Marketer testing consent settings on a laptop

Consent Mode v2: What US Advertisers Need to Do

Q: What's the difference between Consent Mode v1 and v2?

Version 2 adds aduserdata and adpersonalization to the original adstorage and analytics_storage, per Google's documentation. Those two give finer control over sending user data for advertising and using it for personalization. If your CMP hasn't been updated to pass all four, you're still effectively on v1.

October 19, 2026

Consent Mode v2 is Google’s way of letting your tags know what each visitor agreed to, so Google Ads and GA4 collect only what that person allowed. Version 2 added two parameters, ad_user_data and ad_personalization, on top of the original ad_storage and analytics_storage. If any of your traffic comes from the EEA or UK, you need it. If all of it comes from Ohio, you probably don’t, and you can stop reading here. Most US advertisers are somewhere in between, and that’s where the expensive mistakes happen.

Here is the version we’d give a client over coffee: what it is, who it applies to, which mode to pick, and how to confirm it works. The last step is the one nearly everybody skips.

Rivetline

rivetline.ai

Make Your Marketing Data Easier to Trust

Rivetline connects Google Business Profile to GA4 and provides live Looker Studio dashboards you can check anytime.

Check your marketing data

TL;DR

Consent Mode v2 applies to Google Ads and GA4 data from users in the EEA and UK. A US-only audience isn’t the target, but a US business with European visitors is.
The four signals are ad_storage, analytics_storage, ad_user_data and ad_personalization. Each is either granted or denied, and the banner has to drive them.
Advanced mode keeps modeling possible for users who decline. Basic mode sends nothing before consent. Pick on purpose, not by default.
A deployed banner proves nothing. Open Tag Assistant and confirm the consent update fires after someone clicks accept.
Modeled conversions aren’t magic. Google Ads conversion modeling needs enough volume to switch on.

What Consent Mode v2 does (and what it doesn’t)
The four parameters, in plain English
Do you actually need it? A US business checklist
Basic vs. advanced: pick one on purpose
Setting it up without breaking your data
How to test it: the step everyone skips
Mistakes we’d bet money on
Our take: consent is a measurement problem, not a legal footnote
Want someone to audit your setup?
FAQ
Sources

A consent management platform (CMP) is the banner. Consent Mode is the plumbing behind it. The banner collects a choice; Consent Mode translates that choice into signals Google’s tags understand, and the tags adjust. Granted means normal behavior. Denied means no cookies for that purpose, and, depending on your mode, either silence or a cookieless ping.

Google’s own help page describes it as a way to communicate cookie or app identifier consent status to Google so tags respect the user’s choice. Notice what’s missing from that sentence: it doesn’t say Consent Mode makes you compliant. It doesn’t. It passes along a decision. If your banner is dishonest, Consent Mode will faithfully pass along a dishonest decision.

One more limit worth stating plainly. Consent Mode governs Google tags. It does not stop your other pixels from firing before consent. One compliance vendor flags this as a commonly overlooked risk, and it matches what we see: teams wire up Google beautifully and leave a Meta pixel firing on page load.

The four parameters, in plain English

Parameter	What it controls	New in v2?
ad_storage	Whether advertising cookies can be written or read	No
analytics_storage	Whether analytics cookies (GA4) can be written or read	No
ad_user_data	Whether user data can be sent to Google for advertising	Yes
ad_personalization	Whether data can be used for personalized ads, like remarketing	Yes

The two new ones are the reason “upgrade to v2” became a to-do item. Google’s documentation on the update lists them as the additional parameters supporting more granular consent. If your CMP still only maps the original two, your Google Ads audiences quietly degrade for the users who matter to the rule.

Do you actually need it? A US business checklist

Start with where your visitors come from, not where your office is. Google’s requirement is tied to its EU user consent policy, and the research we reviewed frames it around data from users in the EEA and UK. One vendor summary says Google began enforcing in July 2025, with non-compliant accounts losing personalized ads and conversion features for that traffic. Check the dates against Google’s current help pages before you quote them to a client or a lawyer.

Then run this:

Open GA4, look at country. If the EEA or UK is a rounding error, you have a low-stakes problem. If it’s 10% of sessions, it’s a real one.
Check your campaign geotargeting. Targeting only the US doesn’t keep Europeans off your site. Ads aimed at Texas still get clicked by a traveler in Lisbon.
Check your remarketing lists. If they include European users, those lists are what shrink first without valid signals.
Ask whether you sell or ship to Europe. If yes, stop debating.

What about California and the other US state privacy laws? Those have their own rules, including opt-out mechanisms, and Consent Mode v2 is not a substitute for reading them. Bring your counsel in on that one. We’re marketers, and we’d rather tell you that than play lawyer.

Basic vs. advanced: pick one on purpose

This is the decision that matters most, and most setups make it by accident because that’s how the CMP template shipped.

Basic mode. Google tags don’t load until the user consents. Before that, nothing goes to Google. If the user declines, you get zero data from that session and nothing to model from. It’s the conservative choice, and for some legal teams, the required one.

Advanced mode. Tags load immediately with denied defaults. If the user declines, they send cookieless pings that carry consent state and basic signals, which Google uses for modeling. Google’s developer docs tell you to check your company’s guidelines to choose a method and set defaults. Translation: this is a legal and marketing decision, not a developer one. Get both in a room.

Basic and Advanced Consent Mode compared

Our opinion, since you asked: if your counsel is comfortable with it, advanced mode is the better measurement choice, because basic mode throws away signal you could have modeled. But “if your counsel is comfortable” is doing real work in that sentence. Don’t flip the switch on a Friday because a blog post told you to. Including this one.

What modeling can and can’t rescue

Modeled conversions are estimates for the users you couldn’t observe. They show up in your Conversions column and flow into reporting, per Google’s modeling page. They have a threshold, though. One implementation guide puts it at 700 ad clicks over seven days for a domain and country grouping. Below that, Google Ads will happily tell you Consent Mode is implemented while modeling sits idle.

So a small account with 90 clicks a week shouldn’t expect modeling to patch the hole. It should expect a smaller hole, because most of its visitors aren’t European anyway. Match your expectations to your volume.

Setting it up without breaking your data

The path depends on your stack, but the logic is the same everywhere. Google’s Tag Manager help page assumes you already have a consent mechanism on your site and want to send consent to Google. That mechanism comes first.

Pick a CMP that supports Google Consent Mode natively. Look for the integration to be listed on Google’s CMP partner page, and make sure it maps all four parameters. A banner that offers only “accept all” is a fig leaf.
Set defaults before any Google tag fires. In the EEA and UK, defaults are typically denied. Elsewhere, you can set region-specific defaults, so your US visitors aren’t buried under a banner they don’t need. Confirm the region logic with whoever owns your legal risk.
Set wait_for_update. This is the unglamorous parameter that causes the most trouble. It tells tags to hold briefly while the CMP loads and restores a returning visitor’s saved choice. Google’s debugging docs treat the timing as central to getting consent state right. A value around 500 ms is a common starting point in examples; if your CMP loads slowly, you’ll tune it. Skip it and tags can fire before the state exists, which is how you get “denied” labels on people who already said yes.
Send the update on user action. When someone clicks accept, reject, or customizes, the CMP must fire the consent update with the right values for all four parameters.
Map categories honestly. “Marketing” in the banner should drive ad_storage, ad_user_data and ad_personalization. “Analytics” drives analytics_storage. If your CMP lumps them together, you lose the granularity v2 exists to provide.
Publish, then test. Not optional. See below.

GA4 specifics

GA4 reads analytics_storage for measurement and the ad signals for its advertising features. Google’s GA4 help page says Analytics may notify you if a linked Google service needs consent and you have EEA-based visitors but aren’t sending affirmative consent for ads measurement. If you see that notice, it’s the system telling you the setup is incomplete. Treat it like a smoke alarm, not a suggestion.

If you’re still building out your conversion events, our GA4 conversion tracking playbook is the right order of operations: get events firing first, then layer consent on top, then test both together.

Google Ads specifics

For Google Ads, the practical effects land in three places: conversion tracking, remarketing audiences, and the modeled conversions that fill gaps. If your reported conversions dropped around the time you changed your banner, don’t assume your ads got worse. Check consent first. If the drop persists after that, this three-step diagnostic covers what to look at next.

Also, if you’re considering moving more tagging to your own server, read our piece on server-side tagging. It helps with data control and page speed. It does not exempt you from consent. Anyone who says it does is selling you something, probably a lawsuit.

How to test it: the step everyone skips

Here is the pattern we see constantly. The CMP is installed. The banner appears. Everyone moves on. Three months later, someone notices that conversions are oddly low and the consent state reads denied on every single hit.

The insight from Consentr’s GA4 guide is the right one: a CMP being deployed isn’t the same as GTM consent settings being mapped to what the user actually did. The result is a false sense of security, with data blocked or mislabeled behind a perfectly nice-looking banner.

Test it like this:

Open your site in an incognito window with Tag Assistant connected.
Check the default consent state on the first event. For an EEA visitor, it should show denied for all four.
Click accept on the banner.
Look at the Summary view and confirm a consent update fires, and that later events show granted where they should.
Repeat with reject, and with a partial choice. Check that each parameter follows the choice.
Reload the page. Confirm the saved choice is restored on load and doesn’t reset to denied.

If the state stays denied across every event after you click accept, your update command is broken, and you’re blinding your own analytics. Fix it before you spend another dollar on traffic.

For a sanity check on the money side, compare conversion counts in Google Ads and GA4 for a week before and after any consent change. They won’t match perfectly. A sudden gap that wasn’t there before is your signal.

Mistakes we’d bet money on

Treating “CMP installed” as “done.” Covered above. It’s the number one failure.
Showing every visitor the same banner. If 98% of your traffic is American, a full-screen European-style wall costs you engagement for no reason. Region-based defaults exist for this.
Setting defaults to granted “to keep the numbers up.” That isn’t a measurement strategy. That’s a liability with a dashboard.
Ignoring non-Google tags. Consent Mode won’t hold back your other pixels. Handle them in your tag manager’s consent controls.
Never checking again. Banners get redesigned, CMPs get updated, site builders get swapped. Retest after every one.

We run Google Ads, Meta Ads and SEO for clients who have outgrown agencies that report in a monthly PDF and shrug when numbers move. Consent setup is where that gap shows up fastest.

Here’s how we see it. Most agencies treat consent as someone else’s job: legal’s, the developer’s, the CMP vendor’s. Meanwhile the budget keeps flowing into campaigns optimizing against data nobody verified. We think that’s lazy, and it’s a waste of ad spend. If the signal feeding smart bidding is broken, the bidding is broken, no matter how clever the creative is.

Our take: consent is a measurement problem, not a legal footnote — overview diagram

So we do three things. We verify consent state in Tag Assistant instead of trusting the vendor’s green checkmark. We connect the data to live Looker Studio dashboards, GA4 and Google Business Profile included, so a sudden conversion drop is visible the day it happens, not at month-end. And we push the advanced-versus-basic decision to the client’s counsel and marketing lead together, in writing, because nobody should discover it by accident.

The agencies that handle this well aren’t the ones with the most elaborate banner. They’re the ones that check.

— Chris Breikss

Want someone to audit your setup?

If your conversions dipped and nobody can say why, we’ll look at the consent layer, the tags and the campaigns in one pass, then run it through live reporting so you can watch the numbers yourself. See how our Google Ads and LSA management works, or look at the live dashboard we use to keep clients out of the dark.

FAQ

It’s required if you use Google Ads or Google Analytics with users in the EEA or UK, under Google’s EU user consent policy. A site with purely US traffic isn’t the intended target. Since a US site can still attract European visitors, check your GA4 country report before deciding it doesn’t apply.

Version 2 adds ad_user_data and ad_personalization to the original ad_storage and analytics_storage, per Google’s documentation. Those two give finer control over sending user data for advertising and using it for personalization. If your CMP hasn’t been updated to pass all four, you’re still effectively on v1.

Use Tag Assistant and check the Summary view. You want to see the default state on page load, then a consent update after the user acts on the banner. If everything stays denied after an accept click, the update call isn’t firing.

Partly, and only if you’re in advanced mode and have enough volume. Google Ads conversion modeling needs about 700 ad clicks over seven days for a domain and country grouping, per one implementation guide. Even then, modeled numbers are estimates and don’t replace observed data.

No. It controls Google tags. Other pixels, such as Meta’s, need their own consent handling in your tag manager or CMP. Check each one in a clean browser session.

Sources

Chris Breikss is the founder of Rivetline, an AI visibility agency based in North Vancouver, BC. He works with B2B companies on the three things that decide whether AI models cite a business or skip it: structured signals, extractable content, and authority. He's also a founding partner at Major Tom, Rivetline's sister agency. Chris writes about what's actually working in AI visibility, tested on client accounts before it shows up here.