Google Consent Mode v2: basic vs advanced

Google Consent Mode is an API that tells Google tags (Google Analytics 4, Google Ads, Floodlight and the tags in Google Tag Manager) what each visitor agreed to in your cookie banner, so the tags store and send only what that choice allows. Version 2 added two signals about advertising, and Google has required it since March 2024 for advertisers who want to keep measurement, remarketing and personalised ads for visitors in the European Economic Area. This guide explains the signals, basic versus advanced mode, what each changes in GA4 and Google Ads, and how to set it up and check it. It is part of our guide to cookie consent and what the law requires.

Watch out

This guide explains Google's documented behaviour and the legal debate around it in plain language, current as of September 2026. It is not legal advice. Whether advanced mode's cookieless pings are acceptable before consent depends on your country's regulator and your setup; decide that with a lawyer or your data protection officer.

Quick answer

Consent Mode is not a banner. It carries the answer your banner or consent platform collected to Google's tags. You still need the banner, and you still need to block non-Google trackers yourself.
Four signals matter: ad_storage, analytics_storage, and the two added in v2, ad_user_data and ad_personalization.
Basic mode: Google tags do not load until the visitor chooses. Nothing reaches Google before consent, and nothing at all after a refusal.
Advanced mode: tags load at once with every signal denied. Without consent they set no cookies but send cookieless pings that Google uses to model conversions and behaviour.
Who needs it: anyone using Google Ads or GA4 audiences with EEA or UK visitors. Without v2 signals, those visitors drop out of remarketing and personalised ads.
Set defaults before any Google tag, update them from the banner, and check the result with the free cookie scanner and Tag Assistant.

Without Consent Mode, a cookie banner and a Google tag have only two ways to work together: the tag runs, or it is blocked. Consent Mode adds a third, a tag that runs but behaves according to the visitor's choice. The banner (or consent management platform) sets consent states with gtag('consent', …) commands, and every Google tag reads them before it stores a cookie or sends data.

The first version, launched in 2020, had two main signals. Version 2 arrived in late 2023, ahead of the EU's Digital Markets Act, which requires Google as a designated "gatekeeper" to have consent before using personal data for ad services. Google made the new signals a condition for EEA traffic in March 2024.

Signal	Controls	Added
`ad_storage`	Cookies and identifiers for advertising, such as `_gcl_au`	v1
`analytics_storage`	Cookies for analytics, such as `_ga`	v1
`ad_user_data`	Whether user data may be sent to Google for advertising	v2
`ad_personalization`	Whether data may be used for personalised ads and remarketing	v2
`functionality_storage`, `personalization_storage`, `security_storage`	Other storage categories; Google tags do not change behaviour on them	v1

The first two are about storage in the browser. The v2 signals are about what Google may do with data it receives, which is why a visitor can, in principle, allow advertising cookies but refuse personalisation.

Google documents two implementations. The difference is what happens before the visitor answers and after a refusal.

	Basic mode	Advanced mode
Google tags before a choice	Not loaded	Loaded, all signals `denied`
Cookies before consent	None	None
Data sent before consent	Nothing	Cookieless pings (no identifiers)
After "Reject"	Nothing sent	Cookieless pings continue
After "Accept"	Tags load with signals `granted`	Signals updated to `granted`, cookies set
Google Ads conversion modeling	General model, not specific to your account	Advertiser-specific modeling
GA4 behavioural modeling	Not available	Available when thresholds are met
Privacy exposure	Lowest	Some requests reach Google without consent

What a cookieless ping contains

In advanced mode with consent denied, Google's documentation says tags send pings without cookies, carrying information such as the consent state, a timestamp, the user agent, the referrer and whether the page view or conversion happened, but no client ID from a cookie. Google uses the pings to estimate what it cannot measure directly.

Which mode should you choose?

Basic if your priority is the lowest legal exposure, your regulator is strict about any request before consent, or modeled data would not change your decisions. It is also the easier mode to explain to a visitor: nothing goes to Google until they say yes.
Advanced if you rely on Google Ads bidding and conversion numbers for EEA traffic and your legal advice accepts cookieless pings before consent.

The European Data Protection Board's Guidelines 2/2023 read Article 5(3) of the ePrivacy Directive as covering more than cookies, including information a script collects from the device and sends, which is why some lawyers treat advanced-mode pings cautiously. There is no single EU-wide ruling on Consent Mode itself as of September 2026.

With consent granted, GA4 works as usual. With analytics_storage denied:

No _ga cookie is set, so each ping cannot be tied to a returning visitor.
In advanced mode, behavioural modeling can fill the gap. GA4 uses the consented visitors' behaviour to estimate the unconsented ones and blends the result into reports that use the "Blended" reporting identity.
Modeling has thresholds. Google's GA4 help centre lists, among other conditions, at least 1,000 events a day with analytics_storage denied for at least 7 days, and at least 1,000 daily users with it granted on at least 7 of the previous 28 days. Many small sites never reach them, and then denied visits simply are not reported.
In basic mode, refused visitors are not measured at all.

Expect GA4 user counts to drop when you implement consent properly, whatever the mode. That drop is the real share of visitors who say no, not a fault in Consent Mode.

Conversions: with ad_storage denied, conversions cannot be attributed through cookies. Google Ads models them, with advertiser-specific models in advanced mode and a general model in basic mode.
Remarketing and audiences: visitors with ad_personalization denied are not added to remarketing lists. Without any v2 signals for EEA traffic, Google treats those visitors as not consented for these features.
User data: ad_user_data denied stops user-provided data, such as enhanced conversions, being used for advertising for that visitor.

Two optional settings refine what is sent when advertising consent is refused. ads_data_redaction: true removes ad click identifiers from pings when ad_storage is denied. url_passthrough: true passes click identifiers such as gclid through internal links in the URL instead of a cookie, so conversions can still be measured without storing anything.

Google's EU user consent policy covers visitors in the EEA, the UK and Switzerland. Publishers using AdSense, Ad Manager or AdMob with visitors there must additionally use a Google-certified consent management platform.

There are three common ways, from least to most hands-on.

Most consent management platforms, including WordPress consent plugins, have a "Google Consent Mode v2" switch. Turn it on, choose basic or advanced if the platform offers both, and map your banner's categories to the signals: statistics to analytics_storage, marketing to ad_storage, ad_user_data and ad_personalization. Then check that the platform's script loads before any Google tag. Our guide to choosing a WordPress cookie consent plugin covers the WordPress side.

2. In Google Tag Manager

Use your consent platform's template from the Tag Manager Community Template Gallery, fired on the Consent Initialization – All Pages trigger, so defaults are set before any other tag. Turn on consent overview in the container settings to see which consent each tag checks. Google tags check their own consent built-in; other tags (a Meta Pixel, Hotjar) need "additional consent checks" or triggers tied to the banner, because they do not read Consent Mode.

3. Directly with gtag.js

Put the defaults in <head>, before gtag.js or the Tag Manager snippet, and call an update from your banner:

HTML

<!-- In <head>, before any Google tag -->
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){ dataLayer.push(arguments); }
  gtag('consent', 'default', {
    ad_storage: 'denied',
    ad_user_data: 'denied',
    ad_personalization: 'denied',
    analytics_storage: 'denied',
    wait_for_update: 500
  });
  gtag('set', 'ads_data_redaction', true);
</script>

JavaScript

// In your banner's accept handler
gtag('consent', 'update', {
  ad_storage: 'granted',
  ad_user_data: 'granted',
  ad_personalization: 'granted',
  analytics_storage: 'granted'
});

wait_for_update gives an asynchronously loading banner that many milliseconds to send its update before tags fire. The defaults above are advanced mode. For basic mode, keep the same defaults but do not load gtag.js or the container until the visitor has answered. Our guide to GA4 and Tag Manager: the cost and the consent shows these snippets in the context of loading order and page speed.

A default command can also take a region list, such as region: ['AT', 'BE', 'DE'], to apply denied defaults only to visitors in those countries. If you use it, be sure your list covers every country whose law requires prior consent, including the UK and Switzerland.

Scan the first visit. The free cookie scanner loads your page in a fresh browser from Frankfurt, records every cookie and tracker before and after it clicks Accept, and notes whether Consent Mode is present.

getReport detects Consent Mode when the page calls gtag('consent', …) or pushes a consent entry to the data layer. It cannot tell basic from advanced or read your default values, so confirm those with the next steps. When Consent Mode is present and no Google cookie is set before the click, Google's cookieless requests are not counted as trackers before consent.

Open the network panel in a private window, filter for collect, and look at the gcs parameter on GA4 requests. G100 means both storage signals denied, G111 both granted; the newer gcd parameter encodes all four signals. Before you click anything, you should see denied states and no _ga cookie in Application → Cookies.
Use Tag Assistant (tagassistant.google.com) to preview the page. Its Consent tab shows the default and update states and when each was set.
Check Google's own status. GA4's admin shows whether consent signals are being received for EEA traffic, and Google Ads shows consent mode status in its conversion diagnostics.

The report shows the related findings:

Common mistakes

Defaults set after the tags. If gtag.js or the container runs before gtag('consent', 'default', …), the first hit goes out with no consent state. Defaults go first.
Defaults set to granted. Then Consent Mode records consent the visitor never gave.
Only the v1 signals. Without ad_user_data and ad_personalization, EEA visitors are treated as not consented for ad personalisation.
Assuming Consent Mode blocks other trackers. A Meta Pixel, LinkedIn Insight or a session recorder ignores it; block those through the consent platform.
Categories mapped wrong. A banner "statistics" switch that also grants ad_storage gives advertising consent nobody gave.
Advanced mode chosen by default in a plugin without anyone deciding it. Make that choice deliberately.

Questions people ask

Not for Google's policy. The v2 requirement comes from Google's EU user consent policy, which covers visitors in the EEA, the UK and Switzerland. If none of your traffic comes from there and you do not use Google's advertising features for such visitors, nothing changes. US state laws use an opt-out model, which Consent Mode can support but does not require.

No. With the defaults set to denied, Google tags in advanced mode do not write analytics or advertising cookies. They do send cookieless pings to Google with the consent state, the page and technical details, which Google uses for modeling. Whether sending those pings before consent is acceptable is a legal question some EU regulators view critically, so take advice before choosing advanced mode.

Because visitors who refuse consent are no longer measured with cookies. In basic mode they are not measured at all; in advanced mode GA4 can estimate them through behavioural modeling, but only once your property meets Google's thresholds, such as 1,000 daily events with analytics consent denied for at least 7 days. The lower number is the honest one; the old number counted people who never agreed.

For EEA, UK and Swiss visitors, Google treats missing v2 signals as no consent for ad personalisation and user data. Those visitors are left out of remarketing lists and audiences, and conversions from them are measured less completely because no modeling is based on their pings. Visitors elsewhere are not affected. Adding v2 signals through your consent platform restores modeled conversions for refused visitors.

Yes, technically. You can write your own banner and call gtag('consent', 'update', …) when the visitor chooses, as long as the defaults are set before any Google tag loads. You then also have to record consent, offer a way to change it, and block non-Google trackers yourself. Publishers using AdSense or Ad Manager in the EEA, UK or Switzerland must use a Google-certified platform.

Google Consent Mode v2: basic vs advanced, and what it changes in GA4 and Ads