# Google Consent Mode v2: set it up correctly

> Consent Mode v2 tells Google tags what the visitor allowed: defaults denied before the tag loads, an update on each choice, ad_user_data and ad_personalization.

Source: https://cookiequiet.com/guides/google-consent-mode-v2
Published: 2026-10-20
Publisher: Cookiequiet

## Steps

1. **Load the banner script first** Place the consent script as the first script in the head, with the attribute that enables Consent Mode, so the default of denied is set before any Google tag runs.
2. **Keep the Google tag after it** Leave gtag.js or the Google Tag Manager container where it is, as long as it comes after the banner script. For basic mode, mark the Google tag so it only loads after analytics consent.
3. **Map your categories** Marketing must drive ad_storage, ad_user_data and ad_personalization; analytics must drive analytics_storage; functional drives functionality_storage and personalization_storage.
4. **Send updates on every change** Make sure an update is sent when the visitor accepts, rejects, customizes, or withdraws later, and that the stored choice is applied on the next page load.
5. **Wire non-Google tags** In Tag Manager, trigger Meta, LinkedIn or TikTok tags on the dataLayer event that carries the category flags, not on page view.
6. **Verify in a private window** Inspect the dataLayer before any click, after Reject all and after Accept all. Confirm that no analytics or advertising cookie is set after a refusal.

Google Consent Mode is a signal, not a banner. It is a set of flags that your consent banner passes to Google tags (Google Analytics 4, Google Ads, Floodlight) so that each tag adapts what it stores and sends. To set it up correctly you need three things in this order: a default state of "denied" declared before any Google tag runs, an update sent whenever the visitor makes or changes a choice, and the two parameters that version 2 added, `ad_user_data` and `ad_personalization`, mapped to your marketing category.

## What the signals mean

Google's documentation defines seven consent types:

| Consent type | What Google says it controls |
|---|---|
| `ad_storage` | Storage, such as cookies, related to advertising |
| `ad_user_data` | Sending user data to Google for online advertising purposes |
| `ad_personalization` | Personalized advertising |
| `analytics_storage` | Storage related to analytics, for example visit duration |
| `functionality_storage` | Storage that supports the functionality of the site, for example language settings |
| `personalization_storage` | Storage related to personalization, for example video recommendations |
| `security_storage` | Storage related to security, such as authentication and fraud prevention |

Version 2, announced for traffic in the European Economic Area, added `ad_user_data` and `ad_personalization`. Google's help page for EEA traffic says advertisers must adhere to the EU user consent policy to use ad personalization and measurement with tags that send data to Google, and must share the consent signals. Since March 2024, Customer Match lists used in the EEA require both fields set to granted; data from unconsented EEA users is not processed. The background and the consequences are in [our article on the March 2024 change](/blog/consent-mode-v2-deadline-what-changed).

## Basic or advanced?

Google describes two ways to implement consent mode.

- **Basic.** Google tags are blocked until the visitor interacts with the banner. If they refuse, no data is sent to Google at all, not even the consent state. Google Analytics then has no "cookieless pings" to model from, so you get no modeled data for the visitors who refused.
- **Advanced.** Google tags load on page open with consent defaulted to denied. While consent is denied, the tags send measurements without cookies; when the visitor consents, they send full data. Google uses the cookieless pings for conversion and behavioral modeling.

Advanced mode is the one Google's pages recommend for modeling, and it is the one most consent tools wire up. Whether a cookieless ping is acceptable to your supervisory authority is a legal question, not a technical one: the ping still sends a request to Google from the visitor's browser. If you want the conservative setup, use basic mode by marking the Google tag so that it only loads after analytics consent, as described in [the script blocking guide](/guides/block-scripts-until-consent). Consent mode is not a replacement for consent either way; Google's own documentation says you are responsible for obtaining users' consent.

## The order matters

Google's guide says it plainly: "The order of the code here is vital. If your consent code is called out of order, consent defaults won't work." The default command must run on every page before any `config` or `event` command. A typical hand-written default looks like this:

```html
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('consent', 'default', {
    'ad_storage': 'denied',
    'ad_user_data': 'denied',
    'ad_personalization': 'denied',
    'analytics_storage': 'denied',
    'functionality_storage': 'denied',
    'personalization_storage': 'denied',
    'security_storage': 'granted',
    'wait_for_update': 500
  });
</script>
```

`wait_for_update` gives an asynchronously loaded banner a few hundred milliseconds to report a stored choice before the tags fire. Google also supports a `region` parameter so that defaults apply only to visitors from listed countries or states, and two optional settings: `ads_data_redaction` removes ad click identifiers from Google Ads requests when `ad_storage` is denied, and `url_passthrough` carries click information in URL parameters across pages when cookies are denied.

When the visitor chooses, send an update, and send it again every time the choice changes, including from granted to denied:

```js
gtag('consent', 'update', {
  'ad_storage': 'granted',
  'ad_user_data': 'granted',
  'ad_personalization': 'granted',
  'analytics_storage': 'granted'
});
```

Persist the choice (in a first-party cookie) so that the next page sets the right state immediately.

## How Cookiequiet sends the signals

Add `data-consent-mode="1"` to the Cookiequiet snippet and load it before the Google tag:

```html
<script src="https://cookiequiet.com/cq.js" data-site="KEY" data-consent-mode="1" defer></script>
```

The Google tag or the Tag Manager container goes below it.

On load, the script pushes a default with every type denied except `security_storage`, with `wait_for_update` at 500 ms, before it fetches anything from the network. If the visitor already has a stored choice, the update is pushed at once. On every choice the mapping is: marketing drives `ad_storage`, `ad_user_data` and `ad_personalization`; analytics drives `analytics_storage`; functional drives `functionality_storage` and `personalization_storage`. The script also pushes a `cq_consent` event to the dataLayer with `cq_functional`, `cq_analytics` and `cq_marketing` booleans, which you can use as a Google Tag Manager trigger for non-Google tags; the [Tag Manager guide](/platforms/google-tag-manager) shows the trigger setup. Microsoft UET consent is sent the same way when enabled.

One limit to know: Cookiequiet is not a Google-certified consent management platform for the IAB Transparency and Consent Framework, so websites that show Google AdSense, Ad Manager or AdMob ads to visitors in the EEA, the UK or Switzerland need a certified CMP for those ads. Google Analytics 4, Google Ads conversion tracking and remarketing work with the Consent Mode integration described here.

## Checking that it works

Open your site in a private window with the developer tools. Before clicking anything, inspect `window.dataLayer`: the first entries should be the consent default. Click Reject all and check that an update with every advertising type denied was pushed and that no `_ga` cookie appeared. Click Accept all and check the reverse. Google's Tag Assistant shows the consent state per tag as well. If the default appears after a `config` command, move the Cookiequiet script higher in the head.

## Questions

### Is Consent Mode a cookie banner?

No. Google's documentation says consent mode does not provide a consent banner or widget. It takes the visitor's choice from your banner and adjusts how Google tags behave. You still need a banner that collects valid consent.

### Does Consent Mode make Google Analytics legal without consent?

No. It changes what the tags store and send when consent is denied, and Google says you remain responsible for obtaining consent. Whether cookieless pings are acceptable without consent depends on your supervisory authority's reading of the ePrivacy rules.

### Do I need advanced mode?

Only if you want Google's modeled conversions and behavioral data for visitors who refuse. Basic mode, where the Google tag does not load until consent, is simpler to explain and sends nothing to Google for those visitors.

### What about Microsoft Advertising?

Microsoft UET has its own consent signal (ad_storage granted or denied, pushed to the uetq queue). Cookiequiet sends it from the marketing category when the option is enabled.

## Sources

- [Google, Set up consent mode on websites (Tag Platform documentation)](https://developers.google.com/tag-platform/security/guides/consent)
- [Google, Consent mode concepts: consent types, basic and advanced implementation](https://developers.google.com/tag-platform/security/concepts/consent-mode)
- [Google Ads Help, Updates to consent mode for traffic in European Economic Area (EEA)](https://support.google.com/google-ads/answer/13695607)
- [Google Analytics Help, Consent mode in Google Analytics](https://support.google.com/analytics/answer/9976101)
- [Google Ads Help, How to provide consent for Customer Match](https://support.google.com/google-ads/answer/14546648)