Consent Mode v2: what changed in March 2024 and what happens without it

In March 2024 Google started enforcing a requirement it had announced a few months earlier: advertisers who want to keep using measurement, ad personalization and remarketing for users in the European Economic Area must collect consent and pass it to Google through Consent Mode, including two new signals, ad_user_data and ad_personalization. Without those signals, Google treats EEA users as not consented: their data is not processed for Customer Match, audiences shrink, and conversion measurement loses the modeled part. The deadline did not create a new law. It made Google's platforms enforce the consent that European law already required.

What Google's policy always required

Google's EU user consent policy, which every Google Ads and Analytics customer agrees to, requires sites to obtain legally valid consent from end users in the EEA, the UK and Switzerland for the use of cookies or other local storage where legally required, and for the collection, sharing and use of personal data for personalization of ads. It also requires keeping records of consent and giving users clear instructions for withdrawing it. The policy predates Consent Mode; what changed in 2024 is that Google began checking for the consent signal in its own systems instead of relying on the advertiser's word.

What version 2 added

Consent Mode version 1 had four storage signals: ad_storage, analytics_storage, functionality_storage and personalization_storage (plus security_storage). Version 2 added two signals about data use rather than storage:

• ad_user_data: "Sets consent for sending user data to Google for online advertising purposes."
• ad_personalization: "Sets consent for personalized advertising."

The distinction matters because a visitor can allow cookies and still refuse personalization, and because Google's advertising products now read these two signals to decide whether a user's data may be used at all. Google's help page on consent for Customer Match says it plainly: starting in March 2024, both fields must be set to granted for Customer Match lists used in the EEA, and data from unconsented EEA users is not processed and cannot be used for ad personalization. The same page notes that the enforcement in 2024 also affects measurement features for data from tags on websites and SDKs in apps.

If you set both ad_personalization and the older allow_ad_personalization_signals with conflicting values, personalization is disabled; Google recommends implementing ad_personalization.

Basic or advanced, and what each loses

Google documents two implementations.

In basic consent mode, Google tags do not load until the visitor interacts with the banner. A visitor who refuses sends nothing to Google, not even the consent state. Google Analytics then has nothing to model from, so reports for refusing visitors are simply absent.

In advanced consent mode, Google tags load on page open with every signal defaulted to denied. While consent is denied, the tags send measurements without cookies ("cookieless pings") carrying the consent state and coarse information; after consent, full measurement. Google uses the pings for conversion and behavioral modeling, which requires meeting a data threshold.

Google's pages describe advanced mode as the way to get modeled data. They also say, in the consent mode concepts documentation, that you are responsible for obtaining users' consent, and that consent mode does not provide a banner or widget. The advanced-mode ping is a request from the visitor's browser to Google; whether sending it before consent is acceptable is for your supervisory authority to say, and positions differ. The conservative path is basic mode. Both are set up the same way; the difference is whether the Google tag is marked to wait for analytics consent.

What happens without Consent Mode

Google's help page on the EEA updates describes the failure mode of a half-measure: if you block the Google tag until the visitor interacts with the banner but never send consent signals, Google cannot verify the choices, "which may lead to loss in data". Concretely:

• Customer Match lists for EEA users are not populated from unconsented data.
• Remarketing audiences built from site visits lose EEA users whose consent is not signalled.
• Conversion measurement for EEA traffic has no modeled component and is reported only for consented visitors.
• Google Analytics 4 shows no modeled data for refusing visitors in basic mode or without consent mode.

None of these is a legal penalty. They are Google declining to process data it cannot show was consented to, which is Google protecting Google. The legal exposure is separate and sits with the site: the fines for cookies placed before consent are described in our fines round-up.

Certified CMPs and the TCF are a different requirement

Two Google requirements are often confused. Consent Mode is the signal described above, and any banner can send it. Separately, for publishers who show Google AdSense, Ad Manager or AdMob ads to users in the EEA, the UK or Switzerland, Google requires a consent management platform certified for the IAB Transparency and Consent Framework. Cookiequiet sends Consent Mode v2 signals and is not a certified TCF CMP, so websites that show those ads need a certified CMP for them; Google Analytics 4, Google Ads conversion tracking and remarketing work with its integration. If you use a certified CMP, Google says the CMP provider updates to the newest version of consent mode automatically; if you built the integration yourself, check that the two version 2 signals are present.

How to check your own setup

Open your site in a private window with the developer tools and inspect window.dataLayer before clicking anything: the first consent entry should be a default with ad_storage, ad_user_data, ad_personalization and analytics_storage set to denied. Click Accept all and look for an update that sets them to granted; click Reject all on a fresh profile and confirm no _ga or _gcl cookie appears. Google's Tag Assistant shows the consent state each tag received. If the default appears after a config call, the order is wrong, and Google's documentation is explicit that out-of-order defaults do not work. The Consent Mode guide walks through the setup with a banner; the Google Ads platform page covers conversion tags specifically.

With Cookiequiet, data-consent-mode="1" on the snippet sets every signal to denied before any Google tag runs, with a 500 ms wait_for_update, and updates all seven signals on each choice: marketing drives the three advertising signals, analytics drives analytics_storage, functional drives functionality and personalization storage. A cq_consent dataLayer event carries the category flags for Tag Manager triggers.