Google Consent Mode v2: set it up correctly

Google Consent Mode is a signal, not a banner. It is a set of flags that your consent banner passes to Google tags (Google Analytics 4, Google Ads, Floodlight) so that each tag adapts what it stores and sends. To set it up correctly you need three things in this order: a default state of "denied" declared before any Google tag runs, an update sent whenever the visitor makes or changes a choice, and the two parameters that version 2 added, ad_user_data and ad_personalization, mapped to your marketing category.

What the signals mean

Google's documentation defines seven consent types:

Version 2, announced for traffic in the European Economic Area, added ad_user_data and ad_personalization. Google's help page for EEA traffic says advertisers must adhere to the EU user consent policy to use ad personalization and measurement with tags that send data to Google, and must share the consent signals. Since March 2024, Customer Match lists used in the EEA require both fields set to granted; data from unconsented EEA users is not processed. The background and the consequences are in our article on the March 2024 change.

Basic or advanced?

Google describes two ways to implement consent mode.

• Basic. Google tags are blocked until the visitor interacts with the banner. If they refuse, no data is sent to Google at all, not even the consent state. Google Analytics then has no "cookieless pings" to model from, so you get no modeled data for the visitors who refused.
• Advanced. Google tags load on page open with consent defaulted to denied. While consent is denied, the tags send measurements without cookies; when the visitor consents, they send full data. Google uses the cookieless pings for conversion and behavioral modeling.

Advanced mode is the one Google's pages recommend for modeling, and it is the one most consent tools wire up. Whether a cookieless ping is acceptable to your supervisory authority is a legal question, not a technical one: the ping still sends a request to Google from the visitor's browser. If you want the conservative setup, use basic mode by marking the Google tag so that it only loads after analytics consent, as described in the script blocking guide. Consent mode is not a replacement for consent either way; Google's own documentation says you are responsible for obtaining users' consent.

The order matters

Google's guide says it plainly: "The order of the code here is vital. If your consent code is called out of order, consent defaults won't work." The default command must run on every page before any config or event command. A typical hand-written default looks like this:

html
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('consent', 'default', {
    'ad_storage': 'denied',
    'ad_user_data': 'denied',
    'ad_personalization': 'denied',
    'analytics_storage': 'denied',
    'functionality_storage': 'denied',
    'personalization_storage': 'denied',
    'security_storage': 'granted',
    'wait_for_update': 500
  });
</script>

wait_for_update gives an asynchronously loaded banner a few hundred milliseconds to report a stored choice before the tags fire. Google also supports a region parameter so that defaults apply only to visitors from listed countries or states, and two optional settings: ads_data_redaction removes ad click identifiers from Google Ads requests when ad_storage is denied, and url_passthrough carries click information in URL parameters across pages when cookies are denied.

When the visitor chooses, send an update, and send it again every time the choice changes, including from granted to denied:

js
gtag('consent', 'update', {
  'ad_storage': 'granted',
  'ad_user_data': 'granted',
  'ad_personalization': 'granted',
  'analytics_storage': 'granted'
});

Persist the choice (in a first-party cookie) so that the next page sets the right state immediately.

How Cookiequiet sends the signals

Add data-consent-mode="1" to the Cookiequiet snippet and load it before the Google tag:

html
<script src="https://cookiequiet.com/cq.js" data-site="KEY" data-consent-mode="1" defer></script>

The Google tag or the Tag Manager container goes below it.

On load, the script pushes a default with every type denied except security_storage, with wait_for_update at 500 ms, before it fetches anything from the network. If the visitor already has a stored choice, the update is pushed at once. On every choice the mapping is: marketing drives ad_storage, ad_user_data and ad_personalization; analytics drives analytics_storage; functional drives functionality_storage and personalization_storage. The script also pushes a cq_consent event to the dataLayer with cq_functional, cq_analytics and cq_marketing booleans, which you can use as a Google Tag Manager trigger for non-Google tags; the Tag Manager guide shows the trigger setup. Microsoft UET consent is sent the same way when enabled.

One limit to know: Cookiequiet is not a Google-certified consent management platform for the IAB Transparency and Consent Framework, so websites that show Google AdSense, Ad Manager or AdMob ads to visitors in the EEA, the UK or Switzerland need a certified CMP for those ads. Google Analytics 4, Google Ads conversion tracking and remarketing work with the Consent Mode integration described here.

Checking that it works

Open your site in a private window with the developer tools. Before clicking anything, inspect window.dataLayer: the first entries should be the consent default. Click Reject all and check that an update with every advertising type denied was pushed and that no _ga cookie appeared. Click Accept all and check the reverse. Google's Tag Assistant shows the consent state per tag as well. If the default appears after a config command, move the Cookiequiet script higher in the head.