Table of contents
Google Consent Mode v2 does one specific job: it tells Google tags how to behave based on a user’s consent choice. It does not show a banner, collect consent, decide what is lawful, or make a website compliant by itself.
That distinction prevents the most common implementation mistake. A consent management platform (CMP) asks the user and records the choice. Consent Mode passes the resulting state to Google Ads and Google Analytics. The tags then change their storage and data-use behavior.
This guide gives a marketing operations team a complete implementation and validation checklist. It follows Google’s current Consent Mode overview, website setup guide, and Tag Assistant troubleshooting guide. Technical details were last checked on August 23, 2026.
The working system in one view
| Layer | What it must do | Owner |
|---|---|---|
| Consent banner or CMP | Show choices, collect the decision, and retain the evidence your policy requires | Legal, privacy, and web teams |
| Consent Mode v2 | Translate the choice into Google consent states | Analytics or tag owner |
| Google tag or GTM | Change tag behavior according to those states | Analytics or tag owner |
| CRM and offline pipeline | Preserve the relevant consent state when permitted data moves off the website | Marketing operations |
| Validation | Prove the default and update states work for every choice and region | Analytics QA |
If one layer is missing, the implementation is incomplete. A CMP installed without consent signals is not Consent Mode. A gtag('consent') command without a real choice source is not consent collection.
What the four consent types mean
Consent Mode v2 added ad_user_data and ad_personalization to the existing storage controls.
| Consent type | What granted permits for Google tags | What denied changes |
|---|---|---|
ad_storage | Advertising-related storage, such as cookies or device identifiers | Advertising storage is not used |
analytics_storage | Analytics-related storage, such as cookies used to measure visits | Analytics storage is not used |
ad_user_data | Sending user data to Google for online advertising | User data such as user_id and enhanced-conversion data is not sent for advertising |
ad_personalization | Personalized advertising use cases | Personalized advertising, including remarketing use, is disabled |
These are separate decisions. Do not map one “Accept marketing” button to all four values unless that mapping matches your banner language and approved policy.
Basic mode versus advanced mode
Google documents two implementation patterns. The right choice depends on your policy and legal advice, not on a marketer’s desire for more modeled conversions.
| Check | Basic consent mode | Advanced consent mode |
|---|---|---|
| When Google tags load | After the user grants consent | On page load with the configured default state |
| Before consent | No data is sent to Google | When storage is denied, measurements without cookies and consent-state signals can be sent |
| If the user denies | Google tags remain blocked | Tags adjust their behavior and do not use denied storage |
| Modeling input | General model | Advertiser-specific signals can support more detailed modeling |
Advanced mode does not mean normal user data is collected regardless of the choice. Google’s documentation says that when storage is denied, consent-aware tags do not store advertising or analytics cookies. They can send measurements without cookies. When ad_user_data or ad_personalization is denied, the corresponding advertising uses are disabled.
Before implementation: write the consent map
Do not start in GTM. First write a small mapping table with the CMP values your site actually emits.
| Banner choice | ad_storage | analytics_storage | ad_user_data | ad_personalization |
|---|---|---|---|---|
| Reject all | denied | denied | denied | denied |
| Analytics only | denied | granted | denied | denied |
| Measurement, no personalization | Your approved value | Your approved value | Your approved value | denied |
| Accept all | granted | granted | granted | granted |
The middle row is intentionally not prescribed. Its correct values depend on what your notice says, what data your tags send, the region, and your organization’s policy. Get the map approved before it becomes code.
Also record:
- The regions where each default applies.
- The CMP event and field that represents each choice.
- Who owns the mapping when the banner changes.
- How revocation is handled after a user changes their preference.
Option 1: set up Consent Mode with Google Tag Manager
Google recommends using a CMP template from the Tag Manager Community Template Gallery when your CMP provides one.
- Confirm that the CMP supports all four Google consent types.
- Add the CMP’s Tag Manager template.
- Use the Consent Initialization - All Pages trigger. It runs before normal Initialization triggers.
- Configure the approved default state and regional rules.
- Map the CMP’s Accept, Reject, and granular choices to consent updates.
- Review each Google and third-party tag’s built-in and additional consent checks.
- Publish only after the validation matrix below passes.
Do not use a normal page-view trigger to set defaults. If a Google tag runs first, the default arrives too late.
Option 2: set up Consent Mode with gtag.js
The default command must run before any Google config command. The following is a conservative example, not a legal recommendation:
<script> window.dataLayer = window.dataLayer || []; function gtag() { dataLayer.push(arguments); }
gtag('consent', 'default', { ad_storage: 'denied', analytics_storage: 'denied', ad_user_data: 'denied', ad_personalization: 'denied' });</script>
<!-- Load the Google tag only after the default command is queued. --><script async src="https://www.googletagmanager.com/gtag/js?id=TAG_ID"></script><script> gtag('js', new Date()); gtag('config', 'TAG_ID');</script>When the user makes a choice, send an update from the CMP callback:
gtag('consent', 'update', { ad_storage: 'granted', analytics_storage: 'granted', ad_user_data: 'granted', ad_personalization: 'granted'});Do not hard-code every update as granted. Use the actual values from the approved consent map. Send the update on the page where the choice occurs. Google warns that updating immediately before a reload can cause the browser to cancel related requests.
If you apply different defaults by region, use Google’s documented ISO 3166-2 region setting. Test the general default and every more-specific regional override.
Option 3: connect consent choices to CustomerLabs
CustomerLabs can receive a consent update, keep it with the customer profile, and use it when configured destination workflows send data. This does not replace your CMP.
For the current product flow:
- In CustomerLabs, open Destinations → Google Adwords → Configuration Settings.
- Turn on Consent Mode Configuration.
- Set the approved default values for
ad_storage,ad_user_data, andad_personalization. - Turn on Client Side Consent Initialization only when your CMP is not already responsible for initializing those flags.
- When the banner choice changes, send the same values to CustomerLabs:
_cl.trackConsent({ ad_storage: 'denied', analytics_storage: 'granted', ad_user_data: 'denied', ad_personalization: 'denied'});- Save the destination configuration and run a test user through every banner choice.
Use the current CustomerLabs Google Ads destination guide for the product screens. If your team also sends CRM stages, store sales, or Customer Match audiences, follow the separate Consent Mode v2 for offline conversions guide. The website setup alone does not prove the offline payload carries the right state.
CustomerLabs’ privacy and consent operations page explains the commercial workflow for keeping consent state attached as data moves between systems.
The validation matrix: test behavior, not just installation
Open a fresh incognito session for each row. Clear site data between tests.
| Test | What to do | Pass condition |
|---|---|---|
| Default order | Open Tag Assistant and load the page without touching the banner | The earliest Consent event contains all four defaults before dependent tags fire |
| Accept all | Accept every purpose | The latest Consent event updates all approved values to granted |
| Reject all | Reject every purpose | The latest Consent event keeps all four values denied |
| Granular choice | Allow analytics but reject advertising | Only the values mapped to that choice change |
| Revocation | Accept, reopen preferences, then reject | A new update reflects the revoked choice |
| Navigation | Make a choice and visit another page | The state remains consistent and does not reset unexpectedly |
| Region | Simulate each configured location | The expected regional default wins |
| Form and CRM | Submit a test lead and move it to a test stage | The downstream workflow follows the approved consent rule |
Google’s Tag Assistant validation instructions specifically recommend checking the earliest event for defaults and the most recent event for updates. That is stronger proof than looking only for gcs or gcd in a network request.
Common failures and the exact fix
The banner works, but Tag Assistant shows no consent events
The CMP may not have Consent Mode enabled, or its event is not mapped to Google’s API. Enable the CMP integration and confirm it runs on Consent Initialization.
Defaults appear after Google tags fire
The trigger or script order is wrong. Move the default command before Google tag configuration, or use GTM’s Consent Initialization trigger.
Accept updates, but Reject does not
The implementation is probably listening only to the accept callback. Map every user action, including granular choices and revocation.
Consent resets during navigation
Check whether the CMP cookie or preference store uses the correct domain, path, and expiry. Then confirm the saved choice is read before tags initialize on the next page.
Advanced mode is described as bypassing consent
Fix the documentation and the expectation. Advanced mode changes tag behavior under denied states; it does not override the user’s choice.
Marketing says the setup is “GDPR compliant”
Replace that claim with the precise statement: the setup communicates consent choices to Google tags. Legal compliance still depends on the notice, lawful basis, records, data processing, regional configuration, and actual behavior.
The handoff your team should keep
Do not close the task with a screenshot of a toggle. Save these five items:
- The approved banner-to-signal map.
- The GTM container version or code release.
- Tag Assistant evidence for Accept, Reject, granular choice, and revocation.
- The list of regions tested.
- The owner and date for the next quarterly validation.
If your team needs help connecting website consent, CRM consent, and Google destination rules into one tested flow, book a CustomerLabs demo. Bring your CMP name, GTM container owner, Google Ads conversion actions, and one sample CRM journey so the session can focus on the real setup.