Consent Mode v2 with server-side Google Tag Manager

Consent Mode is how Google tags learn what a visitor agreed to. Since March 2024, version 2 is required for advertisers who use Google's ad products with visitors in the European Economic Area. With server-side tagging it still starts in the browser, but the consent state then travels along to your server container, and that is where most setups have a gap.

The four signals

• analytics_storage: may analytics cookies be stored.
• ad_storage: may advertising cookies be stored.
• ad_user_data: may user data be sent to Google for advertising (new in v2).
• ad_personalization: may the data be used for personalised ads such as remarketing (new in v2).

Your consent banner sets a default for each, usually denied, before any tag runs, and sends an update when the visitor answers.

Basic or advanced mode

In basic mode, Google tags don't load at all until the visitor consents. Nothing is sent before or without consent. In advanced mode, the tags load straight away and send cookieless pings with the denied state, which Google uses for conversion and behaviour modelling. Advanced mode gives better modelled data; basic mode is the stricter choice. Which one fits is a decision for your organisation.

How the consent state reaches your server

Every Google hit carries the consent state in two parameters: gcs (for example G111 when analytics and ads are granted, G100 when both are denied) and gcd, which also says whether each signal was set by default or by the visitor. Your server container receives these with the hit. Google's own server tags, such as the GA4 tag, read them and behave accordingly.

Measurebase reads them too: the Domain statistics page shows how many hits arrived granted, denied, or without any Consent Mode state at all.

What your server container has to do

Tags for other platforms don't read Google's consent state by themselves. A Meta, TikTok or LinkedIn Conversions API tag in your server container fires for every incoming event unless you tell it not to. Add a trigger condition or an exception that checks the consent state of the event, so visitors who denied advertising are not forwarded to those platforms.

The two mistakes we see most

1. No Consent Mode at all. The site shows a banner, but the Google hits carry no gcs parameter. Google then treats every hit as consented. Our tracking audit reports this as "the Google hits carry no consent state".
2. Defaults that come too late. The default is set in a tag on All Pages, after other tags already fired. Set it on the Consent Initialization trigger, or let your consent tool's Tag Manager template do it.

Both are covered in more detail in Tags that fire before consent.

Testing

Check the hits in your browser's developer tools for the gcs value before and after you answer the banner, and in server container preview for the same value on the incoming event. To test your tags without answering your own banner every time, the Auto Grant Consent power-up treats every hit as consented. It is for testing only: switch it off afterwards.