Consent Mode v2 in practice: basic or advanced?

Consent Mode v2 passes the choice from your cookie banner on to Google's tags. With basic, nothing goes to Google until your visitor consents; with advanced, the tags send cookieless pings when consent is refused ^[1]. In Belgium, basic is the safest default. Choose advanced only deliberately, and together with your DPO.

If you advertise to people in the European Economic Area, Google has required you to pass on their choice since March 2024. Without those signals you lose remarketing, ad personalisation and part of your measurement for that traffic ^{[2], [3]}. Consent Mode does not ask for consent itself: that remains the job of your banner.

Whether you set it up yourself or bring in a Google Analytics agency, the trade-off stays the same: how much measurement data do you want to recover, and how much legal risk are you willing to carry? This is an explanation, not legal advice.

Basic or advanced: what is the difference?

The difference lies in what happens before and after a refusal. "v2" only means that two consent types were added, ad_user_data and ad_personalization. They don't govern cookies, but what Google may do with the data for advertising ^[1].

Advanced only pays off if you meet Google's thresholds. GA4 only models with at least 1,000 events per day with analytics_storage denied, for at least 7 days. You also need at least 1,000 users per day with consent, on at least 7 of the past 28 days ^[5].

For Google Ads, Google cites 700 ad clicks over 7 days, per country and domain grouping ^[6]. Google also warns that visitors who consent typically convert 2 to 5 times more often than those who refuse ^[6]. So don't extrapolate the conversion rate of consenting visitors to everyone.

Which choice suits you?

Weigh the legal risk first, and only then the modelling. According to the Belgian Data Protection Authority (DPA), you may only place or read cookies that are not strictly necessary after valid consent, and that includes pixels, device fingerprinting and local storage ^[7]. Belgium has no exemption for analytics cookies, not even for first-party cookies ^[8].

The European regulators read the rule broadly: information that the device sends via pixels or tracking links is covered too, even without cookies ^[9]. With advanced, the Google tags load before the choice and, on a refusal, send information from the device along, such as the user agent ^[4]. We found no specific DPA position on Consent Mode (checked on 27 September 2026), but the EDPB reading makes the risk real.

Google says so itself: you remain responsible for consent on your website ^[3].

What changed on 15 June 2026?

Since that date, Consent Mode is the only control for the advertising data that GA4 passes to a linked Google Ads account. The Google signals setting now only governs the link with signed-in users for reports in GA4 itself. Later in 2026, ad_personalization also becomes the only setting for personalisation in Google Ads ^[10].

Turning off Google signals is therefore no longer a privacy switch for your Ads data: that switch is your banner. So check that your advertising category controls all three advertising types: ad_storage, ad_user_data and ad_personalization.

How to set up Consent Mode v2

1. Choose a banner that meets the DPA checklist: a reject button next to the accept button on the first layer, no pre-ticked boxes, consent per purpose, and withdrawing as easy as giving. Closing the banner or continuing to browse does not count as consent ^[7].
2. Map your banner categories to the consent types, as in the table below.
3. Set the default status to denied before anything else. In Google Tag Manager you do this with your CMP's template on the Consent Initialization - All Pages trigger ^[11]. If the code runs in the wrong order, the default status doesn't work; if your banner loads asynchronously, use wait_for_update ^[12].
4. Update the status as soon as your visitor chooses. Consent Mode doesn't remember anything itself: your CMP sends an update on every page ^[12].
5. Handle third-party tags. For the Meta pixel, LinkedIn or TikTok, set "Require additional consent for tag to fire" on each tag. The Consent Overview shows which tags don't have a setting yet ^[11]. How Tag Manager works is explained in Google Tag Manager explained: the basics for SMEs.
6. Decide deliberately on url_passthrough and ads_data_redaction. They pass click information through the URL, or leave out click IDs, when ad_storage is denied ^[12].

The DPA asks that your own advertising, third-party advertising and sharing on social media are separate purposes ^[7]. Your banner can therefore be more granular; the mapping to Google stays the same. Having a new site built? Put Consent Mode on the delivery checklist, as in A new website for your SME: the checklist from A to Z.

How to check that it works

Test in your browser first. Open the developer tools, go to the Network tab and filter on collect. The gcs parameter in the requests to Google Analytics shows the status: G100 is no consent, G101 analytics only, G110 advertising only and G111 both ^[13].

• First visit, no choice yet: with basic, nothing goes to Google; with advanced, you see G100.
• Reject all: with basic, still nothing; with advanced, it stays G100.
• Accept all: G111.
• Withdraw consent: after that, the requests must actually change ^[7].

In Tag Manager's preview mode you see the default status and the update for each event. A tag that fires before the default status is set is an error. In GA4, Admin shows under Data collection and modification whether the signals for analytics and advertising come through; after a change, that can take 48 to 72 hours ^[14].

Want a second pair of eyes? The free tracking audit checks whether your banner passes the signals correctly and on time, and what happens to visitors who refuse.