Consent Mode v2 Explained: What Small Businesses Must Do

Consent Mode v2 sounds like something only large European companies need to worry about. In reality, it affects any business that runs Google Ads or uses GA4 and gets visitors from Europe, and it shapes how much conversion data Google can recover when people decline cookies. Most of the small business sites I check either have no Consent Mode at all, or have a cookie banner that looks right but sends no signals to Google. This guide explains what Consent Mode v2 is, the four signals it uses, the difference between basic and advanced mode, and the practical steps a small business should take.

I am a tracking specialist, not a lawyer. Treat this as a technical guide and check your legal obligations with a qualified adviser.

What is Consent Mode v2?

Consent Mode v2 is Google's system for telling its tags, such as GA4 and Google Ads, whether a visitor has agreed to cookies and data use, so the tags can adjust their behaviour. Your cookie banner, called a consent management platform (CMP), collects the visitor's choice. Consent Mode passes that choice to Google tags as a set of signals.

Version 2 added two new signals that relate to advertising: ad_user_data and ad_personalization. Google made these signals a requirement for advertisers who want to keep using measurement, remarketing and personalisation features for users in the European Economic Area (EEA), with enforcement that started in March 2024. This ties into Google's EU user consent policy and the EU's Digital Markets Act.

What are the four Consent Mode v2 parameters?

Consent Mode v2 uses four core parameters, each set to either granted or denied:

There are also non-advertising types, functionality_storage, personalization_storage and security_storage, that some CMPs set. Google's ad and analytics tags mainly respond to the four in the table.

The difference between ad_storage and ad_user_data confuses many people. ad_storage is about cookies on the visitor's device. ad_user_data is about whether data about that user can be sent to Google for advertising purposes, which matters for features like enhanced conversions.

What is the difference between basic and advanced Consent Mode?

The difference is what happens before and after a visitor declines: in basic mode Google tags do not load at all until consent is granted, while in advanced mode tags load straight away and send cookieless signals when consent is denied.

Basic Consent Mode

• Google tags are blocked until the visitor interacts with the banner.
• If the visitor declines, no data is sent to Google at all.
• Google Ads can only use a general, less specific model to estimate missing conversions.
• Simpler and stricter, so some businesses prefer it from a privacy point of view.

Advanced Consent Mode

• Google tags load immediately, with default consent states set to denied before the banner is answered.
• When consent is denied, tags send cookieless pings: signals without cookies or identifiers, such as an event having happened.
• If the visitor grants consent, tags update and work normally.
• These pings allow Google to build an advertiser-specific model, which gives better conversion modelling in Google Ads and can enable behavioural modelling in GA4 once your property has enough traffic to meet Google's thresholds.

Which one is right depends on your legal advice and your risk appetite. I explain the trade-off to clients, but the business makes the call.

Do small businesses outside Europe need Consent Mode v2?

If you have visitors from the EEA or the UK and you use Google Ads or GA4 for them, you should implement Consent Mode v2. If you have no meaningful European traffic, Google does not currently require it in the same way, but it is still worth setting up properly.

Most of my clients are ecommerce brands in Bangladesh and local service businesses in the US, such as cleaning, chimney and HVAC companies. Their customers are mostly local, so the EEA rule is not usually their main concern. I still recommend a clean consent setup because:

• Privacy laws are expanding in many regions, including several US states.
• A correct setup now avoids rebuilding the tracking later.
• If you do run ads to any European audience, missing signals limit remarketing and audience features for that traffic.

How do you set up Consent Mode v2?

The simplest reliable approach is to use a CMP with a Google Tag Manager template and connect it to Consent Mode. These are the steps I follow:

1. Choose a CMP that supports Consent Mode v2. Popular options such as Cookiebot, CookieYes, Usercentrics and OneTrust offer GTM templates. Google keeps a list of certified CMP partners, and using one is required for some Google publisher products.
2. Enable Consent Overview in GTM. In Container Settings, tick "Enable consent overview" so you can see the consent settings for every tag.
3. Add the CMP tag on the Consent Initialization trigger. The built-in Consent Initialization - All Pages trigger fires before all other triggers, so default consent states are set before any Google tag runs.
4. Set default states. Usually all four parameters default to denied for regions where consent is required. Many CMPs let you set different defaults by region.
5. Confirm the update command. When the visitor clicks accept or reject, the CMP must send a consent update with the new states.
6. Review tag consent settings. Google tags have built-in consent checks. For non-Google tags, such as the Meta Pixel, add "additional consent" requirements so they only fire when the right consent is granted.
7. Decide on optional features. url_passthrough can pass ad click information in URLs when cookies are denied, and ads_data_redaction removes ad click identifiers when ad_storage is denied.

What the code looks like without a template

If you use gtag.js directly, the default and update commands look like this. The default must run before the Google tag loads:

gtag('consent', 'default', {
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  analytics_storage: 'denied',
  wait_for_update: 500
});

// Later, after the visitor accepts:
gtag('consent', 'update', {
  ad_storage: 'granted',
  ad_user_data: 'granted',
  ad_personalization: 'granted',
  analytics_storage: 'granted'
});

wait_for_update tells Google tags to wait a set number of milliseconds for the banner's update before sending data. You can also add a region array to apply defaults only to certain countries.

How do you check that Consent Mode is working?

Check it in three places: Tag Assistant, GA4 and Google Ads. A banner showing on the page does not prove the signals are reaching Google.

• In Tag Assistant (GTM Preview mode), open the Consent tab and confirm the default states appear on the first event, before any tag fires.
• Accept and reject the banner, and confirm the update states change correctly.
• In GA4, go to Admin > Data collection and modification > Data collection and check the consent settings status.
• In Google Ads, open conversion action diagnostics and look for the consent mode status.
• Confirm the Meta Pixel and other non-Google tags do not fire after a rejection.

Consent is one of the first areas I check in an audit, because errors here quietly affect every other tag. If you are planning server-side tracking, make sure consent signals pass through to your server container too. For a broader review, my tracking audit checklist covers consent alongside the rest of your setup.

Final thoughts

Consent Mode v2 is not just a banner. It is a set of signals that decides how Google tags behave and how much data Google can model when people say no. Pick a CMP that supports it, fire it on Consent Initialization, and test the signals. If you want help getting it right alongside your conversion tracking, see my advanced conversion tracking service or book a free tracking audit.