How to Set Up Consent Mode v2 in Google Tag Manager (and Verify It)

By the Mayab Media Team · Level: Advanced · Time: 1 hour

You add a cookie banner, but Google Ads still shows a consent warning. Or GA4 shows a message that you're not sending consent signals for visitors in the European Economic Area. Or your banner works, yet tags fire before anyone clicks "Accept." All three point to the same thing: your banner and your tags aren't talking through Consent Mode v2.

Consent Mode is Google's way for your site to tell its tags what each visitor allowed. Version 2 uses four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization. The two newer ones tell Google whether user data can be sent for advertising and whether ads can be personalized. Google requires these signals for visitors in the EEA if you want to keep using measurement, remarketing and personalization features with their data.

The setup has three parts. Set a default state before any tag runs. Update it when the visitor makes a choice. Make sure every tag respects the result. Google Tag Manager has built-in tools for all three. This guide covers the GTM side and how to verify it. It isn't legal advice, so confirm the defaults you need with whoever handles privacy for your business.

Quick answer

1. Choose a consent banner (CMP) that supports Consent Mode v2 and has a GTM template.
2. In GTM, turn on Enable consent overview under Admin > Container Settings.
3. Add the CMP's template tag with the Consent Initialization - All Pages trigger and set defaults (usually all four signals denied in regions that need opt-in).
4. Decide on advanced (Google tags load and send cookieless pings) or basic (tags blocked until consent).
5. Review Consent Settings on every tag, adding additional consent checks to non-Google tags.
6. Verify in Tag Assistant: the Consent tab must show On-page Default and On-page Update for all four signals.

Before you start

• Access: Publish permission in GTM. Editor access in GA4 to view consent settings.
• A consent management platform (CMP). Most popular banner tools offer a GTM template in the Community Template Gallery. Check that it lists Consent Mode v2 support.
• Your consent policy. Which regions need opt-in, which tools count as analytics or advertising, and how long choices are stored. Legal or privacy staff should sign off.
• Tag Assistant at tagassistant.google.com.
• Time: about an hour, plus a week before Google shows modeling or consent diagnostics.
• Backup: Export your container (Admin > Export Container) before you start. Any mistake here can stop all tracking.

Basic or advanced?

	Basic consent mode	Advanced consent mode
Before the visitor chooses	Google tags don't load at all	Google tags load with consent denied by default
If the visitor declines	No data is sent to Google	Tags send cookieless pings without cookies
Conversion modeling	Google uses a general model	Advertiser-specific modeling becomes possible
How you build it	Block tags until consent with triggers or consent checks	Let the tags fire and rely on the consent state

Advanced mode gives Google more to work with for modeling. Basic mode sends nothing before consent. Which one fits your business is a policy decision, not a technical one.

Step 1: Turn on consent overview in GTM

This gives you one screen to review the consent setup of every tag.

1. In GTM, click Admin.
2. Click Container Settings.
3. Under Additional Settings, tick Enable consent overview.
4. Click Save.

Figure 1. Turn on consent overview so you can audit every tag's consent settings in one place. Illustration of the screen. Labels can differ slightly in your account.

1. The setting that adds the consent overview to your Tags list.
2. Save. This doesn't change how tags fire.

Step 2: Add the CMP template on Consent Initialization

Your banner must set the default consent state before any other tag runs. GTM has a special trigger for this, Consent Initialization - All Pages. It exists in every web container and fires before everything else, including the Initialization trigger.

1. Go to Templates > Tag Templates > Search Gallery. Find your CMP's template and click Add to workspace.
2. Go to Tags > New and pick that template.
3. Enter your CMP account or site ID.
4. Set the default consent for each signal. For regions where you need opt-in, set all four to denied.
5. If the template offers it, set a wait for update value such as 500 milliseconds. This gives the banner time to read a returning visitor's saved choice.
6. Optional settings many templates include: ads data redaction (hides ad click IDs when ad_storage is denied) and URL passthrough (passes click info in URLs when cookies are denied).
7. Under Triggering, choose Consent Initialization - All Pages.
8. Save the tag.

Figure 2. Defaults per region, a short wait for update, and the Consent Initialization trigger. Illustration of the screen. Labels can differ slightly in your account.

1. Default states. These are example settings, not a recommendation for your business.
2. The trigger must be Consent Initialization - All Pages, never a normal page view.

Region codes use the ISO 3166-2 format. A default without a region applies to everyone else. The more specific region wins.

No template? Set defaults on the page

If your banner has no GTM template, place the default command in the page <head>, above the GTM snippet. Order matters.

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('consent', 'default', {
    'ad_storage': 'denied',
    'analytics_storage': 'denied',
    'ad_user_data': 'denied',
    'ad_personalization': 'denied',
    'wait_for_update': 500
  });
  gtag('set', 'ads_data_redaction', true);
</script>
<!-- Google Tag Manager snippet goes here -->

Your banner then needs to call an update when the visitor chooses. Google says not to call gtag('consent', 'update', ...) from a Custom HTML tag inside GTM. Use a consent template that uses the GTM consent APIs instead.

Step 3: Make sure the banner sends the update

When the visitor clicks Accept, Reject or saves preferences, the CMP must update the four signals. A good template does this for you. It also reapplies the saved choice on every page for returning visitors.

Check the mapping in your CMP settings. Usually:

CMP category	Consent Mode signals
Statistics / Analytics	analytics_storage
Marketing / Advertising	ad_storage, ad_user_data, ad_personalization
Necessary / Functional	functionality_storage, security_storage (optional)

If your CMP only maps ad_storage and analytics_storage, it's a version 1 setup. Update the template or the CMP plan, because the two v2 signals will be missing.

Step 4: Review consent settings on every tag

Open Tags and click the Consent Overview icon at the top of the list. GTM groups your tags by their consent configuration.

• Built-in consent checks. Google tags (the Google tag, GA4 events, Google Ads, Floodlight) know about consent. They adjust their behavior on their own. You don't need to add anything to them for advanced mode.
• Additional consent checks. Use these for tags that don't understand consent, such as social pixels, heatmaps or chat widgets. Set Require additional consent for tag to fire and pick the signal, for example ad_storage. The tag then waits until that signal is granted.

Figure 3. Tags in the Not Configured group need a decision from you. Illustration of the screen. Labels can differ slightly in your account.

1. Non-Google tags with no consent awareness. These fire regardless of the banner unless you act.
2. Select tags and use Edit Consent Settings to add additional checks in bulk.

For a single tag, open it and go to Advanced Settings > Consent Settings. Choose one of Not set, No additional consent required, or Require additional consent for tag to fire.

Figure 4. Third-party ad pixels should wait for ad_storage. Illustration of the screen. Labels can differ slightly in your account.

1. Require consent for tags that don't read Consent Mode.
2. The signal that must be granted. Use analytics_storage for analytics-type tools.

For basic mode, add additional consent checks to the Google tags too. Require analytics_storage on GA4 tags and ad_storage on Google Ads tags. Then they won't load at all until consent is given.

Also check your triggers. Tags should fire on Initialization - All Pages or later, never on Consent Initialization, except the CMP tag itself.

Step 5: Preview and publish

1. Click Preview, enter your URL and connect.
2. In a fresh browser profile (no saved consent), load the site. Don't touch the banner yet.
3. Then accept all. Then repeat in another fresh session and reject all.
4. Check the results as described in the next section.
5. When everything looks right, click Submit, name the version (for example "Consent Mode v2 via CMP template"), and Publish.

How to confirm it's fixed

In Tag Assistant:

1. Select the earliest Consent event in the left list. In the API call, all four signals should be present with your default values.
2. Click a GA4 or Google Ads tag, open the Consent tab. The On-page Default column should show your defaults.
3. After you click Accept, select the newest Consent event. The On-page Update column should show granted.
4. Open the Tags tab to confirm that tags with additional checks stayed blocked before consent.
5. If the Consent tab is empty, Consent Mode isn't set up on that page.

Figure 5. All four signals need a default and, after a choice, an update. Illustration of the screen. Labels can differ slightly in your account.

1. The v2 signals. If ad_user_data or ad_personalization are missing, your CMP integration is incomplete.

In the network requests (optional): Open Chrome DevTools, Network tab, filter for collect. Click a GA4 request and look for gcs and gcd in the payload. Practitioners decode gcs as G1 plus two digits: the first for ad_storage, the second for analytics_storage. So G100 means both denied, G111 both granted. gcd encodes all four signals. Google doesn't document these values officially, so treat them as a debugging aid.

In GA4: Go to Admin > Data collection and modification > Consent settings. GA4 shows whether it receives ad measurement and personalization signals for EEA traffic. Status messages can take 48 to 72 hours to update.

In Google Ads: Consent mode effects on modeled conversions need at least 7 full days of data and enough volume before Google shows them.

Still not working? Common causes

Symptom	Likely cause	Fix
Consent tab empty in Tag Assistant	No default set, or CMP tag not firing	Check the CMP tag fires on Consent Initialization - All Pages
Tag Assistant warns a tag read consent before a default was set	Default set too late (normal page view trigger, async script, or snippet below GTM)	Move defaults to Consent Initialization, or above the GTM snippet
Only ad_storage and analytics_storage appear	CMP or template still on v1	Update the template and map ad_user_data and ad_personalization
Update shows nothing after clicking Accept	CMP category mapping wrong, or update sent on page unload	Fix the mapping. Make sure the update fires right after the click
Third-party pixels fire before consent	No additional consent checks on those tags	Require ad_storage (or the right signal) on each one
GA4 data drops sharply after launch	Expected in opt-in regions in basic mode, or defaults denied for everyone	Use region-specific defaults. Confirm the policy, then consider advanced mode
Returning visitors see the banner state ignored	CMP doesn't reapply saved consent before tags fire	Use wait for update and a template that reads stored consent on load
GA4 still warns about missing signals	Status lag, or EEA traffic still missing v2 signals	Wait 72 hours. Re-test with a simulated EEA location
Consent changes not recorded on single-page apps	Update fired during a route change that unloads the view	Fire the update on the page where the choice happens, right away
Duplicate defaults with different values	Both a template and a hard-coded snippet set defaults	Keep one source of defaults

Testing regional defaults

If you set defaults by region, your own location decides what you see. Use a VPN or Chrome's sensor overrides to test another region, as Google's debugging guide suggests. Check that EEA visitors start as denied and others start with your chosen defaults.

FAQ

Do I need Consent Mode v2 if I have no visitors from Europe?

Google requires it for EEA visitors when you use Google's ad measurement and personalization features. If you have no EEA traffic, it's not mandatory for that reason, but other privacy laws may still require a banner. Check with your privacy adviser.

Is Consent Mode the same as a cookie banner?

No. The banner collects the choice. Consent Mode passes that choice to Google tags. You need both.

Does advanced mode break privacy rules?

Google says tags send cookieless pings with limited data when consent is denied. Whether that fits your obligations is a legal question. Some businesses choose basic mode for that reason.

Do GA4 event tags need additional consent checks?

Not in advanced mode. Google tags have built-in consent checks. In basic mode, add analytics_storage as an additional check so they don't load before consent.

Will this affect my conversion tracking?

Yes, some conversions from visitors who decline won't be observed directly. Google may model part of them once you meet data thresholds. Review Google Ads conversion tracking and enhanced conversions after you launch, and re-check your GTM install if tags stop firing.

Stuck on this one? We fix these for clients every week. Book a free audit

Sources

• developers.google.com: /tag-platform/security/guides/consent
• developers.google.com: /tag-platform/security/guides/consent-debugging
• support.google.com: /tagmanager/answer/10718549
• support.google.com: /google-ads/answer/10000067
• support.google.com: /analytics/answer/14275483
• simoahava.com: /analytics/consent-mode-v2-google-tags