Consent Mode v2 parameter and debugging reference

What this is

Google Consent Mode lets tags adjust their behavior to the visitor’s consent state instead of being blocked outright; v2 (November 2023) added two signals that gate Google advertising features for EEA traffic. This page is the lookup card for every signal, command, and modifier, plus the official way to verify what your page actually sends.

The seven consent signals

Every signal takes 'granted' or 'denied'. If you never set any signal, no consent mode values exist at all — unset is not the same as denied, and tags run no consent-mode logic.

Commands

gtag('consent', 'default', {
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  analytics_storage: 'denied',
  wait_for_update: 500,
});

gtag('consent', 'update', {
  ad_storage: 'granted',
  ad_user_data: 'granted',
  ad_personalization: 'granted',
  analytics_storage: 'granted',
});

In Google Tag Manager, set defaults on the built-in Consent Initialization - All Pages trigger — it exists precisely so consent preferences are honored before any other tag fires. Tags carry built-in consent checks (Google tags adjust automatically) and optional additional consent checks you assign per tag; the Consent Overview screen shows which tags have which.

Basic vs advanced implementation

When analytics_storage is denied, tags won’t read or write first-party analytics cookies; measurement continues as cookieless pings. Those pings carry: timestamp, user agent, referrer, the boolean consent state, random per-page-load numbers, and ad-click indicators (GCLID/DCLID) from the URL.

GA4 behavioral modeling prerequisites

Meeting these numbers does not guarantee activation — the model applies its own additional eligibility criteria. Since March 2024, EEA audience features (e.g. Customer Match) require both ad_user_data and ad_personalization granted; unconsented or unspecified EEA user data is not processed for ad personalization.

Debugging in Tag Assistant

1. Start a Tag Assistant session on the page.
2. Select the earliest Consent event in the Summary → API Call should set ad_storage, ad_user_data, ad_personalization, analytics_storage (your defaults).
3. Open the tag output’s Consent tab → check the On-page Default column.
4. Accept the banner, select the most recent Consent event → verify the same four in API Call, or the On-page Update column.
5. An empty Consent tab means consent mode is not implemented on that page.

Google request URLs also carry consent state in the gcs and gcd query parameters, but their encoding is not officially documented — treat community decodings as hints and verify in Tag Assistant instead.

Gotchas

1. First hits carry no consent state — the default runs after your tags load. Fix: place the default snippet above the gtag.js/GTM snippet; in GTM, fire it on Consent Initialization - All Pages.
2. Consent tab in Tag Assistant is empty — consent mode is simply not implemented on the page; no default or update ever ran. Fix: implement, then re-test.
3. EEA ad features stopped working — your CMP still sends v1 signals only. Since March 2024, ad_user_data + ad_personalization must be 'granted' for EEA audience features. Fix: upgrade the CMP template to a v2 version.
4. Behavioral modeling never activates — basic implementation blocks tags until consent, so denied pings never reach Google. Fix: advanced implementation, then meet the 1,000/1,000 thresholds — and note activation still is not guaranteed.
5. Stored consent applies too late on returning visits — an async CMP delivers its update after the first events. Fix: set wait_for_update (e.g. 500) in the default command.

Quick recipes

window.dataLayer = window.dataLayer || [];
function gtag() { dataLayer.push(arguments); }
gtag('consent', 'default', {
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  analytics_storage: 'denied',
  functionality_storage: 'granted',
  security_storage: 'granted',
  wait_for_update: 500,
});

gtag('consent', 'default', {
  ad_storage: 'denied',
  analytics_storage: 'denied',
  region: ['ES', 'US-AK'],
});

gtag('set', 'ads_data_redaction', true);
gtag('set', 'url_passthrough', true);

gtag('consent', 'update', {
  ad_storage: 'granted',
  ad_user_data: 'granted',
  ad_personalization: 'granted',
  analytics_storage: 'granted',
});

Related

• Hub: Privacy & consent guides
• Lateral: ACDL cheat sheet · GA4 event naming cheat sheet
• Canonical docs: Consent mode setup · gtag consent reference · Consent mode behavior · Verify consent mode · GA4 behavioral modeling

Verification notes

Signals, commands, and modifiers checked against Google’s developer docs and Help Center on the date in the header. Two items are deliberately hedged: gcs/gcd request-parameter encodings are not officially documented, and precedence between overlapping region-scoped defaults is not stated in the consent guide — verify multi-region setups in Tag Assistant.