If you run Google Ads or use Google Analytics on a website that receives traffic from the European Economic Area (EEA), UK, or Switzerland, Google Consent Mode v2 is no longer optional. It has been mandatory since March 2024. If you are not yet compliant, you are missing conversion data, your remarketing audiences are degraded, and your Google Ads campaigns may not be bidding effectively.
This guide explains what Consent Mode v2 is, how Basic and Advanced implementations differ, what it does to your tracking data, and how it fits into a server-side tracking setup.
What Is Google Consent Mode?
Google Consent Mode is a framework that lets your website communicate your users' cookie consent decisions to Google tags — GA4, Google Ads, and other Google services. When a user declines tracking cookies on your consent banner, Consent Mode tells Google's tags to respect that decision and modify their behaviour accordingly.
Before Consent Mode existed, the only compliant option was to block Google tags from firing when a user declined consent. This meant zero data from non-consenting users — no conversions, no sessions, no signals. Consent Mode introduced a middle path: adjust what data is collected based on consent status, rather than simply firing or not firing.
What Changed in v2?
Version 1 of Consent Mode used two consent parameters:
analytics_storage— controls whether cookies and storage for analytics purposes (GA4) can be usedad_storage— controls whether cookies for advertising (Google Ads) can be used
Consent Mode v2 adds two new parameters:
ad_user_data— controls whether the user's personal data can be sent to Google for advertising purposesad_personalization— controls whether personalised advertising and remarketing can be enabled for this user
These two new parameters are the reason v2 became mandatory. The Digital Markets Act (DMA) requires platforms like Google to obtain explicit consent before using personal data for advertising. ad_user_data and ad_personalization give Google the specific consent signals it needs to comply with the DMA.
If you do not implement v2, Google cannot use data from EEA users for remarketing or enhanced conversion matching. Your Audience lists stop growing with EEA traffic. Enhanced Conversions stop working for non-consenting EEA users. And your bidding algorithms work from a partial signal.
Basic vs. Advanced Consent Mode: The Key Difference
This is the most important practical decision in your implementation.
Basic Consent Mode
In Basic mode, Google tags do not load at all until the user makes a consent decision. If they consent, tags fire normally. If they decline, tags do not fire and no data is sent to Google.
Simple to implement, but it means zero data from non-consenting users. With average cookie consent rates around 30% in the EEA, roughly 70% of your EEA traffic becomes invisible to Google. No conversion modeling helps you recover that data.
Advanced Consent Mode
In Advanced mode, Google tags load immediately — before the user makes a consent decision. When a user consents, they behave normally. When a user declines, the tags fire "cookieless pings" instead: stripped-down, anonymised signals that contain basic interaction data (page URL, rough location, event type) but no cookie IDs or personal identifiers.
These cookieless pings feed Google's conversion modeling — a machine learning system that uses patterns from consenting users to estimate the conversions happening in the non-consenting population. Google typically recovers 15–25% of otherwise-invisible conversions through this modeling.
Advanced mode requires more careful implementation (you need your consent banner to trigger properly, and your tags need to be configured to respond to consent state changes in real time), but it provides significantly better data than Basic mode.
For any advertiser spending meaningful budget on Google Ads in the EEA, Advanced mode is strongly recommended.
How Consent Mode v2 Affects Your Google Ads Data
Conversion tracking. When a user declines consent, their purchase event is not attributed directly. However, with Advanced mode and conversion modeling, Google estimates the conversions that occurred in non-consenting segments. Your reported conversion count will be higher than Basic mode, and your cost-per-conversion will be more accurate.
Smart Bidding. Google's Target CPA, Target ROAS, and Maximize Conversions strategies rely on conversion signals to make bid decisions. With proper Advanced Consent Mode implementation, modeled conversions feed the bidding algorithm — so it can make better bid decisions even for the non-consenting segment.
Remarketing audiences. Without ad_personalization consent, users cannot be added to remarketing lists. Your audience sizes will shrink for non-consenting EEA traffic. This is a legal requirement, not a technical limitation.
Enhanced Conversions. The Enhanced Conversions feature — which sends hashed customer data (email, phone) to Google for matching — requires ad_user_data consent to be granted. Without it, Enhanced Conversions will not function for non-consenting users.
How Consent Mode v2 Works With GA4
GA4 also respects consent signals. When analytics_storage is denied:
- No GA4 cookies are set in the user's browser
- The session is not attributed to a specific user
- With Advanced mode, cookieless pings still send basic interaction data (page visited, event type) that contributes to blended modeling in GA4 reports
The practical result: your GA4 session and user counts will be lower for EEA traffic than your actual visitor numbers, but the conversions and attribution will be more accurate than nothing.
Does Server-Side Tracking Change Consent Requirements?
This is a common misconception worth addressing directly: server-side tracking does not exempt you from consent requirements.
Consent Mode must be implemented regardless of whether your tags run in the browser or on a server. If a user declines analytics and advertising cookies, your server-side GTM container must respect that decision. Server-side tracking without a proper consent management setup is a compliance risk, not a privacy improvement.
How the integration works in practice:
- Your Consent Management Platform (CMP) captures the user's consent decision in the browser
- Your web GTM container reads the consent state and applies it via
gtag('consent', 'update', {...}) - The web container passes the consent state as a parameter in the event payload sent to your sGTM server
- Your server-side tags check the consent state and only forward data to platforms (Meta, Google, GA4) when the corresponding consent has been granted
Done correctly, this is actually more reliable than a browser-only implementation — one rule in your server container enforces consent across every platform simultaneously, with no risk of a tag firing that you forgot to condition on consent.
What You Need to Implement Consent Mode v2
A Consent Management Platform (CMP) certified by Google. Google maintains a list of certified CMPs (including CookieYes, OneTrust, Cookiebot, and others). Your CMP must be certified to ensure it communicates consent decisions to Google's tags in the correct format.
Updated tag configuration. Your Google tags (GA4, Google Ads) must be using the Consent Mode API — setting default consent states and updating them when the user makes a decision. This is configured in GTM using built-in Consent Initialisation triggers and the gtag consent commands.
Both new v2 parameters. Your CMP must pass ad_user_data and ad_personalization signals, not just the v1 parameters. If your CMP was set up before 2024, check whether it has been updated for v2.
Advanced mode configuration (recommended). Your tags must load before consent is given, and your CMP must update the consent state when the user makes a decision. This requires that your tags respond to the consent state change dynamically — which is handled through GTM's built-in consent architecture when set up correctly.
FAQ
Is Consent Mode v2 required outside the EEA? Google's official requirement covers EEA, UK, and Switzerland traffic, linked to GDPR and the DMA. Outside these regions, it is not currently mandatory. However, implementing it globally simplifies your compliance architecture and prepares you for similar regulations expanding to other markets.
What happens if I do not implement Consent Mode v2? For EEA traffic, Google Ads will not collect data for new users from March 2024 onwards, remarketing audiences degrade, and Enhanced Conversions stop working for non-consenting users. Your Smart Bidding algorithms will work from an increasingly incomplete signal.
Does Consent Mode v2 replace GDPR compliance? No. Consent Mode v2 is a technical framework for communicating consent decisions to Google's tools. It does not replace your legal obligations under GDPR — you still need a lawful basis for data processing, a privacy policy, and a proper CMP that obtains valid consent.
What is conversion modeling in Consent Mode? Google uses machine learning to estimate conversions from non-consenting users based on patterns observed from consenting users with similar characteristics. The models never identify or target individual non-consenting users — they produce aggregate estimates that feed bidding algorithms and reporting.
Can I use Advanced Consent Mode with server-side GTM? Yes. The consent state is read in the browser and passed to your server container as a parameter in the event payload. Your server-side tags can check this parameter and only forward events to platforms when the appropriate consent is present.
Conclusion
Google Consent Mode v2 is not a choice for EEA-facing advertisers — it is a compliance requirement with direct consequences for your campaign data and performance. The practical choice is between Basic and Advanced implementation, and for anyone spending seriously on Google Ads, Advanced mode's conversion modeling benefit makes it the correct option.
Server-side tracking and Consent Mode v2 work well together when properly integrated: consent is enforced in the browser, passed to your sGTM server, and applied to every outgoing API call in one place.
If you are setting up sGTM and want the server infrastructure handled for you, Firstag gets your container running in under 15 minutes with no DevOps setup required.
Start your Firstag container free for 14 days at firstag.io.