ad_user_data: Controls whether user data can be sent to Google for advertising
  • ad_personalization: Controls whether personalized advertising is allowed

Combined with the existing V1 parameters:

  • analytics_storage: Controls Google Analytics cookies
  • ad_storage: Controls Google Ads cookies

Why It Matters

Without Consent ModeWith Consent Mode V2
No data from users who decline cookiesModeled conversions from cookieless pings
Remarketing audiences shrink 30-70%Audience recovery through modeling
Conversion data gaps in EU marketsUp to 70% conversion recovery via modeling
Risk of losing Google Ads featuresFull access to all Google Ads features

Implementation Methods

Method 1: Google Tag Manager (Recommended)

  1. Enable Consent Overview: In GTM, go to Admin → Container Settings → enable "Enable consent overview"
  2. Set default consent state: Add a Consent Initialization tag that sets all four parameters to "denied" by default for EEA visitors
  3. Connect your CMP: Your Consent Management Platform should fire an update command when the user grants consent
  4. Verify with Tag Assistant: Check that consent states change correctly when users accept or reject

Method 2: Manual Implementation (gtag.js)

<!-- Set defaults BEFORE loading gtag.js -->
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}

// Default: deny everything for EEA
gtag('consent', 'default', {
  'ad_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied',
  'analytics_storage': 'denied',
  'wait_for_update': 500   // ms to wait for CMP
});
</script>

<!-- Load gtag.js AFTER consent defaults -->
<script async src="https://www.googletagmanager.com/gtag/js?id=GA-XXXXX"></script>

<!-- When user consents, update: -->
<script>
gtag('consent', 'update', {
  'ad_storage': 'granted',
  'ad_user_data': 'granted',
  'ad_personalization': 'granted',
  'analytics_storage': 'granted'
});
</script>

CMP Integration

Your consent banner must communicate with Consent Mode. Most major CMPs support this natively:

CMPV2 SupportSetup
CookiebotNativeAutomatic when GTM template is used
OneTrustNativeEnable in cookie compliance settings
IubendaNativeAutomatic with TC string support
DidomiNativeBuilt-in Google Consent Mode integration
OsanoNativeEnable in platform settings

Testing and Verification

  1. Google Tag Assistant: Check consent state changes in real-time
  2. Chrome DevTools: Monitor Network tab for consent parameters in Google requests
  3. Google Analytics Debug View: Verify events arrive with correct consent status
  4. PrivacyChecker: Scan your site to verify Google tags respect consent state

Common Mistakes

  • Loading gtag.js before setting defaults: The consent default must execute BEFORE the Google tag loads
  • Missing ad_user_data or ad_personalization: V2 requires all four parameters — missing two means V1 only
  • Not setting wait_for_update: Without it, tags may fire before the CMP loads
  • Granting by default for EU users: Violates GDPR — default must be "denied" in EEA
  • Not testing reject flow: Verify that declining cookies actually sets parameters to "denied"

Run a PrivacyChecker scan to verify your Consent Mode V2 implementation and ensure Google tags behave correctly with and without consent.

Check your website now — free

Run a complete privacy audit in under 60 seconds. Get your score, find issues, and learn how to fix them.

Start Free Audit

Related Articles

Features

Cookie Consent Banners: Is a Cookie Banner Mandatory? Complete GDPR Guide

Everything you need to know about cookie consent: is a cookie banner mandatory, what cookies to declare, requirements by country, and common mistakes to avoid.

Features

Dark Patterns: How to Detect and Remove Deceptive UX from Your Site

Dark patterns are now regulated. Learn what counts as deceptive design, how regulators are cracking down, and how to audit your UX for compliance.

Features

SPF, DKIM & DMARC: Fix Your Email Deliverability in 10 Minutes

Gmail and Outlook now require email authentication. Learn how to configure SPF, DKIM, and DMARC records to ensure your emails reach inboxes.

Features

Security Headers Explained: Protect Your Website in 5 Steps

CSP, HSTS, X-Frame-Options, and more — learn what security headers your website needs and how to implement them to prevent attacks.

Regulations

EAA Rules 2025: European Accessibility Act Checklist & Requirements

The EAA is enforceable since June 2025 — fines up to €30,000 and market bans. Free checklist of WCAG 2.1 AA requirements for websites: alt text, color contrast, keyboard navigation, forms, and more. 87 million EU users affected.

Regulations

DORA Compliance Checklist 2026: 14 Steps to Avoid Fines (Free Template)

DORA is enforceable now — fines up to 1% of daily turnover. Use this free 14-step DORA compliance checklist covering ICT risk management, incident reporting (4h deadline), resilience testing, and third-party oversight. Includes DORA vs GDPR vs NIS2 comparison.