Consent Mode v2: how to read the gcs and gcd parameters

Every request that Google's tags send carries the visitor's consent state in two short URL parameters: gcs and gcd. Your banner and your Tag Manager setup can look fine while these two say something else, and they are what Google Analytics and Google Ads actually receive. Reading them takes a minute and tells you whether Consent Mode v2 works on your site.

This guide explains where to find both parameters, how to decode them and which values point to a problem. Setting Consent Mode up is covered in Consent Mode v2 in Google Tag Manager.

Consent Mode v2 in short

Consent Mode passes four signals to Google's tags, each granted or denied:

• ad_storage: cookies for advertising.
• analytics_storage: cookies for analytics.
• ad_user_data: sending user data to Google for advertising.
• ad_personalization: using the data for personalised advertising, such as remarketing.

Your site sets a default before the visitor chooses and sends an update once they answer the banner. The tags turn this state into request parameters. Google names gcs, gcd and dma among them and adds that these fields may change as its services evolve.

Where to find them

Open your site in Chrome, open the developer tools (F12, or Cmd+Option+I on a Mac) and go to the Network tab. Type collect in the filter box and reload the page. Each GA4 hit is a request to /g/collect: on google-analytics.com, or on your own tagging subdomain when you use server-side tagging. Click one and open Payload: gcs and gcd are in the query string parameters. Google Ads requests carry the same two.

With server-side tagging, check the other end too. In server container preview, select an incoming request and open its Request tab: the request URL shows the values your server container received.

Using Enhanced Ad Blocker Protection? Then the hits leave the browser in a masked form, and the Network tab shows no readable gcs. Read them in server container preview instead, where the hits arrive unmasked.

Reading gcs

gcs holds the two storage signals. It always starts with G1, followed by one character for ad_storage and one for analytics_storage, in that order: 1 is granted, 0 is denied.

gcs	ad_storage	analytics_storage
G111	granted	granted
G110	granted	denied
G101	denied	granted
G100	denied	denied
G1--	not set	not set
missing	Consent Mode is not running

gcs shows the state the hit was sent with, not where it came from. G100 can mean "denied by default, no answer yet" or "the visitor refused". For that difference, and for the two advertising signals that version 2 added, you need gcd.

Reading gcd

According to Google, gcd is always sent, whether Consent Mode is active or not. A typical value looks like 13r3r3r2r5l1. It starts with 1, followed by a digit and a letter for each signal, in this order: ad_storage, analytics_storage, ad_user_data, ad_personalization. Read only the letters: in 13r3r3r2r5l1 all four signals are r. The digits and the characters after the fourth letter carry other information that does not change the state.

Each letter combines the default with the update:

Letter	Default	Update	Result
l	not set	not set	no signal
p	denied	none yet	denied
q	denied	denied	denied
r	denied	granted	granted
t	granted	none yet	granted
u	granted	denied	denied
v	granted	granted	granted
m	not set	denied	denied
n	not set	granted	granted

Google does not publish this table. It comes from how the tags behave, it matches the decoders others have published, and we check it against the hits we process every day. Now and then a capital letter appears, such as Z where you would expect t. It carries an extra flag Google has not documented; for those, Tag Assistant's Consent tab gives the definite answer.

Common values and what they mean

These pairs all come from real traffic:

gcs	gcd	What it means
missing	13l3l3l2l1l1	No Consent Mode at all. The tags work as if everything was allowed.
G100	13p3p3p2p5l1	Denied by default, the visitor has not answered yet. This is advanced mode working as it should.
G111	13r3r3r2r5l1	Denied by default, the visitor accepted everything.
G100	13q3q3q2q5l1	Denied by default, the visitor refused everything.
G110	13r3q3r2r5l1	The visitor accepted advertising but refused analytics.
G111	13t3t3t2t5l1	Granted by default, no answer. Fine for regions where you do not need consent first; for visitors in the EEA it means consent was assumed before anyone asked.

1Check the first hit

Open your site in a private window, so no earlier consent is stored, and leave the banner alone. In advanced mode the first /g/collect hit should show G100 with p letters (or your region's default). In basic mode there should be no GA4 hit at all until the visitor answers. A first hit with t letters for an EEA visitor means your default is granted.

2Accept, then refuse

Click Accept all. The next hit should show G111 and r letters. Then open a new private window, refuse everything and check for q letters. A refusal that leaves the letters at p means the banner closes without sending an update; Google then only knows the default.

3Go to a second page

After accepting, click through to another page. Its first hit should carry r again: the banner reads its own cookie and repeats the update early on every page. A first hit with p, followed by r a moment later, means the update arrives after the first tags fired.

4Compare with the server container

With server-side tagging, open server container preview and check that the incoming requests carry the same values as in the browser. Remember that Auto Grant Consent, the testing power-up, rewrites every hit to fully granted before it reaches your server container. While it is on, the browser shows the real values and server container preview shows G111, so switch it off before you test consent.

Warning signs

• gcs missing, only l letters: Consent Mode is not running, even if a banner shows. Start with the setup guide.
• m or n letters: an update arrived without a default. The default is missing or set too late, so tags that fired before the update had no consent state at all. Tags that fire before consent lists the usual causes.
• G111 before anyone clicked: the default is granted, or the banner reuses an old answer. Test again in a private window.
• Only two signals set: ad_storage and analytics_storage have letters, but ad_user_data and ad_personalization show l. That is a version 1 setup, which does not meet Google's requirement for visitors in the EEA.
• gcs and gcd disagree on ad_storage or analytics_storage: rare, and usually a tag that sets its own consent next to your banner's. Check the Consent tab in Tag Assistant.

Other consent parameters: dma and dma_cps

Hits can also carry dma and dma_cps, which relate to the EU Digital Markets Act. Google only says that dma_cps encodes consent to Google services. You do not need them to check your Consent Mode setup; gcs and gcd tell you what you need.

How Measurebase reads them

Measurebase decodes gcs and gcd on every Google hit your domain receives. The Domain statistics page shows how many hits arrived granted, denied or without a Consent Mode state, per signal. The tracking audit reports Google hits without a consent state and tags that fire before the banner is answered. And Data Enrichment adds the visitor's city and region only when the hit does not deny analytics_storage; the country is always added.

Frequently asked questions