Google Consent Mode v2: What Changed and What to Check

Most Google Consent Mode v2 guides still describe it as a compliance checkbox for European traffic. That framing is out of date. Since 15 June 2026, Consent Mode decides whether your advertising data gets collected at all, which makes a misconfigured banner a measurement problem rather than just a legal one.

This guide covers what actually changed, the four signals Google requires, and how to check your own setup is doing what you think it is.

Quick Summary

Google Consent Mode v2 is the system that passes a visitor's cookie banner choices to Google tags so those tags change behavior to match. Version 2 added two signals, ad_user_data and ad_personalization, on top of the original ad_storage and analytics_storage. It signals consent, it does not block trackers by itself.

• Four signals are required in v2: ad_storage, analytics_storage, ad_user_data and ad_personalization. Sending only the original two is an incomplete setup.
• Since 15 June 2026, Consent Mode is the single control over whether Google Analytics data is collected and used for advertising. Google Signals no longer gates it.
• Basic mode blocks tags until the visitor chooses. Advanced mode loads them in a restricted state and sends cookieless pings, which is what feeds conversion modeling.
• ad_user_data is required for measurement including enhanced conversions and the conversion tracking that runs through the tag, so denying it affects reporting, not just personalization.
• The policy covers the EEA, the UK and Switzerland, and applies to advertisers serving those users regardless of where the business itself sits.
• Google states it may limit or suspend your use of the product, or terminate the agreement, where the consent policy is not met.

The four consent mode signals and what each one governs.

Not sure whether your own setup is passing all four? Talk to Seller Splash about a tracking audit.

What Is Google Consent Mode v2?

Google Consent Mode v2 is a tagging framework that communicates each visitor's consent choices to Google tags, so the tags adjust what they store and send. It sits between your consent banner and your Google tags. It does not display a banner and it does not stop third-party scripts from firing on its own.

That last point is where most misunderstanding starts. Consent Mode signals a decision. Something else has to enforce it. A consent management platform collects the choice, Consent Mode relays it, and your tag configuration acts on it.

Version 2 is not a separate product from version 1. It is the same mechanism with two additional signals, introduced so advertisers can state separately whether user data may be sent to Google and whether ads may be personalized.

What Changed on 15 June 2026?

On 15 June 2026, Google Analytics moved to using Consent Mode in Google Ads as the single control over whether data is collected and used. Google's own documentation describes the transition to Consent Mode as the single control for data, which means the privacy choices captured through Consent Mode now govern collection and use directly.

The practical consequence is the part worth acting on. The Google Signals setting and the Google Signals API now only control linking Analytics data to signed-in user information for behavioral reporting. Collection of Google Ads cookies and identifiers no longer depends on Google Signals at all.

Google has also stated that ads personalization for Analytics data will move under Ads settings later in 2026, after which the ad_personalization signal will exclusively control whether that data is used for personalization in the linked Ads account. Separately, IP addresses collected automatically by the Google tag and SDKs are to be encrypted and sent to the linked Google Ads account.

Why this matters more than a compliance deadline

• There is no second gate. A misconfigured Consent Mode setup used to be partly cushioned by a separate Signals control. That cushion is gone.
• Audience sizes follow consent capture. Remarketing and bidding audiences now reflect only the visitors who granted the relevant signals.
• The failure is silent. Nothing errors. Numbers simply come in lower than they should, which is easy to misread as a performance problem.

That last failure mode is the expensive one. A tracking fault that looks like a campaign fault gets treated with budget changes, and the budget changes do not fix it.

Which Consent Signals Does Google Support?

Google supports seven consent types, split into consent mode parameters and privacy parameters. Only the first four are the Consent Mode v2 signals that advertising and analytics depend on.

Source: Google Tag Manager consent types documentation.

Google states that ad_user_data is required for measurement including enhanced conversions and the conversion tracking that runs through the tag. That is the signal teams most often overlook, because its name suggests it only affects personalization when it also affects whether conversions are measured.

Do You Need Consent Mode If Your Business Is Not in the EU?

What matters is where your visitors are, not where your company is registered. Google's EU user consent policy covers end users in the European Economic Area, the UK and Switzerland. A US business advertising into those markets is inside the scope.

If you serve no traffic from those regions at all, the policy does not reach you. In practice very few ecommerce stores can say that with confidence, and the cost of implementing regional defaults is low compared with the cost of discovering the gap later.

The cleaner approach is to set denied defaults for the regions that require them and leave other visitors unaffected. Consent Mode supports region-specific defaults using ISO 3166-2 codes, and where a region and a subregion both have values, the more specific one applies.

What Does Google's Consent Policy Actually Require?

Google's EU user consent policy sets out obligations beyond installing a tag. For properties you control, it requires legally valid consent for cookies or other local storage where the law requires it, and legally valid consent for collecting, sharing and using personal data to personalize ads.

Two further duties get missed regularly.

1. Keep records of the consent users give, and give clear instructions for withdrawing it.
2. Identify each party that may collect, receive or use end users' personal data through your use of a Google product, with prominent and easy-to-find information about how each party uses it.

Google states that where the policy is not met it may limit or suspend your use of the product, or terminate the agreement. Google has also described this as strengthening enforcement of that policy for tags and SDKs that send data to Google.

This section is general information about platform requirements, not legal advice. Consent obligations vary by jurisdiction and a qualified advisor should confirm what applies to your business.

Basic or Advanced Consent Mode: Which Should You Use?

The difference is what happens before and during a denied state, and it decides how much measurement you recover. Both are valid implementations.

Source: Google's consent mode implementation documentation.

Advanced mode is the right default for most advertisers, because the cookieless pings are what make modeling possible. Choosing basic mode on a site with real European spend means giving up the modeled conversions that advanced mode would have recovered.

How Do You Implement Consent Mode v2?

Set a default state before any tags fire, then update it the moment the visitor makes a choice. The order matters more than anything else in the setup.

1. Set defaults first. The default command must run on every page before any config or event commands, otherwise tags fire before they know the consent state.
2. Default to denied where required, scoped by region so visitors outside those regions are unaffected.
3. Use wait_for_update with a millisecond value when your consent tool loads asynchronously, so tags wait for the update instead of sending too early.
4. Update on interaction, and update again whenever a visitor changes or withdraws their choice.
5. Pass all four signals, not just the original two.

In Tag Manager the equivalent commands are setDefaultConsentState and updateConsentState rather than the gtag consent commands, which is a frequent source of copied code that never runs.

What usually breaks

• Old exception triggers left on Google tags. Google tags already carry built-in consent checks, so layering legacy blocking on top can leave them blocked after consent is granted.
• Extra consent checks added manually on top of the built-in ones, with the same result.
• Defaults set after the config command, which lets tags fire in an unknown state.
• Only two signals sent, leaving measurement features without the ad_user_data signal they need.
• A banner that never calls update, so every visitor stays permanently denied.

The common thread is that none of these produce an error message. The tag fires or it does not, and the only visible symptom is a number that looks lower than you expected.

What Happens to Conversions When Consent Is Denied?

When ad_storage is denied, no new advertising cookies are set and existing first-party advertising cookies are not read. Requests route through a different domain, Analytics does not read or write Google Ads cookies, and full page URLs are still collected while ad-click information is used only to approximate traffic measurement.

When analytics_storage is denied, first-party analytics cookies are neither read nor written, and cookieless pings are sent so modeling can run.

The honest summary is that denied traffic is estimated rather than observed. Modeling fills part of the gap, not all of it, and the size of the gap depends on your consent rate. This is why consent rate itself belongs on your reporting dashboard next to the performance metrics, and why the monitoring cadence that works for campaigns should include it.

What Happens to Remarketing and Audience Lists?

Advertising audiences now reflect only the visitors who granted the relevant consent. If consent capture sits below one hundred percent, audiences that previously drew on other data sources will be smaller than they were.

For Customer Match specifically, Google requires both consent fields to be granted for users in the EEA, and treats missing or unspecified consent as not consented. Data from users without granted consent is not processed for ad personalization.

Smaller audiences change what is realistic from retargeting, which in turn changes the blended numbers you report. If your targets were set when lists were larger, revisit them. Working out what a good return actually looks like for your catalog is worth doing again once you know your real consent rate.

Does Consent Mode Stop GA4 Counting European Traffic?

No. Consent Mode does not switch off European reporting in Google Analytics. This is one of the most repeated misconceptions among advertisers, and it usually traces back to a specific setup fault rather than to Consent Mode itself.

Traffic disappearing from reports almost always means tags are blocked rather than consented. A banner that never fires the update command, or tags still carrying legacy blocking rules, will produce exactly the pattern people describe as Consent Mode deleting their data.

Check the setup before concluding the data is gone. The distinction matters because one explanation is a configuration fix and the other is a reporting reality you have to plan around.

How Do You Check Whether Consent Mode Is Working?

Test the denied path, not just the granted one. Most setups are verified by accepting the banner, which only proves the happy path works.

1. Load the page without interacting with the banner and confirm the default state is what you intended.
2. Decline, and watch what still fires. In advanced mode you should see cookieless pings, not silence and not cookies.
3. Accept, and confirm all four signals flip to granted, not just the original two.
4. Change the choice afterwards and confirm an update is sent again.
5. Test from a covered region, since region-scoped defaults will not reproduce otherwise.
6. Check your consent rate over time, because a sudden move usually means a banner or tag change, not a change in visitor behavior.

Running this on a schedule matters more than running it once. Consent setups break quietly when a banner is restyled, a tag is republished or a plugin updates, and nobody finds out until a monthly report looks wrong.

Where Should You Go Next?

• If conversion numbers moved and you are not sure why, start with how to monitor PPC campaigns.
• If you are resetting targets after an audience change, read what a good ROAS looks like and how to calculate break-even ROAS.
• If your product data is the next thing to fix, see Google Shopping feed optimization.
• If automation is doing more of the work, read Performance Max for ecommerce.

About the Author

Seller Splash is an ecommerce marketing agency based in New York, working with product brands on Google Ads, Shopping, Merchant Center, paid social and marketplace advertising. Conversion tracking and consent configuration sit inside the account work the team does every day, because campaign decisions are only as good as the measurement underneath them. More on who we are, or see what the work produced for other product brands.

Frequently Asked Questions