If your site serves Google Ads, Google Analytics (GA4) and Floodlight tags and attracts any traffic from the EEA or UK, you will no longer be able to avoid the new regulatory requirements. Google's latest privacy-focused initiative, namely Consent Mode v2, is now the default choice for advertisers who care to continue remarketing and measuring activity across the EEA and UK. In short, Consent Mode is a communication layer between your CMP (Consent Management Platform) or cookie banner and Google's first-party tags, which allow Google to act upon the signals it receives from your CMP without you having to update each tag's logic and behaviour.
As of now, using Consent Mode v2 has been the recommended default choice for any advertiser with a website, which uses Google tags and serves any traffic from the EEA and UK. Google has actively encouraged advertisers to adopt this practice in mid-2025, and then has announced another transition in mid-2026, when Google Signals will cease to exist and ad_storage will be the only parameter which controls advertising-related processing in linked GA4 accounts.
The most challenging part about the transition which has been taking place since early 2024 is that there are no obvious signs of failure. Your site will not appear broken, and none of your tracking or remarketing tags will stop working. However, some of your remarketing audiences may begin to drain silently and stop being available as soon as their size drops below a threshold. Some of your conversion events may begin to show up as invalid, while some campaigns will stop running altogether if they become dependent on audiences which have stopped updating. A CMP which appears to collect all necessary consents and categories may fail to pass them to Google tags in a way they expect.
What's the Difference Between Consent Mode V1 And V2?
| Aspect | Consent Mode V1 | Consent Mode V2 |
|---|---|---|
| Consent Parameter | 2 Signals: ad_storage, analytics Storage | 4 Signals: ad_user_data And ad_personalization |
| What It Covers | Basic Cookie Storage On/Off For Ads & Analytics | Cookie storage along with the possibility of user details being sent to Google for the purpose of advertisement personalization. |
| Advertising granularity | There is no separation between "measure" and "personalized" in this case. | Enhanced conversion tracking and remarketing/advertising can be controlled separately. |
| Compliance Status | The function has been discontinued in Google advertising. | The function has become mandatory starting from March 2024 for EEA/UK advertisers and reinforced as of mid-2025. |
| Impact of partial implementation | There has been no impact until now. | If the banner states that v1 parameters have been set, v2 checks will not go through, although everything might seem okay on the surface. |
| Google Product Impact If Missing | Reduced Measurement | Remarketing, conversion tracking, Demand Gen, and Customer Match audiences degrade or stop functioning |
Consent Mode V1 relied on two signals (ad_storage, analytics_storage) for handling basic Ads and Analytics cookies. The more advanced version, V2, introduces ad_user_data and ad_personalization, which provides even more control over the data utilization. This means that a banner adjusted only with V1 parameters looks perfect, but suffers from compliance issues with the V2 version.
What types of consent are available in Consent Mode?
Consent Mode v2 consists of four different parameters, each having granted or denied value, which are:
- analytics_storage responsible for determining if the site owner uses cookies in Google Analytics and collects session information and user data.
- ad_storage responsible for determining if the Google Ads cookies can be used, which influences the conversion tracking and creation of remarketing lists.
- ad_user_data responsible for determining if the user data may be delivered to Google for advertisement use, including enhanced conversions.
- ad_personalization responsible for determining if the said data may be used to personalize advertisements, create remarketing audiences, etc.
In case of visitors from EEA and the UK, it is expected that all four would be set to deny by default until an action is taken by the visitor. This default denying approach is the basis of the whole system because if any of the values are automatically set to granted and became denied later due to the rejection, the event was already counted before consent, which means that the concept of consent becomes irrelevant.
Apart from the four criteria, Consent Mode provides two options for operation:
- Basic Consent Mode there is no action taken by Google tags until the user responds to the banner. No data is shared, not even in an anonymous way, until a decision is made. The advantage of this choice is its sensible applicability from the perspective of privacy.
- Advanced Consent Mode this variant sends messages to Google right away, although no consent has been given. A "ping" message does not contain cookies or private information, but with its help, Google is able to analyze how many users, who disregarded the request to give consent, act. Even if some information can be sent from the website before a decision is reached, Advanced mode still provides more snippets of valuable information.
Why Consent Mode V2 Matters?
There are several specific reasons why it should receive serious consideration instead of being treated hurriedly.
It's a requirement from Google products rather than a legality issue. The regulation itself does not even identify Consent Mode as part of its language meaning that a party can comply with it while ignoring consent mode altogether. The only thing lost while doing this, however, is access to advertising and measurement features of Google's products when dealing with traffic from EEA/UK. Basically, Google is enforcing its own rules independently from what the law demands.
The effects of abandoning Consent Mode are gradual rather than immediate. Noticing a direct penalty for not implementing Consent Mode is impossible. Instead, Google is no longer collecting any remarketing and measurement data on the visitors. After some time, audience size decreases, attribution becomes less accurate, and individual types of campaigns stop running because the required number of audience has become insufficient in accordance with Google's requirements.
Getting rid of legal risks may not occur automatically since Google has been dealt with. Regulatory bodies do not stop tracking GDPR compliance just because Consent Mode has been implemented. GDPR breaches may lead to penalties reaching millions of euros and significant shares of revenues in the case of serious violations. Besides that, EU authorities are also paying close attention to "dark pattern" designs that manipulate consumers into rejecting cookies.
Either way, the data quality is going down. Even with the Advanced Consent Mode working, websites with very low traffic levels may not create enough neutral data for Google's models to offer reliable estimates. In this case, the model should be treated as an advisory measure rather than a precise one.
Key Feature Of Consent Mode V2?
| Feature | What It Does |
|---|---|
| Four-Signal Framework | Offers more granular instructions by using analytics storage, ad storage, ad user data, and ad personalization cookies instead of a single toggle. |
| Default-denied Behaviour | Tags are initially denied based on the user's region before being granted or rejected based on their answer to the banner. |
| Basic Consent Mode | No tags fire before the user interacts with the banner |
| Advanced Consent Mode | Fires tags immediately and transmits information to Google in the form of cookieless pings when consent is denied. |
| Conversion & Behaviour Modelling | Tags can estimate conversions and behaviors for users who have not consented if there is sufficient data from users who have consented. |
| Cross-Product Coverage | GA4, Google Ads, and Floodlight tags read the same four signals, so a single implementation can support multiple Google tags. |
| Google-Specific Scope | Only Google tags, tags for other platforms like Meta, TikTok, or LinkedIn are not affected. |
| CMP-Driven Signalling | CMP will automatically interpret the intent of a user's interaction with the banner and assign the appropriate values to the parameters, no additional implementation is necessary. |
Overall, this functionality allows you to go beyond mere compliance: With Consent Mode v2, Google and your CMP work based on the exact consent each user granted you on an individual basis. The choice between basic and advanced mode is the only possible trade-off: Everything else concerns passing on the right consent signals to the corresponding Google tag before it gets fired.
How To Implement Consent Mode V2?
The right implementation usually follows this pattern:
- The default state must be set first, before any other tag fires, on your site: you must declare default values for all four parameters (all denied by default for EEA/UK visitors). This default state must load before your GA4, Google Ads, or GTM container tags, and not alongside or after them. One of the most common implementation errors is incorrect ordering of tags.
- Your banner's consent categories should be wired up to the signal, so that when a user clicks through, it will update the relevant parameters in real time, instead of just updating what's shown on the page.
- An interaction should update the consent state sent to Google, which decides whether tags fire fully, modelled, or not at all.
- You must deliberately choose between Basic or Advanced mode. It's not a technical detail to leave to chance: it's a business choice about how much data transmission you're willing to sacrifice before obtaining consent, and how much measurement you're able to recover afterwards.
- You should double-check that your tags are firing in the right order in production, as described. A common mistake is for tags to fire before consent has been initialised, which renders the whole setup ineffective, despite appearing to work correctly.
Using a CMP designed for use with Consent Mode rather than rolling your own solves most of these problems, by moving the complexity of signal-passing to the CMP: you only need to define your categories so that they're mapped to the right parameters and updates are sent to Google in response to user interaction. Prior-script blocking is what holds the tags until that first signal arrives, and a region rule engine is what applies the default-denied state to EEA and UK visitors specifically.
Learn More - Consentx Vs One Trust
How to Test Consent Mode V2?
Once live, don't assume it's working - test it!
- Check the browser console/network tab first, before making any consent decisions. Confirm before any Google Ads / Analytics cookies are being set that Gtag('consent', ...) is not setting any default true values for EEA/UK sessions.
- Use GTM Preview or Google Tag Assistant to step through the tag firing and confirm that consent initialization fires before any other tags, and that subsequent tags actually respect the consent state, rather than always firing regardless of the user's choice.
- Test all consent paths. Accept all, reject all, and any custom selections your banner allows. Check what values for ad_storage, analytics_storage, ad_user_data, and Check GA4's built in Consent Mode diagnostics show up for each. GA4 surfaces when valid consent signals are being received, and whether statistical modelling is currently active for the region, which is a good way to spot a broken implementation without needing to dig into network requests.
- Periodically re-test your implementation, especially after any tag or CMP changes. A new marketing tag, GTM container update, or banner redesign can break the firing order without anyone noticing. Checking it more than once, and not just right after launch, will help spot regressions that could silently affect your measurement for weeks or even months.
If you want a quick outside-in check of what fires before a visitor chooses, the free cookie scanner lists every tag and cookie that loads on first paint.
Conclusion
Consent Mode v2 isn't a defense against a potential fine. It's a safeguard of the Google self-regulation framework for its own advertising platform. The four correct signals, the default of denied, the initialization of consent before everything else - these are the ways to both remain compliant and keep campaign performance stable. The other way leads to audiences shrinking, conversions becoming noisy, and active campaigns dying for no obvious reason - and not a penny of your money will be wasted on a penalty, yet there'll be no one to blame but yourself. With Google Signals being retired in mid-2026, this is the perfect time to prepare instead of wasting time until the deadline approaches.
Ready to get compliant without the manual setup? Try ConsentX free and get your Consent Mode v2 signals right in minutes.