Consent Mode v2 and Cookie Banners: Making Your Website Compliant Without Losing Data

Consent Mode v2 is the mechanism by which a website tells Google whether the user has consented to cookies for statistics and advertising, adjusting the behaviour of tags such as Google Analytics 4 and Google Ads accordingly. Together with a properly configured cookie banner it lets you comply with the GDPR and the ePrivacy directive, and still get useful measurement even when some visitors decline consent.

What the Regulation Requires

For cookies and similar technologies that are not strictly necessary, such as non-anonymized statistics and marketing, you need the user's prior, informed and freely given consent. The banner must offer rejection as easily as acceptance, use no pre-ticked boxes and let users change their choice at any time. Technical cookies needed for the site to work do not require consent but must be described in the notice.

Guidance from authorities, including the Italian Garante, also asks that third-party tags not be loaded before the user's choice. That is why conditional tag loading is the most important technical part.

How Consent Mode v2 Works

Consent Mode defines consent signals that the site sets based on the user's choice. Four are central: analytics_storage (statistics), ad_storage (advertising cookies), ad_user_data (sending user data to Google for advertising) and ad_personalization (personalized ads). Version 2 added ad_user_data and ad_personalization, required to use advertising features in the European Economic Area.

The default value, set before tags load, is denied. When the user chooses, the banner updates the signals to granted for the accepted categories. Google tags read these signals and behave accordingly.

Basic and Advanced Modes

In the basic implementation, Google tags are not loaded until the user consents: if they decline, nothing is sent. In the advanced implementation tags load immediately but, without consent, send only anonymous, cookieless pings, which Google uses to model missing conversions in aggregate form.

The choice between the two should be agreed with your privacy adviser and reflected in the notice. The basic implementation is the most cautious; the advanced one recovers more data but requires careful assessment of the legal basis.

Configuring the Banner and Tags

The typical path: choose a consent management platform (CMP) compatible with Consent Mode v2, set the default denied value via Google Tag Manager or directly in code, connect the banner's categories to the consent signals and configure tags to require the relevant consent before firing.

• The banner offers "Accept" and "Reject" with equal prominence and access to granular preferences.
• Default consent signals are set to denied before tags load.
• The four signals (analytics_storage, ad_storage, ad_user_data, ad_personalization) are linked to the choices.
• No unnecessary third-party tag fires before consent.
• A permanent link, for example in the footer, lets users review or withdraw their choice.
• The cookie notice lists categories, purposes, vendors and duration.

Testing the Implementation

Test in a private browsing window with the browser's developer tools. Before consent, check in the Network tab that no requests go to analytics or advertising domains (in basic mode) and that no marketing cookie is set. After accepting, verify that tags fire and signals show granted; after declining, verify they stay denied. Google Tag Manager's preview shows each tag's consent state.

Impact on Measurement

With a correct banner some visitors will decline, and the data observed in Google Analytics 4 will be lower than real traffic. This is an expected effect, not an error. Advanced mode's modelled estimates fill part of the gap but do not replace real data. Compare trends over time rather than absolute values, and add first-party metrics, such as contact form submissions recorded server-side.

Key takeaway: a compliant site asks for consent before loading non-essential tags, sets Consent Mode v2 signals to denied by default, updates them from the user's choice and verifies it all with a test: compliance and reliable measurement are not in conflict.