Consent Mode v2 in Google Tag Manager: web and server-side setup

Consent Mode is how your website tells Google's tags what a visitor agreed to. Your banner records the choice; Consent Mode passes it to Google Analytics and Google Ads, which then decide what they may store and send. Version 2 added two signals for advertising, and since March 2024 Google expects them for visitors in the European Economic Area.

This guide starts in your web container: default and update, the Consent Initialization trigger, basic or advanced mode, region defaults and a check in Tag Assistant. It then follows the consent state to your server container, where tags for other platforms need a consent check of their own. To read the state on each hit yourself, see How to read the gcs and gcd parameters.

The four signals

Consent Mode v2 works with four consent types. Each one is either granted or denied.

• ad_storage: may advertising cookies be read and written. When denied, Google's ad tags write no new advertising cookies and do not read existing ones.
• analytics_storage: may analytics cookies be read and written. When denied, Google Analytics sets no cookies and sends cookieless pings instead.
• ad_user_data: may user data be sent to Google for advertising. New in v2. When denied, personal data for advertising is switched off, which includes enhanced conversions.
• ad_personalization: may the data be used for personalised advertising. New in v2. When denied, remarketing receives no data.

Google also lists functionality_storage, personalization_storage and security_storage as privacy parameters. Your banner may set them, and other tags in your container can check them.

What Google requires, and since when

Google's EU user consent policy covers visitors in the EEA, the UK and Switzerland: you need valid consent for cookies where the law requires it, and for using personal data to personalise ads. In January 2024 Google announced that advertisers reaching people in the EEA must send consent signals to keep conversion measurement and audience features. Since early March 2024, properties without them only include visitors outside the EEA in linked advertising audiences. Google also states that ad_user_data is required for measurement, and that both ad_user_data and ad_personalization must be granted for personalised ads.

In short: advertise with Google and have EEA visitors, and all four signals need to reach Google with every hit.

Basic or advanced mode

There are two ways to implement it. The choice is yours to make with whoever handles privacy in your organisation.

• Basic mode: Google tags do not load until the visitor answers the banner. Nothing is sent before that, not even the consent state. If the visitor declines, Google's modelling falls back to a general model.
• Advanced mode: Google tags load straight away with the default state, usually denied, and send cookieless pings while consent is denied. Google uses those for modelling that is specific to your account. Full measurement starts once the visitor consents.

The steps below apply to both, with one difference in Step 5.

1Add your CMP's Tag Manager template

The cleanest setup is your consent tool's own template from the Community Template Gallery, where Google lists templates from its featured consent platforms. They use Tag Manager's consent APIs, which run before any other tag. In your web container go to Tags › New › Tag configuration › Discover more tag types in the Community Template Gallery, search for your consent tool and add its template. Using Cookiebot? Cookiebot in Google Tag Manager walks through its template.

Set the trigger to Consent Initialization - All Pages. Every web container has it, and it always fires before every other trigger, including Initialization. Never use All Pages: by then other tags may have fired without a consent state.

With a banner you built yourself, set the default in a template that uses the consent APIs, or put the gtag('consent', 'default', ...) command in the page source above the Tag Manager snippet. Google calls the order vital: a default that runs after the first measurement command does not work.

2Set the default state

The default is what applies before the visitor has chosen. For EEA traffic, that is normally all four signals denied. In a template you fill in the default settings table; in code it looks like this:

gtag('consent', 'default', {
  'ad_storage': 'denied',
  'analytics_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied',
  'wait_for_update': 500
});

wait_for_update is how many milliseconds Google tags wait for an update before sending anything. Google recommends at least 500 when the consent tool loads asynchronously.

3Add region-specific defaults (optional)

For a different default outside Europe, add a region with ISO 3166-2 codes: a country such as NL, or a subdivision such as US-CA. A default without a region applies to everyone a regional one does not cover, and where regions overlap, the more specific one wins. In a CMP template this is the region column. Leave it empty on your strictest row, so visitors from countries you did not list get the strict default.

4Make sure the update is sent

When the visitor answers, the banner must send an update with the new state, for each of the four signals:

gtag('consent', 'update', {
  'ad_storage': 'granted',
  'analytics_storage': 'granted',
  'ad_user_data': 'granted',
  'ad_personalization': 'granted'
});

Check three cases. A refusal must send an update with denied, not just close the banner. A partial choice must send a mix. And a returning visitor must get the update early on every page; a CMP template does this by reading its own consent cookie on load.

5Check the consent settings on your tags

Google's tags (the Google tag, GA4 events, Google Ads and Floodlight) have built-in consent checks: they read Consent Mode by themselves. Other tags, such as the Meta pixel, do not. Open each non-Google tag, go to Advanced Settings › Consent Settings and choose Require additional consent for tag to fire, with the consent types it needs (for an advertising pixel, usually ad_storage).

For basic mode, give your Google tags the same additional consent requirement, so they do not load at all before consent.

For the whole container at once, switch on Admin › Container Settings › Enable consent overview. The shield icon on the Tags page then lists which tags have consent configured and which do not.

6Decide on url_passthrough and ads_data_redaction

Two optional settings refine what happens while consent is denied. If your CMP's template offers them, switch them on there (Google's own sample template has a checkbox for each); in code they are gtag('set', ...) commands.

• url_passthrough: when ad_storage or analytics_storage is denied, the ad click information (such as gclid, wbraid and _gl) is passed along in the URL as the visitor clicks through your pages, instead of in a cookie. That keeps the click linked to a later conversion. It changes your internal link URLs, so check that nothing on your site breaks on the extra parameters.
• ads_data_redaction: when ad_storage is denied, ad click identifiers are removed from Google Ads and Floodlight requests. It has no effect when ad_storage is granted.

7Check it in Tag Assistant

Open Tag Assistant, connect to your site and leave the banner alone. Select the first Consent event in the summary and open the Consent tab, where On-page Default should show all four signals with your default. Then answer the banner, select the latest Consent event and check that On-page Update matches your choice. The Tags tab shows which tags fired and which consent held back. An empty Consent tab means Consent Mode is not running.

The same state is on every hit your site sends. In your browser's Network tab, the gcs and gcd parameters of a GA4 request should change from denied to granted when you accept; How to read the gcs and gcd parameters explains the values.

GA4 confirms it under Admin › Data collection and modification › Consent settings, per data stream; Google notes its notices can take 48 to 72 hours to update after a fix.

Measurebase checks this every night: the tracking audit reports Google hits without a consent state and tags that fire before the banner is answered, and the Domain statistics page shows how many hits arrived granted, denied or without a state. To test consent-gated tags without answering your own banner, use Auto Grant Consent and switch it off afterwards.

Consent Mode with a server container

Server-side tagging changes nothing in the steps above: Consent Mode is set in the browser, and every Google hit carries the state to your server container in two parameters. gcs holds ad_storage and analytics_storage: G111 when both are granted, G100 when both are denied. gcd holds all four signals and says whether each came from the default or from the visitor. How to read the gcs and gcd parameters decodes both.

Google's own server tags, such as the GA4 tag, read that state and behave accordingly. Tags for other platforms do not: a Meta, TikTok or LinkedIn Conversions API tag in your server container fires for every event that matches its trigger, whatever the visitor chose. That is the gap in most server-side setups, and the next two steps close it.

8Add a consent check to non-Google server tags

In your server container, go to Variables › User-Defined Variables › New and create an Event Data variable with the key path x-ga-gcs. The GA4 client puts the hit's gcs value there, for example G111.

Then add a condition to the trigger of every advertising tag that may only fire with consent, such as your Meta Conversions API tag: x-ga-gcs matches RegEx ^G11. That passes G110 and G111, the two values where ad_storage is granted. A tag that depends on analytics consent checks the last digit instead, with ^G1.1.

Two things to know. x-ga-gcs only exists on events from the GA4 client; events from another client carry consent in their own fields, so check what that client provides. And a hit without Consent Mode has no gcs at all, so the condition holds the tag back: fix the web container first.

9Check the server side

Open server container preview next to Tag Assistant and click through your banner. For each incoming request, the Request tab shows its URL with the gcs value, and the Tags tab shows which tags fired. After a refusal, your Conversions API tags should be listed under Tags Not Fired.

To test consent-gated tags without answering your own banner every time, use Auto Grant Consent: it rewrites every hit to fully granted before it reaches your server container. Switch it off afterwards, and before you test a refusal.

The mistakes we see most

1. No Consent Mode at all. The site shows a banner, but the Google hits carry no gcs. The tags then behave as if everything was allowed. Our tracking audit reports this as "the Google hits carry no consent state".
2. A default that comes too late. The default is set in a tag on All Pages, after other tags already fired. Use Consent Initialization, or your consent tool's template (Step 1).
3. A refusal without an update. The banner closes but sends nothing, so Google only knows the default (Step 4).
4. Conversions API tags without a consent check. The web container is fine, but the server container forwards every event to Meta or TikTok (Step 8).

Tags that fire anyway are covered in more detail in Tags that fire before consent.

Frequently asked questions