Google consent mode v2: what it does, and what it leaves to you

Google consent mode v2 is a setting for Google’s tags. It tells Google Analytics and Google Ads what a visitor said to your cookie banner, so the tags change what they do. There’s no banner in it, and no legal answer either.

If you run a small site with Analytics on it, a plugin or an agency has probably told you to “upgrade to v2”. This guide covers what the setting does, the difference between basic and advanced mode, what the UK and EU rules still ask of you, and how to tell from your own phone whether your tags wait for the click.

What Google consent mode v2 is

Consent mode is a short piece of code that runs alongside Google’s tags. Your banner records a choice. Consent mode passes that choice to Google, and the tags adjust. Google’s Ads help page describes it as a way to pass your users’ consent status to Google so that its tags adjust their behaviour.

The “v2” dates from late 2023. Google’s developer guide says consent mode was updated in November, 2023 and now contains two additional parameters. The original two were ad_storage and analytics_storage. The two new ones are ad_user_data, which covers sending advertising-related data about a user to Google, and ad_personalization, which covers personalised advertising such as remarketing. Four switches, each set to granted or denied.

Code order matters too. The default command has to run on every page before any command that sends data. Google’s guide is blunt about it: The order of the code here is vital. If your consent code is called out of order, consent defaults won’t work.

Basic vs advanced consent mode

Google documents two ways to set it up, and the difference matters for a consent rule.

In basic mode, Google’s tags stay blocked until the visitor interacts with the banner. Google’s concepts page says: No data is sent before a user consents - not even the default consent status. If the visitor declines, nothing goes to Google at all. Conversion modelling in Ads then falls back on what Google calls a general model.

In advanced mode, the tags load straight away. In Google’s words, Google tags load when a user opens the website or app, with consent set to denied unless you set your own defaults. While it’s denied, consent state and measurements without cookies are sent. Google calls these cookieless pings. For Analytics, a denied analytics_storage means the tag will not read or write first-party analytics cookies, but in advanced mode it still sends events that Google describes as containing coarse dimensions. Google’s page lists what they can carry: user agent, screen resolution and the IP address, which Google says it does not store or log. Those pings feed Google’s modelling, and advanced mode gets an advertiser-specific model instead of a general one.

So the two modes come down to this:

• Basic: silence from Google’s tags until the click.
• Advanced: no cookies until the click, but a request to Google on every page view either way, and modelled numbers to fill the gaps.

What consent mode does for the consent rules, and what it doesn’t

Here’s what it does. It makes Google’s tags act on the choice your banner recorded. It stops analytics and advertising cookies when the answer is no. It gives you one place to honour a reject and a later change of mind inside the tag itself, instead of in a dozen scripts.

Here’s what it doesn’t do. It doesn’t ask the question. It doesn’t decide whether your banner is valid, whether Reject is as easy as Accept, or whether your wording names the purposes. Google says whose job that is: You are responsible for obtaining users’ consent on your website or app. Google’s own EU user consent policy asks sites with visitors in the EEA, the UK and Switzerland to obtain consent for cookies or local storage where legally required, to obtain it for personal data used to personalise ads, and to retain records of the consent given.

Then there’s the open question: the cookieless ping. In advanced mode a request leaves the visitor’s phone for Google before the banner is answered. I couldn’t find a published regulator decision that rules on that ping either way. What regulators have said is that the UK rule turns on storing or gaining access to information on the device, and the GDPR on personal data, and that consent comes before processing. Whether a ping with an IP address in transit needs consent is a question for your adviser. What a scan can observe is simpler: whether a request to Google left the page before the click, and the report records that as what it saw.

What the UK and EU rules ask of the banner itself

The ICO finalised its guidance on storage and access technologies on 29 April 2026. On loading things early, it’s a one-word answer followed by the rule: No. You must not pre-enable non-exempt storage and access technologies. It goes on: Unless the technology meets one of the exceptions, you must seek consent before you use storage and access technologies. A banner that treats continued browsing as a yes doesn’t count: This does not represent valid consent, even if the mechanism also includes an ‘OK’ or ‘Accept’ button. Those three lines come from the chapter on how to comply with the PECR rules.

Analytics has its own trap. There is an exception for statistical purposes, but the ICO says it does not allow you to monitor or track individual visitors to your service, and it does not apply to purposes related to online advertising. Google Analytics gives each visitor an identifier and follows them across pages, so it sits outside the exception. A change of mind has to work too: visitors should be able to withdraw their consent with the same ease that they gave it, and once they have, the guidance says to stop using them and make sure what was already set can be removed.

The EU side says the same in its own words. The EDPB’s guidelines on consent state that scrolling or swiping through a page will not under any circumstances satisfy the requirement of a clear and affirmative action (paragraph 86), and that consent should be given prior to the processing activity (paragraph 90).

The pattern regulators keep finding is the one consent mode is built to prevent, if it’s wired up. In September 2025 the CNIL fined the operator of shein.com €150 million. It found advertising cookies placed on visitors’ devices as soon as they arrived on the site, and that after a refusal new cookies were still placed and others, already present, continued to be read. The decision doesn’t mention Google’s tags. The two findings are the two things a tag with consent mode in basic mode cannot do.

Google Tag Manager consent mode: where the settings live

If your tags run through Google Tag Manager, consent mode lives in two places. Each tag has consent settings under Advanced Settings, with three options: “Not set”, “No additional consent required” and “Require additional consent for tag to fire”. Google’s tags already adjust to the four consent types on their own. A non-Google tag in the same container, a chat widget or a social pixel, only waits if you set “Require additional consent” on it.

The second place is the Consent Overview page, which Google says provides a high level view of all the consent settings across the tags in your container. It sorts tags into “Consent Not Configured” and “Consent Configured”. There’s also a Consent Initialization trigger that fires before anything else, which is where the default command belongs. None of it takes effect until you publish the container.

To see what actually happens on a page, Google’s Tag Assistant has a Consent tab. Google’s troubleshooting guide says the tab is empty when consent mode is not implemented on the page. When it isn’t empty, the On-page Default column shows what the tags assumed before the click, and the On-page Update column shows what changed after it. Tag Assistant needs a laptop.

Check whether your tags wait for the click

You don’t need a tool for this. Use your phone, because that’s where most of your visitors are.

1. Open a private window. If you’ve ever clicked Accept on your own site, the stored choice will make every later check lie to you.
2. Load your homepage and don’t touch the banner. Tap the padlock or site information icon, then the cookies or site data entry. Note which domains already hold data. Anything from google-analytics.com, googletagmanager.com, doubleclick.net or google.com at this point loaded before a choice was made.
3. Tap Reject, then reload the page. Open the same list. It shouldn’t have grown. If it has, the reject isn’t reaching the tags.
4. Tap Accept this time, then find the way back to change your mind. It should take as little effort as saying yes did. Withdraw, reload, and check the list once more.
5. Read your banner as a stranger. Does it name analytics and advertising as purposes? Is Reject on the first screen, at the same size as Accept?
6. Open your privacy notice and search for “Analytics”. Does it name Google, say what the data is for, and say how long it’s kept?
7. If you have a laptop nearby, open Tag Assistant’s Consent tab. Empty means consent mode isn’t on the page. A default of denied with tags firing on load means advanced mode. Nothing from Google until the click means basic.

If step 2 shows Google data before any choice, you’re either on advanced mode or consent mode isn’t there at all. The Consent tab in step 7 tells you which. For what each of those cookies is, the companion piece on types of website cookies walks through the names. For where Analytics data goes once it’s collected, see Google Analytics and the GDPR.

Peeky reads the public pages of your site. For tags that fire before the click, the checks are EU-01 and EU-02 in the Handbook, and UK-04 for tracking that carries on after a visitor changes their mind.

Questions people ask

Does consent mode v2 replace a cookie banner?

No. Consent mode reads the choice your banner records and passes it to Google's tags. Google's own page says you are responsible for obtaining users' consent on your website. The banner, its wording and the waiting are still yours.

What's the difference between basic and advanced consent mode?

In basic mode Google's tags are blocked until the visitor answers the banner, and no data is sent before a user consents, not even the default consent status. In advanced mode the tags load on every page with consent set to denied, and send measurements without cookies until the visitor says yes.

Does Google Analytics use cookies when consent is denied?

Google says that when analytics_storage is denied the tag will not read or write first-party analytics cookies. In advanced mode it still sends what Google calls cookieless pings, events with coarse dimensions such as user agent and screen resolution.

Can I switch consent mode off?

It's a setting in your tag or your Tag Manager container, so yes. Without it, Google's tags behave the way they always did: they set cookies as soon as they load. The ICO's guidance says you must not pre-enable non-exempt storage and access technologies, so a tag that loads early needs something else holding it back.

Do analytics cookies need consent in the UK?

Usually. The ICO's exception for statistical purposes is narrow: it does not allow you to monitor or track individual visitors and does not apply to online advertising. Google Analytics assigns each visitor an identifier, so it sits outside that exception.