Consent Mode v2 and Privacy Compliance

Consent Mode v2 is mandatory for advertising in the EEA and recommended globally. This module covers the four consent signals, the CMP integration, and the validation that confirms compliance.

What you will learn

What Consent Mode is and why it exists
Consent Mode v1 vs v2
The four consent signals: ad_storage, analytics_storage, ad_user_data, ad_personalization
How Consent Mode interacts with cookie banners (CMPs)
Privacy regulations driving Consent Mode v2: EU DMA, GDPR, ePrivacy
Consent Mode behavior with full vs basic configuration
Modeled conversions and what they actually do
Server-side consent enforcement
CMP (Consent Management Platform) selection
Implementation steps
Validation and ongoing monitoring

1. What Consent Mode is

Google Consent Mode is a mechanism for adjusting Google tag behavior based on user consent. When a user does not consent to cookies, Consent Mode lets Google tags continue to fire (sending modeled, non-cookie pings) but disables cookie-based features.

2. v1 vs v2

v1 (2020 - 2024): two signals (ad_storage, analytics_storage).
v2 (2024+): adds ad_user_data and ad_personalization signals; required for advertising in EEA.

3. The four signals

Signal	Controls
ad_storage	Advertising cookies
analytics_storage	Analytics cookies (GA4)
ad_user_data	Sending user data for advertising
ad_personalization	Personalized advertising

4. Cookie banner integration

The CMP (Cookie Management Platform) handles user consent and signals it to Consent Mode. Major CMPs (OneTrust, TrustArc, Cookiebot, Iubenda, Usercentrics, CookieYes) have Consent Mode integrations.

5. Privacy regulations

EU GDPR: requires consent for non-essential cookies.
EU Digital Markets Act (DMA): designated "gatekeepers" must obtain consent for combining data.
ePrivacy Directive: governs cookies specifically.
CCPA / CPRA: requires opt-out mechanism.
Other state laws and global equivalents.

6. Basic vs advanced

Basic Consent Mode: Tags do not fire when consent denied; no pings sent.
Advanced Consent Mode: Tags fire and send cookieless pings; Google uses modeling to estimate conversions.

7. Modeled conversions

Google uses machine learning to model conversions that would have been attributed to consenting users but were not measured due to consent denial. Modeled conversions appear in Google Ads reporting.

8. Server-side enforcement

Server-side containers can enforce consent rules at the server. This is the most robust implementation: consent state passed from CMP to client, sent to server-side container, server filters or modifies tag firing.

9. CMP selection

Considerations:

Geographic coverage (EU, US, global).
Consent Mode v2 native integration.
Server-side support.
IAB TCF support.
Customization (banner design, language).
Audit and reporting.
Cost.

10. Implementation

Select CMP.
Configure consent categories and banner.
Connect CMP to GTM via Consent Mode template.
Test consent signals in preview mode.
Validate with Google's Tag Assistant.
Launch.

11. Validation

Test consent denied state.
Verify cookies do not set without consent.
Verify tags fire with appropriate behavior.
Verify modeled conversions appear in Google Ads.
Monitor for compliance and reporting issues.

How to use this module: The four-signal table (Section 3), the implementation steps (Section 10), and the validation checklist (Section 11) are the planning artifacts.

Sources & further reading

Part of the GTM Server-Side series · RGM Training