What Is GA4 Consent Mode v2 and Why Does It Matter?

Google’s Consent Mode v2, launched in early 2024, is a mandatory requirement for any website that uses Google Ads or GA4 and serves users in the European Economic Area or United Kingdom. Without Consent Mode v2 implemented correctly, Google’s advertising products—including Google Ads remarketing, conversion tracking, and GA4 audience creation—no longer function for EEA users. Google began enforcing this requirement in March 2024 and has continued tightening enforcement since. If your website serves European traffic and relies on Google Ads, Consent Mode v2 is not optional.

Consent Mode v2 adds two new consent parameters beyond the original Consent Mode: ad_user_data (controls whether user data can be sent to Google for advertising purposes) and ad_personalization (controls whether data can be used for personalized advertising). These join the existing analytics_storage and ad_storage parameters. All four must be correctly configured to meet Google’s requirements and remain compliant with GDPR and the ePrivacy Directive.

How Consent Mode Works with GA4

When a user visits your site and has not yet made a consent decision, Consent Mode puts GA4 and Google Ads tags in a “pending” state—they do not fire fully. Instead, they send cookieless pings to Google that carry minimal data. Google uses these pings along with machine learning to model the behavior of non-consenting users, filling gaps in your conversion data with modeled conversions. This behavioral modeling is what allows Google Ads to continue optimizing campaigns even when consent is denied or not yet given.

When a user grants consent, the tags fire normally with full cookie access and data collection. When a user denies consent, only the cookieless pings continue—no cookies are set, no personal data is collected, and the user’s behavior is estimated through modeling rather than measured directly. This balanced approach lets you remain GDPR-compliant while preserving most of the advertising functionality that depends on measurement data.

Step 1: Choose a Consent Management Platform

To implement Consent Mode v2 via GTM, you need a Consent Management Platform (CMP) that is certified by Google as a Consent Mode v2 compatible partner. Certified CMPs include Cookiebot (Usercentrics), OneTrust, CookieYes, Complianz, and Quantcast Choice, among others. These platforms handle displaying the consent banner to users, storing their consent preferences, and—critically—communicating those preferences to GTM in the format Consent Mode requires.

If you already use a CMP, check whether it supports Consent Mode v2 and whether it has a native GTM integration. Most certified CMPs provide a GTM template in the Google Tag Manager community gallery that handles the Consent Mode integration automatically. Install your CMP, configure it for your consent categories (analytics, marketing, functional), and then install the CMP’s GTM template before proceeding to the GTM configuration steps below.

Step 2: Configure Consent Initialization in GTM

In GTM, Consent Mode v2 requires setting default consent states before any tags fire—including before the GTM container itself loads any tags. This is done through GTM’s built-in Consent Initialization trigger, which fires at the very start of page load before the DOM is ready and before any other tags execute.

Create a new tag in GTM. Under Tag Type, select “Consent Initialization – All Pages” (a built-in tag type, not a custom tag). This tag type fires on the “Consent Initialization” trigger automatically. Inside this tag, use the Google tag consent API to set default states. If you are using a CMP with a GTM template, the CMP template’s tag will handle this for you—you simply need to ensure the CMP tag fires on the Consent Initialization trigger. Verify this in GTM Preview mode: the CMP tag should appear at the very top of the tag firing order, before any GA4 or Google Ads tags.

Step 3: Set Default Consent States

For users in consent-required regions (EEA, UK), the default consent state for all four parameters should be “denied” until the user actively grants consent. This is what GDPR requires—opt-in, not opt-out. For users outside consent-required regions, you can set defaults to “granted” if your privacy policy allows this. Many CMPs allow you to configure region-specific defaults, granting consent by default for US visitors while requiring explicit opt-in for EEA visitors.

To manually set defaults in GTM without a CMP template, create a Custom HTML tag firing on Consent Initialization that calls the gtag consent API:

<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}

// Default: deny all for EEA users, grant for others
gtag('consent', 'default', {
  'ad_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied',
  'analytics_storage': 'denied',
  'wait_for_update': 500,
  'region': ['AT','BE','BG','HR','CY','CZ','DK','EE','FI','FR','DE','GR','HU',
             'IE','IT','LV','LT','LU','MT','NL','PL','PT','RO','SK','SI','ES','SE',
             'IS','LI','NO','GB']
});

// Grant by default outside EEA/UK
gtag('consent', 'default', {
  'ad_storage': 'granted',
  'ad_user_data': 'granted',
  'ad_personalization': 'granted',
  'analytics_storage': 'granted'
});
</script>

Step 4: Update Consent When Users Interact with the Banner

When a user accepts or declines cookies via your consent banner, the CMP must call the gtag consent API with an “update” command to change the consent state from the default. Your CMP’s GTM template handles this automatically when configured correctly. Verify by using GTM Preview: accept cookies on your site and check the dataLayer in the preview pane. You should see a consent_update event with the new consent states reflecting the user’s choice. If using the CookieYes GTM template, for example, it fires a cookieyes-consent-update custom event that triggers the consent update tag.

Step 5: Verify GA4 Tags Respect Consent

In GTM, open each of your GA4 tags (GA4 Configuration tag and all GA4 Event tags) and click on “Consent Settings” in the tag configuration. Ensure “Require additional consent for tag to fire” is enabled, and that analytics_storage is listed as a required consent type. This tells GTM not to fire the GA4 tag with full functionality unless analytics_storage is granted. The tag will still send cookieless pings if analytics_storage is denied—this is Consent Mode’s modeling behavior, not a complete block.

Similarly, check your Google Ads tags: they should require ad_storage, ad_user_data, and ad_personalization. Tags that do not have consent requirements configured will fire regardless of consent state—a compliance failure that Google’s enforcement can detect and that could expose you to GDPR liability.

Step 6: Test with Google’s Consent Mode Debugger

Google provides a Consent Mode debugger via the Tag Assistant Chrome extension. Install Tag Assistant, navigate to your website, and open the Tag Assistant panel. It will show the consent state for each of the four parameters and indicate whether Consent Mode v2 is active. Test three scenarios: arriving on the page before making a consent decision (all parameters should be at their defaults), accepting all cookies (all parameters should switch to “granted”), and declining all cookies (all parameters should remain “denied”). The Tag Assistant debugger will flag any misconfigurations.

Conclusion

Implementing GA4 Consent Mode v2 via GTM is a non-negotiable compliance and performance requirement for any website using Google’s advertising or analytics products with European traffic. The implementation involves choosing a certified CMP, configuring regional default consent states, ensuring tags respect consent requirements, and verifying the setup with Google’s own debugging tools. Done correctly, Consent Mode v2 keeps you GDPR-compliant while allowing Google’s machine learning to model conversion behavior for non-consenting users—preserving most of your campaign optimization capability even in a privacy-first environment.