What is Google Consent Mode v2?

Google Consent Mode is a framework that lets Google's tags — including Google Ads, Google Analytics 4 and Floodlight — adapt their behaviour to whether a visitor has granted or denied consent. Instead of a binary “fire or don’t fire”, each tag reads a set of consent states and adjusts what it is allowed to read from the browser, write to it, and send to Google.

The model rests on consent signals, each of which is either granted or denied. The original version defined analytics_storage, which governs analytics cookies, and ad_storage, which governs advertising cookies and identifiers. Version 2 adds two more: ad_user_data, which controls whether user data may be sent to Google for advertising at all, and ad_personalization, which controls whether that data may be used for personalised advertising and remarketing.

The distinction between the two new signals matters. A visitor can allow you to send their data to Google for basic conversion measurement while refusing to be added to personalised remarketing audiences, and ad_user_data and ad_personalization let you express exactly that split. Because they are separate from ad_storage, they apply even when no advertising cookie is written.

For advertisers in the European Economic Area, passing these signals is effectively mandatory. Since March 2024 Google has required Consent Mode v2 signals for features that depend on European user data, including remarketing audiences and enhanced conversions. Without them, those audiences stop growing and conversion imports degrade, so the signals are not optional polish — they are the price of measurement in Europe.

Consent Mode works through two commands. Before any tag loads you send gtag('consent', 'default', ...) to declare the starting state — usually everything denied outside regions where you have a lawful basis — and you can scope those defaults by region. The moment a visitor makes a choice you send gtag('consent', 'update', ...) with the new states, and Google's tags react. A wait_for_update value tells tags how long to hold before assuming the default, which avoids a race where a tag fires before the banner is answered.

There are two implementation styles. In basic Consent Mode, tags are blocked entirely until consent is granted, so nothing loads for a visitor who has not answered. In advanced Consent Mode, the tags load immediately in a restricted, cookieless state and send pings, then upgrade to full behaviour if consent arrives. Advanced mode preserves more measurement but requires the tags to load before consent, which is why it must be paired with correct defaults.

When a signal is denied, Google's tags do not simply go silent. They send cookieless pings — requests that carry no identifiers and read or write no cookies — from which Google models the conversions and traffic it can no longer observe directly. You lose the deterministic record but keep a modelled estimate, which is usually far better for reporting than blocking the tag outright and seeing nothing.

All of this only works if the consent states are accurate and arrive at the right instant. A consent platform's real job is translation: turning a visitor's category choices into the four signals, setting sensible defaults before the first tag loads, and pushing an update the moment the choice changes — including when a returning visitor edits their preferences later.

Timing is the part that breaks most home-grown setups. If the default command runs after a Google tag has already initialised, the tag has nothing to wait for and may write a cookie before consent exists. The consent script therefore has to run first, synchronously, ahead of Google Tag Manager and gtag.js, and it must keep its category-to-signal mapping in step with whatever you have configured.

With Cookie Munch, Consent Mode v2 is wired in out of the box. The embed sets the default state before any tag can load, maps your consent categories to all four Google signals, and emits a single update event when a visitor accepts, rejects, or changes their mind. There is no per-tag scripting: statistics maps to analytics_storage, marketing maps to ad_storage, ad_user_data and ad_personalization, and the mapping stays consistent everywhere.

Because the whole thing runs on documented dataLayer and gtag events, you can watch it happen. Google's Tag Assistant and the GA4 DebugView show the default state on the first hit and the update after a choice, so you can confirm the signals are correct rather than assume they are. Regional defaults let you run advanced mode in the EEA and a different posture elsewhere from the same configuration.

The result is measurement that respects consent without throwing away modelled insight, and a setup you can verify rather than take on faith. Drop in the embed, confirm the default and update in your tag debugger, and Consent Mode v2 is handled — correctly, and by default.