What is Google Consent Mode v2?

The four consent signals

Each signal is either granted or denied. The site sets a default before the visitor chooses, normally denied in Europe, and updates it when the visitor makes a choice in the consent banner.

• ad_storage. Whether advertising cookies may be stored.
• analytics_storage. Whether analytics cookies, such as visit duration, may be stored.
• ad_user_data. Whether user data may be sent to Google for advertising. Added in v2.
• ad_personalization. Whether data may be used for personalised advertising and remarketing. Added in v2.

Why version 2 matters

From March 2024, Google began relying on the two new signals for users in the European Economic Area. Without ad_user_data and ad_personalization set to granted, features such as remarketing audiences and Customer Match stop including EEA users, and conversion measurement loses data. Google applies the same requirement to the UK and Switzerland.

Consent Mode does not collect consent itself: the consent banner does, and Consent Mode only carries the result to Google. So the banner still has to meet the GDPR and ePrivacy rules on its own.

Basic and advanced implementations

In a basic implementation, Google’s tags do not load at all until the visitor consents. Nothing is sent before a choice, and nothing is sent after a refusal.

In an advanced implementation, the tags load straight away with the signals set to denied. They store no cookies, but send cookieless pings that Google uses to model the conversions and visits it cannot observe. Advanced gives better modelled data; basic sends less. Which one fits is a privacy decision as much as a marketing one, so record it with the reasoning.

Related terms

Consent management platform (CMP)

Software that asks visitors for consent before a website stores cookies or shares their data, records each choice, and makes the site’s tags respect it. The usual way to meet the GDPR and ePrivacy consent rules.

Cookie consent

A visitor’s permission for a website to store or read cookies and similar trackers on their device. Required in the EU and the UK before any cookie that is not strictly necessary.

Data subject access request (DSAR)

A person’s request for a copy of the personal data an organisation holds about them and how it is used. Under the GDPR it must be answered within one month, normally free of charge.

Sub-processor

A third party that processes personal data on behalf of a processor. Under GDPR a processor needs the controller’s authorisation to use one and must tell it about changes.