Consent Mode tells Google what visitors chose.

What Consent Mode does

Consent Mode is part of the Google tag, whether you load it with gtag.js or Google Tag Manager. Your site gives it a state, granted or denied, for each type of consent. Google’s tags for Analytics, Ads, Floodlight and the Conversion Linker read that state and adjust: with storage denied, for example, they don’t write their cookies.

It doesn’t collect a choice and it doesn’t remember one. Google’s documentation puts the responsibility for getting consent on you, through a banner, your own solution or a consent management platform, and says Consent Mode doesn’t save choices.

Version 2 dates from November 2023, when Google added two signals for advertising to the two that already existed. These are the four that change how Google Analytics and Google Ads behave:

• ad_storage: cookies and similar storage for advertising
• analytics_storage: cookies and similar storage for analytics, such as how long a visit lasts
• ad_user_data: consent to send user data to Google for online advertising
• ad_personalization: consent for personalised advertising, such as remarketing

Set the defaults before the tag loads

Consent Mode starts with no values at all. On every page, send a default state with all four signals set to denied, before any command that sends data, such as config or event. Google’s guide calls the order vital: if the consent code runs out of order, the defaults don’t work.

If your banner loads asynchronously, it may run after the Google tag. Add wait_for_update to the defaults with a number of milliseconds. Google’s example gives the banner 500 milliseconds to send its update before tags fire.

You can also set defaults per region, with ISO 3166-2 codes, and Google recommends scoping them to the regions where you show a banner. For a site whose visitors are mostly in Europe, denied for everyone is the simpler starting point.

With Google Tag Manager, Google recommends loading your banner through the container with a consent mode template, which uses Tag Manager’s own calls for the default and the update.

Update the state when someone chooses

When the visitor makes a choice, send an update with the new state of each signal. Google asks you to send it on the page where the choice happens, before the visitor moves to another page.

Consent Mode doesn’t carry a choice to the next page. Store it yourself, in a first-party cookie or in local storage, and on every page load send the stored choice as an update straight after the defaults.

Withdrawing works the same way: an update that sets the signals back to denied. Keep a link or button on every page that reopens the choice, so changing your mind is as easy as agreeing.

Basic or advanced mode

In basic mode, Google’s tags don’t load until the visitor has used the banner. Nothing goes to Google before that, not even the consent state. If the visitor refuses, nothing goes at all, and Google models conversions with a general model.

In advanced mode, the tags load with the page and the defaults set to denied. While consent is denied, they send pings without cookies. Google lists a timestamp, the user agent and the referrer among what those pings can contain, and in return it builds a model for your account in particular.

So in advanced mode the visitor’s browser contacts Google before anyone has chosen. The EDPB’s guidelines on the cookie rule say that JavaScript telling a browser to send information can fall under that rule, with or without cookies. Talk to whoever advises you on privacy before you pick advanced mode. This is general information, not legal advice.

Gatelamp’s script blocking covers both steps: a tag waits as text until its category is accepted, and all four Consent Mode signals start as denied and update the moment someone chooses.

When Google requires it

Google’s EU user consent policy applies when you use a Google product that includes it, for visitors in the European Economic Area, the UK and Switzerland. It asks you to get legally valid consent for cookies where the law requires it and for personalised ads, to keep records of that consent, to explain how to withdraw it and to name each party that gets the data.

Google says it is strengthening the enforcement of that policy. To keep using its tags for measurement, ad personalisation and remarketing with visitors in the EEA, you must collect consent and pass the consent signals to Google. That also applies when you use Google Analytics data in Google Ads. If you already use Consent Mode and run no personalised advertising, such as remarketing, Google says the v2 update needs no action from you.

This ties in with the Digital Markets Act. In its post on complying with the DMA, published on 5 March 2024, the week the law’s obligations began for designated companies such as Google, Google listed upgrades to its ad tools to help advertisers pass on consent for the data they collect.

You still need a banner, and maybe not a certified one

Consent Mode only passes on a choice made somewhere else. Without a banner there’s no choice to pass on, and the signals stay on their defaults. Google’s own help pages tell site owners without a banner to set one up.

For Google Analytics and Google Ads, the banner can be your own. Google says you can use a consent banner or other custom solution, or one of its CMP partners.

Google requires a certified consent management platform in one case: personalised ads through AdSense, Ad Manager or AdMob for visitors in the EEA, the UK or Switzerland. That has applied since 16 January 2024 for the EEA and the UK and since 31 July 2024 for Switzerland, and the platform has to integrate with the IAB’s Transparency and Consent Framework. Without one, Google says the traffic may still be eligible for non-personalised or limited ads.

Gatelamp doesn’t support that framework at launch, so it isn’t the right tool for sites that sell personalised ads that way.