Consent Mode v2 and the consent banner: a practical guide for agencies

A web page with a consent banner at the bottom; behind it, tag icons wait behind a closed gate until the visitor chooses.

For agencies running ads in Europe, consent is no longer a legal footnote. It decides which tags may load, which data the ad platforms receive and, in the end, how much of a campaign's result you can measure. Google's Consent Mode v2 is the part of this that touches Google tags directly, and it is often misunderstood.

This guide explains it in plain terms and ends with a checklist you can use on each client site. It is not legal advice: the client's own privacy notice and their lawyer decide what their site must ask for.

Consent Mode is a way for a website to tell Google's tags what the visitor agreed to. The tags then adjust their behaviour. It is not a consent banner. You still need a banner (or a consent management platform) to ask the visitor; Consent Mode only carries the answer to Google's tags.

Google's own help centre describes it in exactly those terms: consent mode passes the visitor's consent status to Google and works alongside your existing banner. (Google Ads Help: About consent mode)

The four signals in version 2

Version 2 added two signals to the two that existed before. According to Google's developer documentation (Set up consent mode on websites):

ad_storage: whether advertising cookies may be stored.
analytics_storage: whether analytics cookies may be stored.
ad_user_data: whether user data related to advertising may be sent to Google (new in v2).
ad_personalization: whether data may be used for personalised advertising, such as remarketing (new in v2).

Each signal is either granted or denied. A site sets defaults before any Google tag runs, then sends an update once the visitor has chosen.

Defaults come first

The default must be set before any command that sends measurement data. Google's documentation shows a default that denies all four signals, and an optional wait_for_update value that gives an asynchronous banner a few hundred milliseconds to report the choice before tags fire. Defaults can also differ by region.

If the default is set after a tag has already loaded, the first hit of every page view goes out without the visitor's decision. It is an easy mistake to make when tags are added in several places.

Basic or advanced mode

Google describes two ways to implement Consent Mode (consent mode overview):

Basic: Google tags do not load until the visitor interacts with the banner. If the visitor refuses, no data is sent to Google, not even the consent status.
Advanced: Google tags load straight away with consent denied by default and send cookieless pings while consent is denied; full measurement starts only after consent is granted.

Advanced mode lets Google model more of the missing conversions, while basic mode sends nothing before consent. Which one a client should use is a decision for the client and their privacy adviser, not just for the agency's reporting.

Why it matters in the EEA, the UK and Switzerland

Google's EU user consent policy applies to end users in the European Economic Area, the UK and Switzerland. Among other things, it requires legally valid consent for cookies or local storage where the law requires it, and consent for collecting, sharing and using personal data to personalise ads. It also asks sites to name the parties that receive the data, keep records of consent and tell visitors how to withdraw it.

The policy covers properties you control, including those of your clients. For an agency, that means the consent set-up on a client's site is part of the job, not something to leave to the web developer.

Consent Mode only carries the visitor's choice; the banner is where the choice is made. European data protection authorities have looked closely at banner design: the European Data Protection Board's Cookie Banner Taskforce report (January 2023) covered issues such as a missing reject option on the first layer, pre-ticked boxes and deceptive button design. In practice, a fair banner:

offers Accept and Reject on the first layer, with the same weight;
has no pre-ticked categories beyond what is strictly necessary;
explains the categories (necessary, analytics, marketing) in plain language, in the visitor's language;
loads nothing optional before the choice;
lets the visitor change their mind later, with a visible link or button.

A rollout checklist for each client site

List every tag on the site: Google tag, Tag Manager, Meta Pixel, TikTok, LinkedIn Insight, Microsoft UET and so on. Include the ones nobody remembers adding.
Assign each tag to a category: necessary, analytics or marketing.
Set Consent Mode defaults first, before any tag, all denied.
Show the banner in the visitor's language with equal Accept and Reject.
Load each tag only after consent for its category, and send the Consent Mode update with the visitor's choice.
Decide on ad_personalization with the client: a site may want ad measurement without remarketing.
Remove advertising cookies when consent is withdrawn.
Check the result: open the site in a private window, refuse, and confirm that nothing optional loads.
Re-check regularly. Sites change; someone will paste a new pixel into the footer.

How Reachio handles this

Reachio gives each brand one embed line for the top of the site's <head>. It:

sets Consent Mode v2 defaults to denied for every signal (security storage stays granted) before anything else, with a short wait_for_update;
shows the brand's consent banner in the visitor's language (seven languages), with Accept and Reject side by side and a settings panel for analytics and marketing;
loads only the registered tags the visitor allowed — nothing third-party before the choice, so Google tags behave as in basic mode;
sends the Consent Mode update with the choice; ad_personalization stays denied unless you switch it on for the brand;
removes advertising cookies when marketing consent is withdrawn, and reopens the banner from any element with data-reachio-consent.

A daily scan of the brand's pages checks each registered tag as found, missing, duplicate or wrong id, and you can export a Google Tag Manager container with every tag behind its consent check. More in Tracking, consent banner and tag scan.

What Consent Mode is — and what it is not