Consent Mode v2
Why consent mode exists
In 2018, GDPR required that European users consent to tracking before any analytics data could be collected. The result: GA4 implementations across Europe went dark for a significant percentage of users who clicked "reject."
Google's answer: Consent Mode. A system where GA4 and Google Ads tags can still fire when consent is denied, but they fire with limited data — no cookies, no identifiers. Google then uses statistical modeling to estimate the conversions that were missed.
Consent Mode v2 (January 2024) tightened the requirements. Failing to implement it correctly now impacts Smart Bidding and Google Ads conversion modeling in the EU.
The two consent signals
Consent Mode works with two primary signals:
`analytics_storage`: controls whether GA4 can set and read cookies. When denied, GA4 fires pings without _ga cookie or client_id — no user identification possible.
`ad_storage`: controls whether Google Ads can set cookies for conversion and remarketing tracking. When denied, no conversion cookies are written.
v2 added two additional signals:
`ad_user_data`: whether Google can use this user's data to inform ad targeting
`ad_personalization`: whether ads can be personalized for this user
All four must be passed to Google for compliant v2 implementation in the EU.
Default and update commands
Consent Mode requires two code calls:
Default state (before the CMP loads, before user chooses):`javascript
gtag('consent', 'default', {
'analytics_storage': 'denied',
'ad_storage': 'denied',
'ad_user_data': 'denied',
'ad_personalization': 'denied',
'wait_for_update': 500 // wait up to 500ms for CMP to load
});
Update state (after user makes a choice):`javascript
// If user accepts all:
gtag('consent', 'update', {
'analytics_storage': 'granted',
'ad_storage': 'granted',
'ad_user_data': 'granted',
'ad_personalization': 'granted'
});
// If user accepts analytics only:
gtag('consent', 'update', {
'analytics_storage': 'granted',
'ad_storage': 'denied',
'ad_user_data': 'denied',
'ad_personalization': 'denied'
});
The wait_for_update parameter is critical. Without it, Google tags fire immediately with denied state before the CMP has loaded — you lose data even from users who would accept.
CMP integration
Your Consent Management Platform (OneTrust, Cookiebot, Usercentrics, etc.) must send the update signal after the user makes a choice.
Most CMPs have native Google Consent Mode v2 integrations. For OneTrust: enable the "Google Consent Mode v2" option in the script settings and it handles the update call automatically.
Test the integration in GTM Preview mode:
1. Open your site in preview
2. Open the consent banner and reject all
3. Verify consent state shows denied in GTM variables
4. Accept all cookies
5. Verify consent state updates to granted
6. Verify GA4 tags only fire after consent is granted (or fire in cookieless mode if denied)
What modeling actually does
When analytics_storage is denied, GA4 records a cookieless ping — it knows a session happened but can't tie it to a user or prior sessions. Google then uses machine learning to estimate:
- How many conversions were attributed to each channel from the non-consenting segment
- How those conversions should be modeled back into your reports
The modeling accuracy depends on your consent rate. If 80% of users consent, the model has rich data to extrapolate from. If 20% consent, the model is working with limited signal.
You can verify modeling is active in GA4: Admin → Data Settings → Data Collection → "Enable modeling for users who decline analytics cookies" should be on.
Non-compliant implementations have consequences
I build these systems professionally.
Whether it's a RAG pipeline, analytics migration, or AI workflow — let's talk.