Privacy30 min· Intermediate

Implement Consent Mode v2 properly

Required for EEA/UK ads. Wire a CMP (Cookiebot/Iubenda/Didomi/Termly), set default consent BEFORE GTM loads, update on user choice, and gate every Google tag on the correct signal.

Before you start — you'll need

A Consent Mode v2 compliant CMP
GTM container with Google Tag + GA4 events already firing
Editor access to your <head>

By the end you'll have

Default consent denied on first hit (EEA/UK)
Updated to granted/denied based on user choice
Google tags respect consent (modelled conversions instead of nothing)
ad_user_data + ad_personalization signals sent (v2 requirements)

Step 1

Set the consent default in <head>

BEFORE the GTM snippet, set defaults for all 6 signals. EEA/UK: deny by default. Rest of world: typically granted.

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('consent', 'default', {
    'ad_storage': 'denied',
    'ad_user_data': 'denied',
    'ad_personalization': 'denied',
    'analytics_storage': 'denied',
    'functionality_storage': 'granted',
    'security_storage': 'granted',
    'wait_for_update': 500,
    'region': ['GB','DK','DE','FR','IE','IT','ES','SE','NO','FI','NL','BE','AT','PL','PT','CZ','HU','RO','GR']
  });
</script>
<!-- THEN your GTM snippet below -->

Tip: wait_for_update tells Google to delay tags up to 500ms while waiting for the user's choice — prevents firing before consent updates.

Step 2

Install your CMP's GTM template

Cookiebot / Iubenda / Didomi / Termly all have official GTM templates in the Gallery. Add it, paste your CMP ID, trigger on Consent Initialization — All Pages. The template will call gtag('consent', 'update', ...) when the user clicks accept/deny.

Step 3

Gate each Google tag on the right signal

Open every Google tag (Google Tag, GA4 Event, Google Ads Conversion). Advanced Settings → Consent Settings → Require additional consent for tag to fire:

· GA4 tags: analytics_storage · Google Ads Conversion / Remarketing: ad_storage · Floodlight: ad_storage

Don't tick all of them on every tag — only the relevant signal.

Step 4

Verify in Preview Mode

Preview → Open your site in incognito → ignore the banner → check left rail. Tags that require analytics_storage should be in Not Set or Denied. Now click Accept on the banner. They should jump to Granted and fire.

The Consent tab in Preview shows the state of all 6 signals per event.

Step 5

Verify Conversion Modelling kicks in

Google Ads → Goals → Conversions → Diagnostics. After 30+ days of v2 traffic you'll see a Modelled conversions column populating for users who declined. Without Consent Mode v2 those users contribute nothing — with it, Google models them based on aggregated patterns.

Common pitfalls

Defaults set AFTER the GTM snippet — too late. Always before.
Forgetting ad_user_data + ad_personalization — these are the 'v2' bits Google added in 2024.
CMP misconfigured to also DENY for ROW users — kills 100% of your analytics outside EEA.
Hard-coded gtag.js firing alongside GTM — only the GTM-firing tag respects consent settings.

Official references

Keep going

Google Ads

Tag up Google Ads from start to finish

GA4

Build a GA4 purchase event from scratch