How to set up Google Consent Mode v2

What it is, and why it matters

Google Consent Mode v2 is Google's mechanism for letting its own tags — gtag.js, Google Tag Manager, Google Ads, GA4 — adjust their own behavior based on a visitor's consent state, instead of you having to physically block or unblock each tag yourself. Instead of "script blocked / script allowed," Google's tags receive a structured signal (granted or denied for each of seven storage/usage purposes) and decide for themselves how to behave: fire normally, fire in a cookieless/modeled form, or not fire at all.

It matters for two independent reasons. First, compliance: as of Consent Mode v2, Google requires sites serving EEA/UK traffic to have it in place to keep using Google Ads personalization and to remain eligible for conversion modeling — sites without it lose access to certain Google Ads and Analytics features for European traffic. Second, data quality: because Consent Mode still lets Google tags fire in a privacy-safe, denied-consent mode (pings without cookies, modeled conversions) rather than not firing at all, you keep usable Google Ads/GA4 data even from visitors who decline, instead of a hole in your funnel.

Cookie Munch implements Consent Mode v2 natively inside the banner engine — there is no separate GTM template to install and no manual gtag('consent', ...) calls to write. The banner pushes the signals itself, synchronously, before any vendor script has a chance to load.

How to enable it

1. Open the site in Studio (Dashboard → your site → Studio) and open the Settings drawer.

2. Go to the Consent tab. Consent Mode sits in its own section alongside IAB TCF and US State Privacy — this tab is where every third-party signaling framework is turned on.

3. Toggle Enable Consent Mode. Enabling it for the first time seeds two more fields:

   • Mode — a Basic / Advanced switch.

   • Wait for update — a slider from 0 to 3000 ms.

4. Publish the change from Studio the way you publish any other banner edit.

There is no GTM container ID field to fill in and nothing to configure inside Google Tag Manager itself: if you use gtag.js directly, Cookie Munch calls it; if you use GTM, Cookie Munch pushes the same consent commands onto window.dataLayer, which GTM already listens to.

Basic vs. Advanced

• Basic — each of the seven signals is simply granted or denied based on the visitor's choice. Google tags either run at full capability or don't run with any ad-related storage/usage.

• Advanced — in addition to the same signal set, the default (pre-consent) block also sets ads_data_redaction: true and url_passthrough: true. These tell Google Ads to redact ad-click data and preserve click IDs in the URL until consent arrives, which is what enables conversion modeling for visitors who haven't decided yet or who decline — instead of losing that traffic from your reporting entirely. Advanced is the default for new sites and is what most sites running Google Ads should use; Basic is for sites that want the plainest possible block/allow behavior with no additional data sharing before consent.

Wait for update

This slider controls how long gtag.js holds tag firing while waiting for the consent decision to arrive — it does not change what the default state is. If the visitor hasn't decided by the time the window elapses, tags fire with consent still denied (except security_storage), and an update signal is sent the moment a real decision is made. 0 means gtag doesn't wait at all; values up to 3000 ms give slow-loading banners more time to hydrate a stored decision first.

What it does technically

Before any vendor or Google script is allowed to load, the embed calls gtag('consent', 'default', {...}) (or the equivalent dataLayer.push) with every signal denied except security_storage, which Consent Mode itself treats as always necessary and never gates:

This mapping is not something you configure separately per framework — it's derived from the same three visitor-controlled categories (Marketing / Statistics / Preferences) that drive every other signaling framework Cookie Munch supports. If the site also runs IAB TCF and the visitor grants TCF purposes 2, 3, 4, or 7 (ad selection, delivery, and measurement), that sets the Marketing category to true, which in turn grants the Consent Mode ad signals — you don't have to reconcile TCF and Consent Mode by hand.

As soon as the visitor makes a choice (or a previously stored choice is restored on a later visit), the banner fires gtag('consent', 'update', {...}) with the actual per-signal state. Google tags that respect Consent Mode react immediately — for example, switching a GA4 hit from a full client-ID ping to a cookieless conversion-modeled one.

Because the default-denied block must run before any tag fires, this only works correctly if Cookie Munch's script-blocking is active (the default auto mode rewrites third-party <script> tags so nothing executes ahead of the banner). If you switch blocking to manual and mistag your Google scripts, Consent Mode's default block still fires, but you lose the prior-blocking guarantee behind it.

Verifying it's working

1. Browser network/console check. Open your site in an incognito window with dev tools open, filter the Network tab for google-analytics or googletagmanager, and reload before interacting with the banner. You should see requests fire (if any do) with consent parameters reflecting denied state, and window.dataLayer (via the console) should already contain a consent/default entry with every signal denied except security_storage.

2. Interact with the banner and re-check dataLayer — a consent/update entry should appear immediately, matching the categories you accepted.

3. Google's own tooling. Tag Assistant (or GA4 DebugView) will show the consent state Google's tags are actually operating under, which is the authoritative check that Google is honoring the signal, not just that Cookie Munch sent it.

4. Re-visit test. Accept or decline, then reload the page. The stored decision should be restored and the update signal sent again on load without the banner reappearing (unless your consent expiry/version settings force a re-prompt).

See also: IAB TCF v2.2 and Geo-targeting & regional rules for how region and TCF purposes interact with Consent Mode's category mapping.