By Daniel de Almeida Afonso · Last updated: October 20, 2026
Google Consent Mode is a Google tag setting that passes your visitors' cookie choices to Google's tags, so the tags change what they store and send. It uses four main signals (ad_storage, analytics_storage, ad_user_data and ad_personalization), it comes in a basic and an advanced mode, and Google asks advertisers to send these signals for EEA traffic. It is not a consent banner and it does not make a site compliant by itself.
As of October 20, 2026, two things are new. Since June 15, 2026, Google says Consent Mode in Google Ads is the single control for data from Analytics tags used with ads. Google has also said that ad personalization and IP address changes will follow later in 2026, with dates still to be shared. This guide is general information, not legal advice.
What does Google Consent Mode do?
Google's documentation describes Consent Mode as taking your visitors' choices from your banner or widget and adapting how Google tags behave. Your banner or consent management platform (CMP) collects the choice. Consent Mode only carries it to Google's tags.
When consent is granted, tags work as normal. When it is denied, tags stop using cookies or device identifiers for that purpose. In advanced mode they can still send limited cookieless pings that Google uses for modeling.
Consent Mode is not an "anonymous tracking" switch. Google's own pages say pings can include a user agent, screen resolution and IP address. It also no longer involves Universal Analytics, which stopped processing standard properties on July 1, 2023, with 360 properties following on July 1, 2024. And "v2" is not a future event: it has been the Google requirement for EEA advertisers since 2024.
What are the consent types?
Google's developer documentation lists seven consent types:
| Signal | What it controls, in Google's words |
|---|---|
| ad_storage | Storage such as cookies or device identifiers related to advertising |
| analytics_storage | Storage related to analytics, for example visit duration |
| ad_user_data | Consent for sending user data to Google for online advertising purposes |
| ad_personalization | Consent for personalized advertising |
| functionality_storage | Storage that supports site or app functionality, for example language settings |
| personalization_storage | Storage related to personalization, for example video recommendations |
| security_storage | Storage related to security, such as authentication and fraud prevention |
ad_user_data and ad_personalization were added in the November 2023 update, which is what people call Consent Mode v2.
What happens when each one is denied, according to Google's consent reference:
- ad_storage denied: no new advertising cookies are written and first-party ad cookies are not read. Google Signals stops accumulating data for that traffic, and IP addresses are truncated.
- ad_user_data denied: personal data is not used for online advertising. This includes user_id and user-provided data, and it limits click-ID-based conversion export such as Analytics-based bidding in Google Ads.
- ad_personalization denied: personalized advertising is off, and remarketing in Google Ads, Display & Video 360 and Search Ads 360 receives no data.
- analytics_storage denied: Analytics cookies are not read or written, and cookieless pings go to Google Analytics for modeling.
Google also states that both ad_user_data and ad_personalization must be granted to enable personalized advertising.
What changed for the EEA, UK and Switzerland?
Google's help page on the EEA update says advertisers must collect consent from EEA end users and share the consent signals with Google if they want to keep using measurement, ad personalization and remarketing. Google's Ads documentation dates the consent requirements for features such as Customer Match to March 2024. Its developer guide says Consent Mode was updated in November 2023. If you send no signals, Google's page warns you will lose ads personalization capabilities.
The policy behind this is Google's EU User Consent Policy, which covers end users in the EEA, the UK and Switzerland. It asks operators to obtain consent where legally required, to keep records of consent and to give users clear instructions for revoking it.
Two limits apply. The EEA update page does not mention the UK or Switzerland, so the UK position rests on the policy text and your own legal advice. And Consent Mode is a Google platform requirement, not a law: it does not decide whether your consent is valid under the GDPR or PECR. Our Consent Mode v2 compliance guide covers the legal angle.
What is the difference between basic and advanced mode?
Both modes use the same four signals. They differ in when Google tags load and what Google receives before consent.
| Basic mode | Advanced mode | |
|---|---|---|
| Tag loading | Google tags are blocked until the visitor uses the banner | Google tags load when the page opens, with defaults set to denied unless you configure otherwise |
| Data before consent | None. If the visitor does not consent, nothing is sent, not even the consent status | Cookieless pings with consent state and coarse information |
| Data after consent | Full measurement data | Full measurement data |
| Conversion modeling (Ads) | A general, less detailed model | An advertiser-specific model |
| GA4 behavioral modeling | Not eligible, because tags must load before the banner | Eligible if thresholds are met |
Choose basic if nothing should reach Google before consent and you accept the data gaps. Choose advanced if you need modeled reporting and your counsel is comfortable with cookieless pings before consent. Our GA4 GDPR compliance guide discusses how regulators have viewed this.
What are cookieless pings?
Google describes three kinds: consent state pings, key event pings and Google Analytics pings. They carry coarse information, such as a random number generated on each page load and a Boolean consent state, and Google says they feed behavioral and conversion modeling.
How do you set up Consent Mode with gtag.js?
Order matters. Google's guide says to call the default command on every page before any config or event command, and warns that if consent code runs out of order, the defaults will not work.
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('consent', 'default', {
'ad_storage': 'denied',
'ad_user_data': 'denied',
'ad_personalization': 'denied',
'analytics_storage': 'denied',
'wait_for_update': 500
});When the visitor makes a choice, send an update and store the choice so later pages can set it right away:
gtag('consent', 'update', {
'ad_storage': 'granted',
'ad_user_data': 'granted',
'ad_personalization': 'granted',
'analytics_storage': 'granted'
});How do regional defaults work?
Add a region array of ISO 3166-2 codes to a default command. A default with no region applies to every visitor not covered by a regional default, and the more specific region wins.
gtag('consent', 'default', {
'ad_storage': 'denied',
'ad_user_data': 'denied',
'ad_personalization': 'denied',
'analytics_storage': 'denied',
'region': ['ES', 'FR', 'DE']
});Include every EEA country you serve, plus the UK and Switzerland if you apply the same standard there. What to grant by default elsewhere is a legal choice for each market.
What does wait_for_update do?
It tells tags how long to wait, in milliseconds, for a consent update before they send data. Google's examples use 500. Use it when your CMP loads asynchronously.
What are url_passthrough and ads_data_redaction?
Both are set with the set command, and Google says to place url_passthrough before any config command.
gtag('set', 'url_passthrough', true);
gtag('set', 'ads_data_redaction', true);- ads_data_redaction: when ad_storage is denied, it redacts ad click identifiers in network requests from Google Ads and Floodlight tags, and routes requests through a domain without third-party cookies. It has no effect when ad_storage is granted.
- url_passthrough: it can append gclid, dclid, gclsrc, _gl and wbraid to links to your own domain, so click information survives across pages without cookies.
How do you set it up in Google Tag Manager?
For GTM, Google recommends using a CMP, or a consent mode template built with the Tag Manager consent APIs or taken from the Community Template Gallery. Do not use gtag('consent', 'update', ...) in a GTM setup. Google notes that gtag commands are queued and may not be processed before the next event.
In a template, the equivalent calls are setDefaultConsentState and updateConsentState:
const setDefaultConsentState = require('setDefaultConsentState');
const updateConsentState = require('updateConsentState');
setDefaultConsentState({
'ad_storage': 'denied',
'ad_user_data': 'denied',
'ad_personalization': 'denied',
'analytics_storage': 'denied',
'wait_for_update': 500
});
// Later, when the visitor chooses:
updateConsentState({
'ad_storage': 'granted',
'ad_user_data': 'granted',
'ad_personalization': 'granted',
'analytics_storage': 'granted'
});Fire the consent template on the Consent Initialization trigger, so defaults are set before other tags run. The template needs the "Accesses consent state" permission with write access for each type.
GTM has two layers of consent checks:
- Built-in checks: Google Ads, Google Analytics and Floodlight tags already adjust their behavior to consent signals.
- Additional checks: for other tags, open Advanced Settings and choose "Require additional consent for tag to fire." The tag then fires only if every listed consent type is granted.
The Consent Overview page, enabled in container settings, shows which tags have consent configured.
How does modeling fill the gaps?
Google uses two separate models, with different rules.
Behavioral modeling in GA4. Google's Analytics Help lists these requirements:
- Consent Mode on all pages and screens, with Google tags loading in all cases (the advanced implementation).
- At least 1,000 events per day with analytics_storage denied for at least 7 days.
- At least 1,000 daily users sending events with analytics_storage granted on at least 7 of the previous 28 days.
Meeting the thresholds does not guarantee eligibility. Modeling switches on automatically, and you see it by selecting the Blended reporting identity. It does not apply to audiences, retention reports, predictive metrics or data export such as BigQuery. Google also says that with the IAB TCF, Google Analytics properties cannot model data to fill in missing information.
Conversion modeling in Google Ads. Google's modeling page requires a correct Consent Mode (or TCF) implementation and a daily ad click threshold of 700 ad clicks over a 7 day period, per country and domain grouping. A separate Google page on improving modeling quotes 100 clicks per day for basic mode instead. We could not reconcile the two figures, so check the current Google page for your account. After at least 7 full days of implementation, Google Ads can show consent mode impact results once data meets its minimum thresholds.
What changed in June 2026?
Google's Analytics Help page, "Updates to Google Analytics Data Controls," says the following. In summary, Google's page says:
- From June 15, 2026: Google Analytics transitions to using Consent Mode within Google Ads as the single control for the data. Users' privacy selections, managed through Ads Consent Mode settings, will govern how that data is handled. From the same date, the Google Signals setting and API only control whether Analytics data is associated with signed-in user information for behavioral reporting.
- Later in 2026: Google will update how Analytics data is managed for ads personalization. The ad_personalization setting will then exclusively control whether that data is used for personalization in your Ads account.
- IP addresses: automatically collected IP addresses will be encrypted and flow to your linked Google Ads account, where Google Ads settings and terms govern them. Google says dates for the personalization and IP address changes will be shared later this year, and we did not find dates published as of October 20, 2026.
Check what your ad_storage and ad_personalization defaults and updates actually send, because they now matter for Analytics data used with ads. Our post on the June 2026 Consent Mode change walks through what to check. Where its headline wording is stronger than Google's page, follow Google's page.
Do you need a Google-certified CMP?
It depends on whether you are a publisher or an advertiser.
- Publishers: Google says that since January 16, 2024, publishers and developers using AdSense, Ad Manager or AdMob must use a Google-certified CMP integrated with the IAB Transparency and Consent Framework (TCF) when serving personalized ads in the EEA and UK. The same applies to Switzerland from July 31, 2024. Traffic from a non-certified CMP can still be eligible for non-personalized or limited ads. Google's Ad Manager page also notes the IAB's February 28, 2026 deadline for TCF v2.3.
- Advertisers: Google's Ads help recommends a CMP or CMS to collect consent and send it to Google, but does not describe a certified CMP as a requirement. If you build your own banner, you integrate with Google's consent API yourself.
See our guide to the new publisher consent requirements for the publisher side, and our piece on server-side Consent Mode for GA4 if you send events from a server container.
What goes wrong most often?
- Defaults set too late. A tag that fires before the default command behaves as if no consent system exists.
- No update on later pages. Store the visitor's choice and set it again at the start of each page, with wait_for_update if your CMP is slow.
- Update sent during a page unload. Requests can be cancelled if the update is logged as the page unloads. Send it earlier.
- Only two of the four signals. For EEA traffic, send ad_user_data and ad_personalization as well. Google says conflicting allow_ad_personalization_signals and ad_personalization values disable personalization.
- No test. Check each consent state in GTM preview or Tag Assistant, and use the Google Ads conversion diagnostics tab to confirm detection.
For deeper debugging, see our article on Consent Mode conversion data loss.
What should you do now?
- Choose basic or advanced and write the reasoning down, including your legal sign-off.
- Set defaults for all four signals before any tag fires, with regional defaults for the EEA, UK and Switzerland.
- Wire your CMP to send updates on every choice change and to restore saved choices on each page.
- Check Ads and Analytics settings against the June 2026 change, and re-check when Google publishes the later dates.
- Test in Tag Assistant and the conversion diagnostics tab, then recheck after any banner or tag change.
Secure Privacy is a consent management platform. Its banner can block cookies until consent is given, and it keeps consent logs, which supports steps 3 and 5.
Frequently asked questions
What is Google Consent Mode?
Google Consent Mode is a way of telling Google tags what your visitor has agreed to. Your banner or CMP collects the choice, and Consent Mode passes it to tags so they change what they store and send.
Is Google Consent Mode v2 mandatory?
It is a Google requirement, not a law. Google says advertisers must collect consent from EEA users and share the signals with Google to keep using measurement, ad personalization and remarketing. Without them, you lose ads personalization capabilities.
What is the difference between basic and advanced Consent Mode?
In basic mode, Google tags do not load until the visitor uses the banner, so nothing reaches Google before consent. In advanced mode, tags load with denied defaults and send cookieless pings, and Google uses them for modeling.
Which consent signals do I need to send?
Send ad_storage, analytics_storage, ad_user_data and ad_personalization. The last two were added in November 2023, and Google asks for them on EEA traffic. functionality_storage, personalization_storage and security_storage are optional.
Do I need a Google-certified CMP?
Publishers using AdSense, Ad Manager or AdMob must use a Google-certified, TCF-integrated CMP for personalized ads in the EEA and UK. For advertisers, Google recommends a CMP but does not describe certification as a requirement.
What changed with Consent Mode and Google Analytics in June 2026?
From June 15, 2026, Google says Consent Mode within Google Ads becomes the single control for Analytics data used with ads, and Google Signals only governs association with signed-in user information. Personalization and IP address changes are due later in 2026.
Does Consent Mode work with Universal Analytics?
No. Universal Analytics stopped processing standard properties on July 1, 2023, and 360 properties on July 1, 2024. Consent Mode applies to GA4 and the other current Google tags.
Can I use Consent Mode without Google Tag Manager?
Yes. Call gtag('consent', 'default', ...) and gtag('consent', 'update', ...) directly, with the default command before any config or event command.
