Consent Mode v2 Explained for Non-Technical Marketers

What Consent Mode actually is

Consent Mode is Google's framework for passing the user's cookie choice from your cookie banner into Google's tags: GA4, Google Ads, Floodlight. The browser calls a small piece of JavaScript called gtag('consent', ...) and tells Google whether tracking has been granted or denied.

"v2" is the version introduced in March 2024. It added two extra signals tied to advertising personalisation. If you run Google Ads against audiences in the EU, UK, Switzerland, or increasingly Australia, you need v2 configured. Without it, remarketing lists stop growing and ad measurement degrades.

This is not a legal article. The compliance rules are set by your jurisdiction and your lawyers. The technical and operational side is well within reach for a non-technical marketer to understand.

The four signals

Consent Mode v2 passes four boolean flags. Each can be granted or denied.

analytics_storage

Controls whether GA4 may store and read cookies. When denied, GA4 still receives pings, but with no cookie, no user ID, and no cross-session stitching. Google then uses modelling to fill the gap.

ad_storage

Controls whether the Google Ads conversion cookie and remarketing cookies can be set. When denied, the conversion still pings Google, but cannot be attributed to a specific user or remarketing list.

ad_user_data (new in v2)

Signals whether user-level data may be sent to Google Ads for measurement. Separate from cookie storage. It is about whether the hashed email or click ID can be shared at all.

ad_personalization (new in v2)

Signals whether the user's data may be used for personalised advertising, including remarketing and Customer Match.

A user who accepts everything grants all four. A user who clicks "reject all" denies all four. The banner vendor (OneTrust, Cookiebot, CookieYes, Iubenda, or a custom one) is responsible for translating the user's choice into these four flags.

Why AU and EU sites cannot skip this

Two reasons.

First, the EU Digital Markets Act requires verifiable user consent before Google Ads can use EEA user data for personalisation. Without Consent Mode v2 signals, Google assumes no consent and stops growing your remarketing audiences in those regions. For an Aussie business selling into Europe, that is a real revenue hit.

Second, the Privacy Act 1988 (Cth) reforms (the second tranche, moving through parliament in 2024 and 2025) are dragging Australian expectations closer to the EU baseline. The Office of the Australian Information Commissioner has been clearer about active consent requirements, and the Notifiable Data Breaches scheme adds teeth where things go wrong. Setting up Consent Mode v2 now is low-regret preparation.

Modelled conversions: what actually happens when users decline

The most misunderstood piece.

When a user denies analytics_storage, GA4 still receives a cookieless ping containing the page URL, the referrer, and a few anonymous bits. Google aggregates these across your property and, using machine learning against the behaviour of consenting users, estimates the conversions and traffic patterns the declined users likely generated.

A site with 60 percent consent rates will see GA4 report close to the full traffic and conversion picture, with declined users filled in via modelling. Without Consent Mode, those users vanish entirely and your reports undercount by 40 percent.

Modelling is not perfect. It requires a minimum traffic volume (roughly 1,000 events per day per ad network) and at least seven days of data. Small sites see less reliable modelling than large ones.

Basic versus advanced implementation

Two flavours, and the difference matters for measurement.

Basic Consent Mode

Tags do not load at all until consent is granted. If the user declines, Google gets nothing. Not even a cookieless ping. Modelled conversions are unavailable. Simpler to implement, worst data picture.

Advanced Consent Mode

Tags load on every page, but behave differently based on signals. If consent is denied, they send cookieless pings. If consent is granted, they operate normally. Modelled conversions are available. This is what Google recommends and what most serious implementations use.

If your agency has configured Basic mode, ask them to upgrade.

What marketers sign off on

You do not need to write JavaScript. You do need to make some decisions.

• Default state before the banner appears. In EU and UK traffic, Google expects denied by default for all four signals. In other regions you can choose granted by default, but most consent managers now default to denied globally for consistency.
• Banner design. Accept and Reject buttons must be equally prominent. A grey "Reject" next to a big green "Accept All" is not valid consent under EU law, and is trending that way under Australian Consumer Law guidance too.
• Granularity. You can offer one toggle (accept all vs reject all) or four separate toggles. One is easier, four is more compliant.
• Region detection. Who sees the banner? Everyone, or only EEA and UK traffic? This is a business decision with legal input.
• Renewal interval. How often does the user get re-asked? Annual is typical.

What the tech team implements

The wiring is straightforward for an engineering team, but it needs to happen in the right order.

• Install a certified consent management platform (CMP) with IAB TCF v2.2 support if you serve Europe.
• Set Consent Mode defaults before GTM loads, in a small inline script in the <head>.
• Configure GTM (or your SST container) to respect the consent signals.
• Mark Google Ads and GA4 tags as "Additional consent required" with the appropriate signals.
• Test in incognito with network throttling. The banner should appear before any tag fires.

Common pitfalls

A few things we see over and over on audits.

• The banner fires after GTM has already loaded. Order matters.
• "Reject all" secretly still fires analytics. This is a compliance failure.
• The old GA property is still running alongside GA4 and ignores consent entirely.
• Consent choice is not persisted across subdomains. Users re-consent every click.

Getting started

At CodeDrips, we treat consent management as a first-class part of any marketing-driven build, not a plugin bolted on at the end. If you are not sure whether your current setup is v2-compliant or leaking data, let's audit it.