Quick answer: To set up Google Consent Mode v2 in GTM, use a consent banner (CMP), set all four signals (ad_storage, analytics_storage, ad_user_data, ad_personalization) to denied by default on the Consent Initialization trigger with wait_for_update at 500 ms, update them when the visitor chooses, set consent requirements on non-Google tags, and test in the Tag Assistant Consent tab. Use Advanced mode if you want conversion modeling.
If you run Google Ads or GA4 for visitors in Europe or the UK, a missing or broken consent setup quietly reduces your conversion data, audiences and bidding signals. This guide covers the setup in 9 steps. Allow about 90 minutes. This is a technical guide, not legal advice.
In this guide: Basic vs Advanced | 9 steps | Common mistakes | What it changes in your data | FAQ
Basic vs Advanced: choose first
| Basic | Advanced | |
|---|---|---|
| Google tags before consent | Blocked | Load with denied defaults |
| Data from non-consenting users | None | Cookieless pings, no cookies set |
| Conversion modeling | General, not advertiser-specific | Advertiser-specific modeling possible |
| GTM setting | Require additional consent for tag to fire | Default (Not set) |
| Best for | Strictest privacy position | Most advertisers who want modeled conversions |
Most guides recommend Advanced for advertisers. Some privacy teams prefer Basic, because whether cookieless pings fit strict privacy readings is still debated, so decide this with whoever owns compliance at your company.
The 9-step setup
Step 1: Confirm where Consent Mode applies
Google requires the v2 signals for advertisers using measurement, personalisation or remarketing for users in the EEA, UK and Switzerland. Rules for the USA and Canada depend on state and provincial privacy laws, so check them with a qualified adviser. Also remember that Consent Mode only relays consent to Google tags. It does not collect consent or block other scripts, so you still need a consent banner or CMP. Google also expects a Google-certified CMP for publishers serving personalised ads.
Step 2: Choose Basic or Advanced
Use the table above. For modeling, advertiser-specific conversion modeling needs Advanced mode and enough volume. One guide cites 700 ad clicks over 7 days per country, and GA4 behavioural modeling has its own thresholds, so smaller sites may not qualify even in Advanced mode. Check Google's current documentation for exact numbers.
Step 3: Turn on Consent Overview in GTM
In Google Tag Manager go to Admin > Container settings and enable Enable consent overview. This adds a shield icon to tags so you can see which consent each tag needs.
Step 4: Set the default consent state first
- Add your CMP's GTM template tag (or a consent default tag) and fire it on the Consent Initialization - All Pages trigger.
- Set all four signals to denied for opt-in regions: ad_storage, analytics_storage, ad_user_data, ad_personalization.
- Set wait_for_update to about 500 milliseconds so an asynchronous CMP can restore a returning visitor's saved choice before tags fire.
The default must run before any Google tag, config or event call. Otherwise the first hit can go out without a consent state.
Step 5: Add region-specific defaults
You can apply different defaults by location using ISO 3166-2 region codes, and the most specific match wins. For example, you can set denied for EEA countries and a different default for a US state. Use GB for the United Kingdom, because "UK" is not a valid code. Decide the region list with your compliance owner.
Step 6: Map CMP categories to the four signals
| CMP category | Consent signals |
|---|---|
| Marketing / advertising | ad_storage, ad_user_data, ad_personalization |
| Statistics / analytics | analytics_storage |
Confirm the mapping in your CMP settings. A common error is sending only the older two signals, which leaves Google Ads features limited for EEA users.
Step 7: Set consent requirements on tags
- Google tags (GA4, Google Ads, Floodlight) read the consent state automatically.
- Non-Google tags (Meta, TikTok, LinkedIn, Taboola, Outbrain) do not. Open each tag, go to Advanced settings > Consent settings, choose Require additional consent for tag to fire, and add the signals it needs (usually ad_storage and ad_user_data).
If you use server-side GTM, Google tags in the server container pick up consent automatically, but third-party tags still need consent passed and checked explicitly.
Step 8: Update consent on every user choice
When a visitor makes a choice, push an update for all signals, on accept and on reject. Store the choice and have your CMP re-apply it on return visits inside the wait_for_update window. Do not send a blanket "granted" update on every page load.
Step 9: Test defaults, updates and network parameters
- Open GTM Preview and select the Consent tab. Signals should show denied on the first event and granted after you accept.
- Reload and confirm the saved choice is restored for returning visitors.
- In the browser Network tab, find GA4 requests and read the gcs parameter. A value of G111 means all four signals are granted. If you see something like G100 after accepting, the update is missing or late.
- In GA4, check Admin > Data collection > Consent settings to confirm the v2 signals are being received (menu names change, so use the search bar).
- Test the reject path as well as the accept path, and test partial consent.
Common mistakes
| Mistake | Result | Fix |
|---|---|---|
| Default loads after Google tags | Tags fire in granted mode or with no state | Use the Consent Initialization trigger |
| Only two older signals sent | EEA Google Ads features degraded | Send all four, including ad_user_data and ad_personalization |
| wait_for_update is 0 | Returning visitors recorded as denied | Set about 500 ms |
| Update only on accept | Reject choices not recorded | Send an update on reject too |
| Update fires on every page load | Wrong consent state | Fire it on user choice and restore saved state only |
| Claiming Advanced but gtag blocked | No pings, no modeling | Let tags load with denied defaults |
| Invalid region code (UK) | Region default ignored | Use GB |
| Meta and other tags ungated | Non-Google tags fire without consent | Add additional consent checks per tag |
What Consent Mode changes in your data
- Remarketing: EEA users without ad_personalization consent are not added to audiences, so lists stop growing and members age out.
- Customer Match: EEA records collected without ad_user_data consent cannot be used, so segments come back smaller.
- Conversion modeling: needs Advanced mode and enough volume. It cannot run in Basic mode.
- Smart Bidding: optimises on whatever data arrives and does not warn you that data is missing, so a consent bug can quietly change performance.
- Numbers: expect GA4 and ad platform numbers to differ more. See why GA4, Meta and Google Ads numbers do not match.
If conversions look low after a consent change, also work through the Google Ads conversion tracking checklist.
Frequently asked questions
What is the difference between Basic and Advanced Consent Mode?
In Basic mode Google tags are blocked until the visitor consents and no data is sent before that. In Advanced mode tags load with denied defaults and send cookieless pings when consent is refused, which can support conversion modeling.
What are the four Consent Mode v2 signals?
They are ad_storage, analytics_storage, ad_user_data and ad_personalization. The last two were added in version 2.
Do I need Consent Mode for visitors from the USA or Canada?
Google's requirement applies to users in the EEA, UK and Switzerland. Rules for the USA and Canada depend on state and provincial privacy laws, so check them with a qualified adviser. Region-specific defaults let you apply different settings by location.
Does a consent banner replace Consent Mode?
No. The banner collects the choice and Consent Mode passes it to Google tags. Consent Mode does not collect consent or block non-Google scripts, so you need both.
Why does my consent state show granted before the user clicks?
The default consent command is probably loading after the Google tags. It must run first, on the Consent Initialization trigger, before any Google tag or config call.
Final thoughts
Get the order right: default denied first, then the visitor's choice, then tags that respect it. Test both accept and reject, and re-test after every banner, theme or GTM change. A correct setup protects your data quality, not just your compliance position.
Using a specific consent banner (Cookiebot, CookieYes, Usercentrics or another)? Tell me which one in the comments and I will cover its GTM template step by step.