Google Consent Mode v2 is a framework that adjusts how Google tags behave based on a visitor’s cookie consent choices. When a visitor declines analytics or advertising cookies, Consent Mode tells Google tags to modify their behaviour: collecting limited, cookieless data instead of dropping all measurement entirely. The result is that businesses retain some level of data collection and conversion measurement even when users do not consent to full tracking.
At Gorilla Marketing, Consent Mode v2 configuration is part of our analytics and tracking setup for UK clients. Getting it right means maintaining data quality for SEO and PPC reporting while meeting privacy obligations. Getting it wrong means either losing significant measurement data or, worse, collecting data without proper consent. This guide covers what Consent Mode v2 does, who needs it and how to implement it correctly.
Why Consent Mode v2 Exists
The EU’s Digital Markets Act (DMA) required Google to change how its advertising and analytics tools handle user consent. Google designated its advertising platform as a “gatekeeper” service under the DMA, which means it must respect user consent signals before processing personal data for advertising purposes.
For UK businesses, the driver is the UK GDPR and the Privacy and Electronic Communications Regulations (PECR). These require informed, specific consent before placing non-essential cookies. Consent Mode v2 provides the mechanism for Google’s tags to respond to those consent decisions dynamically rather than operating on an all-or-nothing basis.
The enforcement has real consequences. In July 2025, Google began hard enforcement of Consent Mode v2 for all EEA/UK traffic. Sites without proper implementation reported 90 to 95% drops in metrics overnight. DMA penalties can reach 10% of global revenue, 20% for repeat violations.
Before Consent Mode, the choice was binary. Either a user consented and received full tracking, or they declined and Google tags collected nothing. Consent Mode introduces a middle ground: adjusted, privacy-preserving measurement that continues to function even when full consent is not given.
The Four Consent Parameters
Consent Mode v2 operates through four consent signals that your consent management platform (CMP) passes to Google tags.
analytics_storage controls whether Google Analytics can use cookies. When denied, GA4 still sends events but without cookies, meaning individual users cannot be identified or tracked across sessions.
ad_storage controls whether advertising cookies (used for conversion tracking and audience building in Google Ads) can be set. When denied, conversion measurement continues using cookieless pings, but individual user-level tracking stops.
ad_user_data controls whether user data can be sent to Google for advertising purposes. This is one of the two new parameters added in v2. When denied, data like email addresses from forms cannot be used for audience matching or enhanced conversions.
ad_personalization controls whether data can be used for ad personalisation, including remarketing. When denied, the user is excluded from remarketing audiences and personalised ad targeting.
The first two parameters existed in Consent Mode v1. The second two are the v2 additions that Google required from March 2024. Without all four parameters being communicated, Google considers consent implementation incomplete.
Basic Mode vs Advanced Mode
This is the most important implementation decision and the one most frequently misunderstood.
Basic mode loads no Google tags until the user makes a consent choice. If they consent, tags load normally. If they decline, no Google tags fire at all. No data is collected from users who decline. This is the more privacy-conservative option and the one that aligns most clearly with a strict reading of UK GDPR.
Advanced mode loads Google tags on page load regardless of consent status. When consent is denied, tags fire in a restricted state: they send cookieless pings with limited data. Google uses these pings for conversion modelling, estimating the conversions that likely occurred among non-consenting users based on patterns from consenting users.
The privacy implication of advanced mode is significant. Even in restricted state, data is being sent to Google’s servers before consent is given. Whether this complies with UK GDPR depends on your interpretation. The Information Commissioner’s Office has not issued specific guidance on Consent Mode, but the general principle under PECR is that non-essential data collection requires prior consent.
The data difference between modes is substantial:
| Basic Mode | Advanced Mode | |
|---|---|---|
| Tags before consent | Blocked entirely | Load in restricted state |
| Data from declining users | Zero | Cookieless pings |
| Conversion modelling | General/aggregate only | Advertiser-specific (more accurate) |
| GA4 behavioural modelling | Not available | Available |
| Setup complexity | Simple (CMP toggle) | Requires GTM configuration |
Google claims advanced mode recovers 70%+ of ad-click-to-conversion journeys through modelling. In practice, advertisers typically see 10 to 30% conversion uplift from modelled data. Combined with enhanced conversions, total recovery reaches 30 to 50% of conversions that would otherwise be invisible.
For businesses prioritising strict compliance, basic mode is the safer choice. For businesses that need conversion modelling data for Google Ads optimisation, advanced mode provides more complete measurement at a higher compliance risk.
Who Needs to Implement Consent Mode v2
Any UK business using Google Ads, GA4 or other Google marketing tools and collecting data from visitors in the EEA or UK needs Consent Mode v2 implemented. Without it, Google restricts advertising features: remarketing audiences, conversion tracking, enhanced conversions and certain reporting features in GA4 are limited or unavailable.
If the business does not run Google Ads and uses GA4 purely for analytics, the urgency is lower. GA4 continues to function without Consent Mode. However, the data will not include modelled conversions or behavioural modelling for non-consenting users.
For businesses running Google Ads, the practical impact of not implementing Consent Mode v2 is measurable: reduced audience sizes, incomplete conversion data and Smart Bidding strategies operating on partial information.
Implementation: Step by Step
Step 1: Ensure a compliant CMP is in place
A consent management platform handles the cookie banner, records user choices and communicates consent signals to tags. The CMP must be a Google-certified CMP that supports Consent Mode v2. Major options include Cookiebot, OneTrust, Iubenda, CookieYes, Complianz and Quantcast.
The CMP must present clear options for accepting or declining different cookie categories, record consent choices, and communicate those choices to Google tags through the Consent Mode API.
Step 2: Configure default consent states
In Google Tag Manager, set default consent states before any tags fire. The recommended default for UK visitors is denied for all four parameters: analytics_storage, ad_storage, ad_user_data and ad_personalization. This is the “denied first” approach that aligns with UK GDPR’s principle of privacy by default.
In GTM, this is configured through a consent initialisation trigger that fires before all other triggers. The CMP plugin or custom tag sets the default denied state, then updates it based on the user’s choice.
Step 3: Configure consent updates
When the user interacts with the cookie banner, the CMP sends updated consent signals. If they accept analytics cookies, analytics_storage updates to granted. If they accept advertising cookies, ad_storage, ad_user_data and ad_personalization update to granted.
These updates must happen in real time. The Google tags then adjust their behaviour immediately: full tracking for granted categories, restricted mode for denied categories.
Step 4: Set region-specific behaviour
Consent Mode supports region-specific defaults. For businesses with both UK and non-regulated traffic (from countries without equivalent privacy laws), different defaults can be set by region. UK and EEA visitors get denied defaults. Other regions can be configured according to local requirements.
Step 5: Verify the implementation
Open the browser’s developer tools and check the network requests being sent to Google. Look for the gcs parameter in requests to google-analytics.com or googleads.g.doubleclick.net. The gcs value encodes the consent states: G111 means all granted, G100 means only analytics granted, G000 means all denied.
In GTM’s Preview mode, verify that consent initialisation fires first, that default states are set correctly and that consent updates trigger when the user makes their choice.
Impact on GA4 Data
Consent Mode changes what GA4 collects from non-consenting visitors.
In advanced mode, GA4 receives cookieless pings from users who decline. These pings include the page URL, timestamp and limited technical data but no client ID or user identifier. GA4 uses this data for behavioural modelling: estimating the actions of non-consenting users based on patterns observed from consenting users.
The result is modelled data appearing alongside observed data in GA4 reports. Traffic numbers, conversion counts and engagement metrics include estimated contributions from non-consenting visitors. Google does not disclose the exact methodology, and the accuracy depends on the consent rate: higher consent rates produce more reliable models.
In basic mode, GA4 collects nothing from non-consenting users. Reports reflect only the consenting population. If the consent rate is 60%, GA4 shows data for roughly 60% of actual visitors. The data is accurate for those users but incomplete overall.
For SEO reporting, this means organic traffic numbers in GA4 are lower than actual organic traffic regardless of which mode is used. The gap depends on the site’s consent rate, which varies by industry and audience but typically ranges from 50 to 80% in the UK.
Impact on Google Ads
The advertising impact is more direct. Without Consent Mode v2, Google restricts several features.
Remarketing audiences cannot be built from non-consenting users. Audience sizes shrink in proportion to consent rates.
Conversion tracking relies on consent for ad_storage and ad_user_data. In advanced mode, Google models conversions from non-consenting users. In basic mode, non-consenting conversions are invisible.
Enhanced conversions require ad_user_data consent. Without it, hashed first-party data from forms cannot be sent to Google for conversion matching.
Smart Bidding performance depends on conversion data volume. Fewer reported conversions mean less signal for automated bidding to optimise against. Consent Mode’s modelled conversions (in advanced mode) partially offset this, but the signal quality is lower than from fully consented tracking.
Common Mistakes
Defaulting to granted. Setting default consent states to granted and only switching to denied when a user declines violates the UK GDPR principle that consent must be given before data collection begins. Always default to denied.
Not implementing all four parameters. Some setups only pass analytics_storage and ad_storage, missing the two v2 parameters. Google treats this as incomplete implementation and may restrict advertising features.
CMP not communicating with GTM. The cookie banner appears and records choices, but the consent signals never reach the Google tags. This happens when the CMP is not properly integrated with GTM or when the consent initialisation trigger is misconfigured.
Not testing across consent scenarios. Test the full flow: new visitor with no choice made, visitor who accepts all, visitor who declines all, and visitor who accepts analytics but declines advertising. Each scenario should produce different tag behaviours.
Forgetting server-side tracking implications. If the business uses server-side tracking, consent signals need to reach the server container too. Client-side consent management does not automatically extend to server-side tag execution.
The Practical Reality for UK Businesses
Consent Mode v2 is not optional for businesses running Google Ads or relying on GA4 for marketing decisions. The question is not whether to implement but how.
For most UK businesses, the recommended approach is basic mode with a well-designed consent banner that achieves a reasonable consent rate. The consent banner’s design, language and positioning have more impact on data collection than the technical implementation. A clear, non-manipulative banner that explains what cookies do and why they matter typically achieves consent rates of 60 to 75%.
The data gap from non-consenting users is real and permanent. No single solution fully closes it. The businesses that adapt best layer multiple approaches: Consent Mode (advanced) for modelled data, enhanced conversions for first-party signal matching, server-side tracking for ad blocker recovery, and direct customer feedback for validation. Each layer recovers a portion. Together they close most of the gap.
Global cookie acceptance rates average around 31%, which means basic mode loses nearly 70% of data for sites with primarily European audiences. GA4 behavioural modelling requires at least 1,000 daily events from users denying analytics_storage AND 1,000 daily consenting users, sustained over 7 of the preceding 28 days. Below those thresholds, modelling doesn’t activate. Google Ads conversion modelling needs a minimum of 700 ad clicks over 7 days per country and domain.
One upcoming change to note: TCF v2.3 migration is required by 28 February 2026. The updated framework adds a mandatory “Disclosed Vendors” segment to consent strings. Strings created after the deadline without this segment default to “Limited Ads,” which could significantly reduce programmatic advertising revenue. If your CMP uses the IAB Transparency and Consent Framework, verify that your provider supports v2.3.
Gorilla Marketing’s analytics and tracking service includes Consent Mode v2 implementation, CMP configuration and ongoing data quality monitoring for UK businesses. Get in touch to discuss your current consent setup and whether it meets both compliance requirements and measurement needs.
