Cookie consent and ad tracking: Google Consent Mode v2 without the confusion

Since March 2024, Google has required consent signals to be sent along with data for visitors from the European Economic Area (EEA) if you want to use measurement, ad personalization and remarketing. Plenty of websites have a cookie banner, but many of them tell Google tags nothing — or only half of what they need. This article covers the technical side: what the banner does, what Consent Mode v2 does, and how to check that they talk to each other.

This is technical, not legal advice; check the rules that currently apply to you.

The banner collects, Consent Mode passes it on

Most of the confusion comes from using one word, "consent", for two different things:

• A consent management platform (CMP) — the cookie banner or plugin, for example Complianz. It asks the visitor, stores the answer and lets them change their mind later.
• Consent Mode — Google's mechanism through which Google tags learn the visitor's choice and behave accordingly.

Neither works without the other. A banner without Consent Mode collects the answer, but Google tags never hear about it. Consent Mode without a banner has nothing to pass on. So the question "do we have Consent Mode?" really means: does our banner pass the choice to Google tags, and does it pass all four signals?

The four signals

Signal	What it means
ad_storage	whether advertising cookies may be stored
analytics_storage	whether analytics cookies may be stored
ad_user_data	whether user data may be sent to Google for advertising
ad_personalization	whether personalized ads and remarketing are allowed

The first two already existed in the first version of Consent Mode. Version 2 added ad_user_data and ad_personalization. A banner that sends only the first two does half the job: without the new ones, Google lacks the consent signals it requires for EEA visitors, so personalized ads and remarketing will not work for them.

The default state is "denied" — and it comes before the tags

Until the visitor clicks anything, all four signals must be "denied". This default must be set before any Google tag runs — otherwise the first event goes out before anyone knows whether the visitor agrees.

gtag('consent', 'default', {
  ad_storage: 'denied',
  analytics_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  wait_for_update: 500
});

wait_for_update is how many milliseconds the tags wait for the banner's answer. Once the visitor chooses, the banner sends an update — only for the categories they accepted. If they accepted everything:

gtag('consent', 'update', {
  ad_storage: 'granted',
  analytics_storage: 'granted',
  ad_user_data: 'granted',
  ad_personalization: 'granted'
});

If they accepted statistics only, just analytics_storage becomes granted.

You usually do not need to write this code by hand — consent plugins with a Consent Mode integration add it themselves. Your job is to check that the integration is switched on, that all four signals are sent, and that the default state appears before the Google tags. When several tools add tags to the site — say, a plugin and hand-pasted code — this order easily gets mixed up.

Basic or advanced mode

• Basic. Google tags do not load at all until the visitor consents. Nothing comes in from visitors who decline.
• Advanced. Tags load straight away in the "denied" state and, until there is consent, send so-called "cookieless pings" — signals without cookies. Google uses them to model conversions it did not see directly.

Advanced mode gives you more data, but some lawyers consider it risky: data reaches Google before consent, even if without cookies. Which one to choose is a decision for the site owner and their lawyer. If in doubt, basic is the more cautious option.

What each "no" means in practice

• analytics_storage "denied" — GA4 does not set the _ga cookie and cannot recognize a returning visitor.
• ad_storage "denied" — the ad click identifier (gclid) is not stored in a cookie, so a later purchase is harder to tie to the ad.
• ad_user_data "denied" — no user data is sent to Google for advertising, including the hashed emails and phone numbers used for enhanced conversions.
• ad_personalization "denied" — the visitor is not added to remarketing audiences.

If your tags used to run without consent, the numbers will drop once consent is set up properly. That is not a fault: you now see only the people who agreed.

Meta has no Consent Mode

Consent Mode is a Google-only mechanism. Meta Pixel does not understand it, so until consent the Pixel simply must not run. Usually the consent plugin handles this: it holds back the Pixel script until the visitor accepts marketing cookies. The other way is the Pixel command fbq('consent', 'revoke') before fbq('init', …), followed by fbq('consent', 'grant') once the visitor agrees. If you also send events to Meta from your server, the server has to check consent itself.

How to check that it works

1. Open your site in an incognito window and do not touch the banner.
2. In the browser's developer tools (F12 → Application → Cookies), check that there are no _ga (Google Analytics) or _fbp (Meta Pixel) cookies.
3. Connect the site in Google Tag Assistant (tagassistant.google.com) and, in the consent section, check that the default state with all four signals "denied" is set before the first tag.
4. Click "Accept" and check that an update with "granted" appeared, along with the cookies.
5. In a fresh incognito window, click "Reject" — no cookies should appear afterwards either.

For those who want to dig deeper: in Google requests on the browser's network tab (F12 → Network), the gcs parameter shows the consent state — G100 means advertising and analytics cookies are not allowed, G111 means they are.

Does analytics need consent?

The most common question is whether Google Analytics can run without consent. The answer does not depend on the technology: the site owner decides it with a lawyer, based on the rules in force. In Lithuania, consent is usually required. We handle the technical part — making sure the visitor's choice, whatever it is, reaches every tag correctly.

When you order a new website or a rebuild, put this in the brief: a consent plugin with Consent Mode v2, all four signals, a "denied" default, the chosen mode, and Meta Pixel only after consent. We covered how to write such a brief in How to write a software brief. Our website service has its own page.

What to do tomorrow

1. In an incognito window, check that no _ga or _fbp cookies are created before the banner is clicked.
2. In your consent plugin's settings, check that the Consent Mode v2 integration is on and that all four signals are sent.
3. Decide with your lawyer which mode you will use — basic or advanced.

Frequently asked questions

Does Consent Mode replace the cookie banner?

No. The banner collects consent; Consent Mode only passes it on to Google tags. You need both.

What will I see in reports about visitors who decline?

In basic mode — nothing: their visits and purchases do not reach GA4 or Google Ads. In advanced mode, Google may estimate some of their conversions through modeling and show them in aggregate, without individual visitors.

Do visitors from outside the EU need Consent Mode too?

Google's requirement applies to EEA visitors. Technically, the default state can be set per region (the region parameter), but for a Lithuanian website it is simpler to apply the same rules to every visitor.