CookieHawk › Guides › Google Consent Mode v2 explained

Google Consent Mode v2, explained without detours

Consent Mode v2 is how your website tells Google whether the visitor said yes or no. Without it, Google Ads and Analytics may stop receiving data from visitors in the EEA. Here is what it consists of, and how to see whether it really works on your site.

Updated 2 September 2026 · 6 minute read

What Consent Mode v2 is

Consent Mode is not a consent banner. It is a set of signals your banner passes on to Google's tools so they know what they are allowed to do. The banner asks; Consent Mode relays the answer.

The difference from the first version is that v2 added two signals about advertising: whether data may be used to build audiences, and whether ads may be personalised. Those two are what made v2 a requirement for using Google's advertising products with users in the EEA.

Consent Mode does not make you compliant on its own. It relays a consent — it does not obtain one. If the banner is set up wrongly, Consent Mode simply relays a wrong answer, correctly.

The six signals

All six are set at once, and each is either granted or denied:

ad_storage — storage related to advertising, typically ad cookies
ad_user_data — whether user data may be sent to Google for advertising purposes
ad_personalization — whether data may be used for personalised ads and remarketing
analytics_storage — storage related to statistics, such as Google Analytics
functionality_storage — storage that makes features work, such as language choice
personalization_storage — storage for personalising the content

The first two versions of Consent Mode had only ad_storage and analytics_storage. If you add just those two, the setup is incomplete for v2.

The ordering is what people get wrong

Consent Mode must be set to denied before any Google script loads. Do it the other way around — load Analytics first and set consent afterwards — and the measurement has already happened. What you set on the next line then makes no difference.

That is why the default values belong at the very top of <head>, before everything else:

window.dataLayer = window.dataLayer || [];
function gtag(){ dataLayer.push(arguments); }

gtag('consent', 'default', {
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  analytics_storage: 'denied',
  functionality_storage: 'denied',
  personalization_storage: 'denied',
  security_storage: 'granted',
  wait_for_update: 500
});

wait_for_update states how many milliseconds Google should wait for the consent to arrive before tags run with the default values. Without it, a tag can slip through in the gap between page load and choice.

Once the visitor has chosen, an update is sent:

gtag('consent', 'update', {
  ad_storage: 'granted',
  ad_user_data: 'granted',
  ad_personalization: 'granted',
  analytics_storage: 'granted'
});

Basic or advanced?

Google distinguishes between two ways of using Consent Mode, and the difference matters for what you measure.

Basic: Google tags do not load at all until the visitor has said yes. If they say no, nothing is sent. Easiest to defend, but you lose all measurement of those who decline.
Advanced: the tags load but send so-called cookieless pings while consent is missing. Google uses them for modelling. You keep more measurement, but something is sent to Google even on a no — and you must be able to explain that in your privacy policy.

The choice is yours, not your vendor's. We have no interest in pushing you towards either, but you should know which one you are actually running — many people do not.

How to check that it works

Having the code in place is not the same as it working. Here is how to check for yourself:

Open the website in a private window, so you start with no previous choice.
Open developer tools and go to the Network tab.
Reload the page, but do not click the banner yet.
Filter on google-analytics.com, googletagmanager.com and doubleclick.net. If you see requests sending measurement data before you chose, something loads too early.
Click “Reject all”. Reload without changing the choice, and look for the same requests again.

The last step reveals the most. Many banners show the right choice in the interface but do not block what was already in the page code.

If you would rather not do this by hand, our free check performs exactly these steps automatically and shows which hostnames were contacted in each state.

If you use Google Tag Manager

GTM has built-in support for Consent Mode, but it does not take effect by itself. Each tag has a setting for which consent types it requires, and a tag without that setting runs regardless of what the visitor chose.

There is a separate guide for this: how to check consent in Google Tag Manager.

Common questions

Is Consent Mode v2 required by law?

No. The law requires valid consent before a website stores or accesses information on the visitor's device, under Article 5(3) of the ePrivacy Directive as implemented in national law. Consent Mode is Google's way of receiving that consent, and Google requires it to use its advertising products with users in the EEA. So it is a requirement from Google, not from the law — but without valid consent underneath, it does not help you either way.

What happens if I do not use Consent Mode v2?

For Google Ads and Analytics it can mean that data from visitors in the EEA is no longer received or usable for audiences and remarketing. Your website works as before, but your measurement and advertising get worse.

Is installing a consent banner enough?

Only if the banner actually sends the signals, and does so before the Google scripts load. A banner that shows the right text but loads Analytics along with the page gives you the choice in the interface without the effect behind it.

Do I need Consent Mode if I do not use Google at all?

No. Consent Mode concerns Google's tools. If you use other measurement or advertising tools, the consent has to be relayed their way instead — but the requirement for valid consent before storage applies regardless.

Want to see whether Consent Mode is set up correctly?

The free check reads the consent signals your website sends, both before the visitor has chosen and after “Reject all”. You get the answer as a report, without creating an account.

Check your website free