Google Consent Mode v2: A Practical Setup Guide for EU Businesses in 2026

If you run Google Ads or GA4 on a website with European visitors, Google Consent Mode v2 decides how much of your conversion data you get to see. When it is missing or set up wrong, your reports undercount sales, your remarketing audiences shrink, and Smart Bidding ends up optimising on partial data.

We set up tracking for every client who joins our digital strategy retainer: Google Tag Manager, GA4, Google Ads conversions, the Meta Pixel with the Conversions API, and Consent Mode. This guide covers what we have learned from doing it, including the mistakes we see most often when we audit an existing account.

What is Google Consent Mode v2?

Google Consent Mode v2 is a way for your cookie banner to tell Google's tags what each visitor agreed to, and the tags adjust their behaviour to match. When a visitor accepts, they work normally. When a visitor declines, they either stay silent or send cookieless signals that Google can use for modelling.

Version 2 added two signals to the original two:

• ad_storage: may advertising cookies be stored?
• analytics_storage: may analytics cookies be stored?
• ad_user_data: may user data be sent to Google for advertising? (new in v2)
• ad_personalization: may the data be used for personalised ads and remarketing? (new in v2)

Google has required v2 since March 2024 for advertisers who serve ads to users in the European Economic Area, and enforcement has only tightened since then.

Consent Mode v2 in 2026: the Google Signals change

From 15 June 2026, Google Signals no longer works as a backup route for advertising data from the Analytics tag, and ad_storage alone decides whether those advertising cookies are set. Some accounts had been relying on Signals without anyone realising, and they saw remarketing lists and reported conversions drop when the change went live.

In practice this means:

1. A banner that collects consent but never passes it to Google counts as no consent.
2. Remarketing audiences only include people who granted ad_storage.
3. Conversion modelling needs consent signals to arrive correctly. If they don't, Google has nothing to model from.

Greek businesses have one more layer to deal with. The Hellenic Data Protection Authority expects rejecting cookies to be as easy as accepting them, with no pre-ticked boxes and no tracking before a choice is made. A pushier banner is off the table, so any lost data has to be recovered through the technical setup.

Basic vs Advanced Consent Mode: which should you choose?

The two options behave very differently, so this is the first thing to decide.

Basic mode blocks Google tags completely until the visitor accepts. If someone declines, Google receives nothing at all. It is simple and conservative, but Google only has general modelling to fill the gap, which is less precise.

Advanced mode loads the tags in a restricted state before consent. If the visitor declines, the tags set no cookies, but they do send cookieless pings (for example, that a conversion happened, with no identifier). Google uses these to build a model specific to your account and estimate the conversions you would otherwise miss.

Our default for clients running paid ads is Advanced mode, after a conversation with the client about their privacy stance and, where needed, their legal advisor. For a brochure site with no ad spend, Basic is often enough. We tell clients directly that this is a business and legal decision as well as a technical one, and we make sure they know which option they are getting.

How we set up Consent Mode v2, step by step

This is the order we follow on a new account. It assumes the site uses Google Tag Manager, which we recommend for anything beyond a single tag.

1. Choose a Google-certified consent platform

Use a consent management platform (CMP) that integrates with Consent Mode v2 natively. Cookiebot, CookieYes, Complianz and Usercentrics all do. A custom banner can work, but it adds code you have to maintain and test whenever Google changes something. On WordPress builds we usually go with a certified plugin and style it to match the site, so the banner looks like part of the design.

2. Set defaults before any tag fires

Every consent signal needs a default state, which for EU visitors is usually "denied". It has to load before GA4, Google Ads or any other tag, and in Tag Manager that means using the Consent Initialization trigger. Most broken setups we audit go wrong at this step. The default loads late, so for a split second the tags fire as if consent had been granted.

3. Map the banner categories to all four signals

The banner's "Marketing" category should update ad_storage, ad_user_data and ad_personalization together. "Statistics" or "Analytics" should update analytics_storage. On older setups the banner often still sends only the two original v1 signals. The tags appear to work, but Google treats the missing v2 signals as denied for advertising purposes.

4. Turn on consent checks for every tag

In Tag Manager, each tag should declare which consent it needs. Google tags have built-in consent checks. For third-party tags such as the Meta Pixel, LinkedIn Insight or Hotjar, you add the additional consent requirement manually so they never fire without the right category.

5. Add server-side signals where you can

The browser loses more data every year, through ad blockers, Safari's tracking limits and declined banners. For clients on Meta, we pair the Pixel with the Conversions API so that consented events also go server to server. On Google's side, enhanced conversions do the same job by sending hashed, consented first-party data, such as the email address from a completed order. Both send only the data your consent rules allow, and they run alongside Consent Mode.

6. Test before you trust the numbers

We test every setup before calling it done:

• In Tag Assistant preview, check the consent state on page load, after accepting, and after declining.
• In the browser's network requests, look for the gcs and gcd parameters on Google requests. They show which consent state was sent.
• In Google Ads, the conversion action's diagnostics panel shows whether Consent Mode signals are being received.
• Run a real test purchase or form submission twice, once with consent granted and once denied, to confirm the conversion is recorded (or modelled) as expected.

After that, we compare a few weeks of conversions with the client's actual orders or leads. Some gap is normal. A gap that suddenly widens means something is broken.

Consent Mode mistakes we find most often in audits

When a new client asks us to take over their ads, the tracking audit comes first. The same problems keep coming up, and most audits turn up at least one of them:

• A banner that does nothing. It looks compliant, but tags load before the choice or regardless of it, which is a legal risk and a data problem at the same time.
• Only the v1 signals. The banner was installed years ago and has never been updated for ad_user_data and ad_personalization.
• Double counting. GA4 is installed twice (hardcoded in the theme and again through Tag Manager), so every pageview and purchase counts double.
• Imported and native conversions both set as primary, so Google Ads optimises toward conversions that are counted twice.
• No clear owner. Nobody knows who set it up or which account the tags belong to. We always make sure the client owns their Tag Manager, GA4 and Ads accounts, and we are added as users.

What to expect after the fix

Consent Mode v2 does not bring back individual-level data from people who said no, and it shouldn't. It does give you:

• Reported conversions that are closer to reality, through modelling.
• Smart Bidding that learns from a fuller signal, which usually means steadier cost per acquisition.
• Remarketing audiences built only from people who agreed, which keeps you on the right side of GDPR.
• A setup you can show an auditor or a client without hoping nobody looks closely.

Expect a few weeks before modelled conversions settle. Google needs enough consented traffic and conversions to build the model, so very small accounts may see little modelling at first.

FAQ

Is Google Consent Mode v2 mandatory?

If you use Google Ads or GA4 audiences with visitors from the EEA or the UK, yes, in practice. Without valid consent signals, Google limits conversion measurement and remarketing for those users. The requirement comes from Google, which uses it to apply EU privacy rules on its own platforms; it is not a law in itself.

Does Consent Mode v2 make my website GDPR compliant?

No. It passes your visitors' choices to Google. Compliance still depends on a proper banner, a clear cookie policy, honest categories and tags that respect the choice.

Should I use Basic or Advanced Consent Mode?

If you spend on Google Ads, Advanced mode usually gives better measurement because it allows account-specific modelling. Basic mode suits sites without ad spend or businesses that want no data at all sent before consent. Discuss it with whoever handles your privacy obligations.

How do I check if my Consent Mode setup works?

Use Google Tag Assistant to watch the consent state change when you accept and decline the banner, then check the conversion diagnostics in Google Ads. If the consent parameters never change, or tags fire before a choice is made, the setup needs work.

Get your tracking right before you spend more on ads

Ad platforms optimise toward whatever conversions they can see, so budget spent on bad tracking data goes partly to waste. We set up and audit tracking as part of our digital marketing and performance work, and we build it into our 360° digital strategy from the first week. If you are unsure whether your banner is doing its job, or your ad platforms report numbers that don't match your sales, get in touch and we will take a look. If you are also thinking about how AI search changes your visibility, our guide on GEO vs SEO is a good next read.