Consent Mode v2: Default Denied, and the Tags That Ignore It

Set all four Consent Mode signals to denied before any tag fires, then update them when the visitor chooses. And remember the boundary: Consent Mode only governs Google's tags. Every other tag needs its own consent check in Tag Manager, or it fires regardless of what the visitor chose.

The default that has to come first

Consent Mode v2 sends four signals: ad_storage, analytics_storage, ad_user_data, and ad_personalization. The first two existed before v2; the last two are new and required for Google Ads audiences and remarketing to work under GDPR. The setup rule is absolute: the default must be set before any Google tag fires, or the tags behave as if Consent Mode is not there. Set all four to denied for the regions that need consent, using the Consent Initialization trigger in Tag Manager, and send the update when the visitor chooses, and again on every later page, because Consent Mode does not remember choices. The banner has to re-send the stored choice each time.

The two modes are often confused, and the confusion costs data. Basic mode blocks all Google tags from firing until a visitor grants consent. If someone clicks reject, nothing reaches Google, not even the choice. Advanced mode loads Google tags immediately, but in a restricted state, sending cookieless pings before consent is granted. After a reject, the pings carry no cookies or persistent identifiers. Google recommends advanced mode, and the pings are the price of conversion modeling. Whether those pings constitute personal data processing under the ePrivacy Directive is still debated among data protection professionals, and that debate is worth having with a lawyer, not with a tag template.

The tags Consent Mode never touches

Here is the part that gets missed in most implementations. Consent Mode is Google's way of telling its own tags what a visitor chose. It governs the Google tag, Google Analytics, Google Ads, Floodlight, and the Conversion Linker. It does not govern anything else. The Meta Pixel, TikTok, LinkedIn, Hotjar, and every Custom HTML tag fire on their triggers whatever the signals say, unless each one gets its own consent check in Tag Manager. An audit of a European fashion store in October 2026 found exactly this: Google's tags behaved as designed, every request carrying the denied signal, while an attribution pixel added in Tag Manager sent a page-load event with a visitor ID both before any choice and after reject all. Consent Mode never touched it, because Consent Mode only governs Google's tags.

The fix is per-tag consent checks in Tag Manager, and a test that covers every tag on the live site, not only Google's. Load the site from the EEA, before any choice and after reject all, and read the network tab for every third-party request. The Google requests should carry the denied signal. Every other request should either be absent or carry its own consent logic. If a tag fires with a visitor ID after reject all, the banner is compliant and the site is not, and the gap is in the tag configuration, not the banner. The dark-pattern half is the reject button that is the whole banner, and the fix is usually one toggle per purpose instead of Accept All.

Frequently asked questions

What are the four Consent Mode v2 signals?

ad_storage, analytics_storage, ad_user_data, and ad_personalization. The first two control cookie storage; the last two, new in v2, control whether user data may be sent to Google for advertising and used for personalization.

What is the difference between basic and advanced mode?

Basic blocks all Google tags until consent is granted. Advanced loads them immediately in a restricted, cookieless state, sending pings with no cookies or persistent identifiers. Google recommends advanced, for conversion modeling.

Does Consent Mode v2 cover the Meta Pixel?

No. Consent Mode only governs Google's tags. The Meta Pixel, TikTok, LinkedIn, Hotjar, and custom HTML tags fire on their own triggers unless each gets its own consent check in Tag Manager.

When must the default be set?

Before any Google tag fires, on the Consent Initialization trigger. If the default is set after the tags load, the tags behave as if Consent Mode is not there, and the consent state is never applied.