Is Consent Mode v2 set up on your site?

What we check, and how to fix it

Google Consent Mode passes a visitor’s choice from your cookie banner to Google’s tags. Your site gives each type of consent a state, denied or granted, and tags such as Google Analytics and Google Ads adjust: with ad_storage denied, Google says they set no new advertising cookies. Version 2 added two signals for advertising, ad_user_data and ad_personalization, next to ad_storage and analytics_storage. Consent Mode passes a choice on. Asking for it is still the job of your banner.

Our server fetches the page once with the same limits as our cookie banner checker (up to 3 redirects,8 seconds, 1.5 MB) and reads the HTML. We check:

• which Google tags load: gtag.js and Google Tag Manager, also through a custom loader or a server-side container, with the IDs for Google Analytics 4 (G-), Google Ads (AW-), Floodlight (DC-) and the Google tag (GT-);
• whether an inline script runs gtag('consent', 'default', …), and which of the four signals it sets;
• whether each signal starts as denied, and for which regions;
• whether the default comes before the first command that sends data, such as config, event or the Tag Manager snippet. Google’s guide calls this order vital;
• whether a consent platform we know is on the page, such as Cookiebot, OneTrust, CookieYes, Usercentrics or Complianz.

How to fix a missing or incomplete default

1. Put the default in the head of every page, above the Google tag or the Tag Manager snippet, with all four signals set to denied.
2. If your banner loads asynchronously, add wait_for_update with a number of milliseconds. Google’s example gives the banner 500 milliseconds.
3. When a visitor chooses, send gtag('consent', 'update', …) with their choice. Store the choice yourself and send it again on every later page, straight after the default.
4. With Tag Manager, you can set the default inside the container instead, with your consent platform’s template or one built on Tag Manager’s consent APIs.
5. To limit the denied default to some countries, add a region list with ISO 3166-2 codes. Google recommends scoping defaults to the regions where you show a banner.
6. Check the result in Google’s Tag Assistant, which shows the default and each update on a live page.

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('consent', 'default', {
    'ad_storage': 'denied',
    'analytics_storage': 'denied',
    'ad_user_data': 'denied',
    'ad_personalization': 'denied',
    'wait_for_update': 500
  });
</script>
<!-- Then the Google tag or the Tag Manager snippet -->

From Google’s own documentation, checked on 28 October 2026:

• Set up consent mode on websites
• Consent mode overview: basic and advanced
• Troubleshoot consent mode with Tag Assistant
• Tag Manager Help: updates to consent mode for traffic in the EEA

Our guide Consent Mode v2 explained covers basic and advanced mode, the update after a choice, and when Google requires a certified consent platform.

What this check can’t see

• Tags and settings inside a Google Tag Manager container. The container is a separate file, so a default or a consent template set there doesn’t show up here.
• Defaults that a consent platform sets from its own script.
• What happens after a choice: whether the update fires and the tags follow it. Tag Assistant shows that.
• Tags that a script adds after the page loads, and other pages of the site.

General information about how Google documents Consent Mode, not legal advice. Whether a site meets the law depends on more than these signals, starting with a banner that asks before anything loads.

What we store

Nothing. The address you enter goes to our server, which fetches that one page and sends the result back to your browser. We don’t keep the address or the result, and we don’t log them. The site you check sees one visit from Cloudflare’s network, with our checker’s name in the user agent. More in the privacy policy.