Google Consent Mode v2

Google's mechanism for signalling user consent states from a Consent Management Platform (CMP) to Google's advertising and measurement tools (GA4, Google Ads, Google Marketing Platform). Introduced March 2024 in response to the EU Digital Markets Act (DMA), v2 added two new downstream consent parameters on top of the original v1 signals, extending Google's ability to model behaviour from users who decline tracking rather than simply dropping them from measurement.

Firewall: every claim is what a source reports. See ../../CONTEXT.md Rule 1.

---

Background and regulatory driver

Consent Mode v1 existed before 2024 as a voluntary mechanism. The upgrade to v2 was driven by Google's designation as a DMA "gatekeeper" by the EU in fall 2023, placing it under heightened obligations effective March 2024 for EEA and UK traffic. (Gunnar Griese, gunnargriese.com, 2024-01-30)

---

The four consent signals

Consent Mode v2 operates across four parameters. The split between upstream and downstream is technically significant. (Simo Ahava, simoahava.com, 2024-01-16)

Signal	Version	Type	Controls
ad_storage	v1	Upstream	Whether advertising cookies/identifiers are sent with pings
analytics_storage	v1	Upstream	Whether analytics cookies/identifiers are sent with pings
ad_user_data	v2	Downstream	Whether Google may process user data for advertising purposes
ad_personalization	v2	Downstream	Whether Google may use data for remarketing/personalisation

Upstream signals (ad_storage, analytics_storage) control which identifiers are physically sent in tag pings. Downstream signals (ad_user_data, ad_personalization) are instructions to Google's services on how to process data it receives. (Simo Ahava, simoahava.com, 2024-01-16)

Denying ad_user_data blocks Enhanced Conversions from being processed in Google Ads and GA4, and stops GA4 conversion exports to the Google Marketing Platform. Denying ad_personalization prevents users from entering any Google remarketing lists and blocks personalised advertising via GMP tools. (Gunnar Griese, gunnargriese.com, 2024-01-30)

---

Basic vs Advanced mode

Consent Mode v2 is typically described as operating in two implementation modes, though Simo Ahava notes that "Basic Consent Mode" is not a distinct technical switch in Google's products — it is simply the configuration where the implementer blocks Google tags from firing on denied consent states. (Simo Ahava, simoahava.com, 2024-01-16)

Basic mode

• Google tags are fully blocked from loading until a user interacts with the consent banner (GlowMetrics, 2025-06-10)
• No data — including cookieless pings — is sent to Google before consent is granted
• Enables only generalised (non-advertiser-specific) conversion modelling in Google Ads
• Enables no behavioural modelling in GA4

Advanced mode

• Google tags load immediately on page load, even before a user interacts with the consent banner
• When a user denies consent, cookieless pings are sent: regular event/hit requests to Google's servers that carry no cookie values but do carry behavioural signals (page views, click patterns, session signals)
• Enables advertiser-specific conversion modelling in Google Ads (calibrated from the site's own cookieless pings)
• Enables behavioural modelling in GA4 (fills in estimated behaviour for non-consenting users)
• Carries contested legal risk — see Contradictions below

Note: GA4 in Advanced mode automatically reprocesses hits collected during a denied-consent session on the same page once consent is later granted. Hits from previous pages are not reprocessed, because Google cannot link them without cookie identifiers. (Simo Ahava, simoahava.com, 2024-01-16)

---

Behavioral and conversion modelling thresholds

Modelling does not activate below minimum traffic thresholds. (as-of 2025-06-10)

Product	Threshold
Google Ads conversion modelling	≥ 700 ad clicks/day consistently over 7 days, per country and domain grouping
GA4 behavioural modelling	≥ 1,000 events/day with analytics_storage='denied' AND ≥ 1,000 users/day with analytics_storage='granted', for at least 7 of the last 28 days

Sources: Google Ads Help (support.google.com/google-ads/answer/10548233); GlowMetrics, 2025-06-10. (as-of 2025-06-10)

Google states that consented users are typically 2–5× more likely to convert than unconsented users, meaning that a 50% consent rate does not translate to a 50% conversion drop. Google gives an example of a 50% consent rate producing only a 19% drop in observed conversions, with an 18% modelling uplift recovering the rest. (Google Ads Help, as-of 2026)

Google states that "cookieless pings are never used to track individual users across apps or websites, build remarketing lists, or generate user profiles." (Google Ads Help, support.google.com/google-ads/answer/10548233)

---

Enforcement timeline

Date	Event
6 March 2024	Consent Mode v2 mandatory for all advertisers targeting EEA + UK (Gunnar Griese, 2024-01-30; PPC News Feed, 2025-04-23)
31 July 2024	Extended to Switzerland (PPC News Feed, updated 2026-01-20)
28 Feb 2026	TCF v2.3 migration deadline (relevant to CMPs used with Consent Mode — see IAB TCF)
15 June 2026	Google changing how GA4 and Google Ads consent controls interact — Advanced mode users advised to verify modelling status after this date (DarwinApps, 2026-05-21)

The enforcement applies regardless of where the company is headquartered — it applies to any company worldwide with EEA users. (Gunnar Griese, gunnargriese.com, 2024-01-30)

Without Consent Mode v2 (post-March 2024):

• Audience lists with EEA users cannot be built (GA4 for audiences, remarketing in Google Ads, Floodlight)
• Ad personalisation features are unavailable
• Non-personalised ads based on aggregated data can still be served (Usercentrics, 2024-01-19)
• Enforcement was reported as "soft and gradual" post-deadline — conversion data degraded over weeks rather than cutting off immediately (r/PPC, ~155 upvotes, 2024-04)

Important distinction: The March 2024 deadline was a Google Ads platform deadline, not a GDPR regulator deadline. Non-compliance means Google loses conversion signal — there is no DPA fine for GCM v2 non-compliance specifically. (r/PPC, ~210 upvotes, 2024-02)

---

GCM v2 and GDPR compliance — a critical distinction

A widespread practitioner misconception is that implementing GCM v2 makes a site GDPR-compliant. This is incorrect: GCM v2 signals consent state to Google's tools, but it operates at a different layer from GDPR obligations. Sites still require a valid lawful basis under GDPR for any personal data processing, which must be established through a compliant Consent Management Platform (CMP) separate from — not via — GCM v2 itself. (r/gdpr, ~175 upvotes, 2024-01)

---

CMP certification and Google's Partner Program

Google requires publishers and developers serving ads in the EEA and UK to use a Google-certified CMP integrating with the IAB TCF. Google maintains a live CMP Partner Program registry at cmppartnerprogram.withgoogle.com. (as-of 2026)

Certified CMPs include: CookieYes, Usercentrics/Cookiebot, OneTrust, Didomi, TrustArc, Consentmanager, CookieHub, Secure Privacy. (Google CMP Partner Program, as-of 2026-03-05)

When using a Google-certified CMP, updates to the Consent Mode API are automated — implementers do not need to manually re-implement when Google releases new API versions. (Google Ads Help, support.google.com/google-ads/answer/13695607)

CMP selection trade-offs (practitioner reports, 2024):

• OneTrust — most expensive and over-engineered for mid-market; setup 3 days minimum with professional services; adds 300–800ms to page load (r/analytics, ~188 upvotes; r/webdev, ~220 upvotes, 2024-03) (as-of 2024)
• Cookiebot — easiest GTM integration via native community template; default banner design yields 30–40% opt-in rates; default Decline button placement creates legal pressure from clients (r/TagManager, ~94 upvotes, 2024-03) (as-of 2024)
• Usercentrics — preferred for programmatic control and server-side tagging; full JavaScript API for querying consent states server-side; integrates more cleanly with sGTM (r/TagManager, ~77 upvotes, 2024-03) (as-of 2024)

---

Implementation pitfalls

Practitioners document the following high-frequency failure modes:

1. Tag firing order (race condition). The consent initialisation signal must fire before any other GTM tags on page load. If the CMP script loads asynchronously and consent hasn't resolved before GA4 fires, the tag reads an undefined consent state and behaves as if consent was granted. GTM's Consent Initialization trigger (firing on gtm.init_consent) must be used for setting consent defaults. (DarwinApps, Sergey Kisly, 2026-05-21; r/TagManager, ~72 upvotes, 2024-03)

2. Scripts in HTML bypass GTM entirely. GTM controls tags inside its container only. Scripts embedded directly in page HTML (theme files, plugins, hard-coded <script> tags) fire regardless of CMP configuration. A Facebook Pixel in a theme footer, a chat widget in a plugin — GTM has no control over these. (DarwinApps, 2026-05-21)

3. GA4 "(not set)" attribution. When session_start and page_view events fail to fire during the consent transition, GA4 shows "(not set)" for traffic source in reports. (DarwinApps, 2026-05-21)

4. Shopify banner conflict. Shopify's built-in cookie banner (added 2023) conflicts with third-party CMPs when layered on top, producing two banners or conflicting consent signals. Reported as a multi-day resolution project with limited documentation. (r/TagManager, ~88 upvotes, 2024-03) (as-of 2024)

5. CMP agency upsells. Small business owners report £800/year CMP implementations when free WordPress plugins that correctly implement GCM v2 are available. (r/ecommerce, ~135 upvotes, 2024-03)

---

Ecommerce impact

Consent decline rates: EU consent decline rates typically run 30–60% for European traffic, meaning remarketing audiences built under consent restrictions shrink significantly — a warm audience of 10,000 can shrink to 3,000–4,000. (DarwinApps citing cometly.com, 2026-05-21) (as-of 2026-05-21)

GA4 data-driven attribution: Requires a minimum of 3,000 conversions in 30 days with good-quality data. Once consent-based data loss kicks in, accounts below that threshold fall back to last-click attribution — smaller clients lose their best attribution model exactly when they need it most. (r/GoogleAnalytics, ~112 upvotes, 2024-02)

GA4 data blending: GA4 blends modelled and observed data without clearly labelling which is which in standard reports. There is no way to filter out modelled data in the GA4 UI. BigQuery raw exports do not currently provide modelled-vs-observed flags at the event level (gap — not confirmed). (r/GoogleAnalytics, ~143 upvotes, 2024-03)

Basic mode traffic drops: Implementing GCM v2 in Basic mode caused reported drops of 40% in GA4 sessions/users overnight for some sites, as non-consenters and banner-ignorers become invisible. (r/GoogleAnalytics, ~198 upvotes, 2024-03)

The measurement maturity gap: GCM v2 widens the gap between large and small advertisers. Large brands with first-party data, server-side stacks, and CRM integration barely feel the impact. Small advertisers operating without those resources are operating on modelled guesswork with no way to validate. (r/PPC, ~189 upvotes, 2024-03)

DTC brands with high email capture are insulated. A client capturing emails at 60% of checkouts barely notices consent mode impact via Enhanced Conversions; a competitor with no email capture loses 40% of conversion visibility. (r/digitalmarketing, ~121 upvotes, 2024-02)

---

Complementary measurement approaches

Practitioners document these approaches to reduce consent-induced data loss: (as-of 2024)

• Enhanced Conversions — hash first-party data (email, phone) client-side and send to Google. Operates without cookies via Google's identity graph. Described as the "80/20 solution" — "ECv2 is the real fix. Consent mode just keeps the machine alive; enhanced conversions actually feeds it real signal." (r/PPC, ~176 upvotes, 2024-03)
• Server-Side Tagging (sGTM) — moves tag execution server-side; sets first-party cookies with longer lifespans; browser extensions cannot intercept. "sGTM doesn't bypass consent — you still need it — but it dramatically reduces data loss from ad blockers and ITP." (r/analytics, ~201 upvotes, 2024-02)
• Offline conversion imports — if a GCLID is stored in CRM, conversions can be imported regardless of website consent state. Captures logged-in purchasers with no reliance on modelling. (r/analytics, ~88 upvotes, 2024-03)
• Consent-aware data layers — capture anonymous event data (product views, add-to-carts, funnel steps) in a server-side database independent of Google's consent signals; GA4 gets consent-gated data, internal reporting uses the full unconstrained set. (r/TagManager, ~105 upvotes, 2024-03)
• Consent-exempt analytics (Plausible, Matomo) — collect no personal data so no consent banner is required for analytics, giving 100% accurate session counts. Some practitioners have abandoned GA4 for analytics purposes while retaining Google Ads. (r/analytics, ~162 upvotes, 2023-12)

---

Technical reference

The gcd URL parameter encodes all four consent signals in every Google hit, even when Consent Mode is not active. The gcs parameter covers only ad_storage and analytics_storage. (Simo Ahava, simoahava.com, 2024-01-16)

Regional consent defaults support ISO 3166-2 region codes — country-level (FR, DE) and state-level (US-CA) — with more specific regions automatically overriding broader rules. This allows consent defaults to vary by jurisdiction within a single implementation. (DarwinApps, 2026-05-21) (as-of 2026-05-21)

Consent Mode extends beyond web: The Google Ads API now requires a Consent object for data uploads associated with call conversions, click conversions, Customer Match, and Store Sales. (Gunnar Griese, gunnargriese.com, 2024-01-30)

---

Contradictions

---

Key terms

Term	Meaning
Cookieless pings	Event/hit requests sent to Google's servers without cookie values; fired in Advanced mode when consent is denied; the raw material for conversion and behavioral modelling
ad_user_data	New v2 signal; downstream instruction to Google not to process user data for advertising
ad_personalization	New v2 signal; downstream instruction to Google not to use data for remarketing
Basic mode	Implementation where Google tags are fully blocked until consent is granted; no cookieless pings
Advanced mode	Implementation where tags fire on page load; cookieless pings sent for non-consenters; legal grey area
Behavioral modelling	GA4 feature estimating what non-consenting users would have done, based on patterns from consenting users
Conversion modelling	Google Ads feature estimating conversions from non-consenting users who saw or clicked ads
Google CMP Partner Program	Google's certification programme for CMPs; required for publishers/developers serving ads in EEA/UK

---

Gaps (open research questions)

• Independent accuracy audit of Google's modelling: no third-party study confirmed comparing modelled vs CRM-verified conversions at scale
• GA4 BigQuery export: whether raw exports provide modelled-vs-observed flags at event level not confirmed
• Regulatory enforcement specifics: no documented DPA investigations specifically into GCM v2 implementations found
• Consent opt-in rates by ecommerce vertical: no aggregated benchmark by sector (fashion vs electronics vs grocery) found
• GCM v2 and Performance Max specifically: most practitioner coverage focuses on Search campaigns
• Non-EEA markets: discussion almost entirely EU/GDPR-centric; UK ICO, US CCPA, and APAC treatment largely absent
• June 15, 2026 platform change: DarwinApps (2026-05-21) references this change but specifics not further confirmed

References

1. ~245 upvotes, 2024-03; — www.reddit.com/r/PPC/comments/1b4mc7q
2. ~228 upvotes, 2024-03; — www.reddit.com/r/PPC/comments/1b4uj7p
3. ~167 upvotes, 2024-03; — www.reddit.com/r/PPC/comments/1b5hx4y