Consent Mode v2: the step-by-step GTM setup

Contents

• What changes with Consent Mode v2 and why it matters to you
• Prerequisites before touching GTM
• Step 1: enable the CMP and consent settings in GTM
• Step 2: configure default consent and its update
• The mistakes that break your tracking (and how to avoid them)
• Make your post-consent tracking reliable and monitored with Lysible
• Want tracking that holds up over time? Lysible monitors your consent signals
• Frequently asked questions

What changes with Consent Mode v2 and why it matters to you

Consent Mode v2 adds two signals to the two existing ones. All four must travel from your banner to the Google tags, no exceptions. Otherwise your ad audiences stop being fed.

The first version handled analytics storage and ad storage. The second one grafts on two parameters tied to user data for advertising. analyticsstorage lets GA4 place its measurement cookies. adstorage allows the advertising cookie, the one that links an ad to a purchase. aduserdata tells Google whether it can use the visitor's data for advertising. ad_personalization tells it whether it can use that data for remarketing. These last two are the newcomers in v2. Their absence alone is enough to empty your lists.

The stakes are not theoretical. According to Google's official documentation on Consent Mode, without passing ad_user_data and ad_personalization, remarketing lists stop filling up in the EEA. An online retailer that used to re-target abandoned carts watches that audience drain within a few weeks. It all happens silently, with no alert in the interface. This shift is part of the wider move driven by the Digital Markets Act (DMA), the European regulation that governs large digital platforms. The European Commission sets out the scope of the DMA and aims to regulate how gatekeepers use data. This regulatory pressure is also pushing the market toward a cookieless web, where measurement increasingly relies on modeling.

What exactly is Google's Consent Mode?

It's a mechanism that adjusts how your tags behave based on the response to the cookie banner. If the visitor refuses, the tags do not place cookies. They can send an anonymous signal, without any identifier. Google uses it to estimate missing conversions through statistical modeling.

Basic or advanced: which mode should a small business choose?

Basic mode is not right for a site that invests in Google Ads. The gain in legal safety is marginal, because the advanced ping stays anonymous. In return, you lose all data on every refusal.

In basic mode, no tag loads until the visitor clicks "accept". Refusals go straight to the bin. In advanced mode, an anonymized ping fires as soon as the page loads, even before the banner response. That gives Google the material to model lost conversions. For a small business that lives on paid acquisition, advanced mode is almost always the right call.

A field example makes the difference tangible. An e-commerce small business, around 900 monthly conversions, was running in basic mode with a refusal rate near 40%. In plain terms, nearly 360 conversions a month were no longer tied to their campaigns after refusal. After switching to advanced mode, modeling reattributed a large share of those lost conversions back to the Ads campaigns. The account regained enough data to optimize its bids, where it had previously been flying blind on truncated numbers.

According to Statista, which tracks search engine market share, Google remains largely dominant in Europe. Neglecting its signals therefore means cutting off most of your measured visibility.

Prerequisites before touching GTM

Three building blocks must be in place before you open Tag Manager: a Google-certified CMP, GTM installed correctly, and GA4 linked to Google Ads. Skipping this check means spending an hour configuring a setup that will never activate.

The CMP (Consent Management Platform, the tool that displays and manages your cookie banner) is the critical point. It must appear among Google's certified partners and comply with the IAB Europe TCF v2.2 framework. Without certification, conversion modeling does not activate. That holds true even if your banner works visually.

Is cookie consent mandatory?

Yes, for any cookie that isn't strictly necessary for the site to function. The CNIL requires free, informed and unambiguous consent before any measurement or advertising tracker is placed. Refusing must be as easy as accepting. A banner without a "reject all" button at the first level is unlawful. Fines have already been handed down against major players.

Which CMP to choose, and why it must be Google-certified?

Choose a CMP from Google's list of certified partners, otherwise modeling stays off. Three solutions cover most small business needs: Axeptio (French, affordable pricing), Cookiebot (by Usercentrics, very widespread), OneTrust (robust, but oversized for a very small business).

Before finalizing your choice, check that the CMP actually writes the consent commands into the GTM data layer. This is the point that breaks most often, well before the tags are set up. If you're starting from scratch on the measurement ecosystem, it's better to first get to grips with GA4 step by step before adding the consent layer.

Step 1: enable the CMP and consent settings in GTM

First, enable the additional consent settings in your GTM container settings. Without this, your tags will never listen to the signals. It's a hidden switch, forgotten in most installs I open up.

Go to the GTM workspace, click Admin, then Container Settings. Tick the box Enable consent overview in tag settings. This adds a "Consent" tab to each of your tags. There you declare the signals it waits for before firing.

Then install your CMP. Certified CMPs offer a template in the GTM template gallery. Search for the name of your tool (Axeptio, Cookiebot) under Tag Templates, import it, then trigger it on Consent Initialization - All Pages. This special trigger loads before everything else.

Where do you enable the additional consent settings?

In the Consent tab of each Google tag (GA4, Google Ads). Open the tag, expand Advanced consent settings, and declare the required consents. A GA4 tag waits for analytics_storage. An Ads conversion tag waits for ad_storage, ad_user_data and ad_personalization. If you leave it on "No additional consent required", the tag ignores the refusal and fires anyway. This mistake is probably the most common one.

Step 2: configure default consent and its update

The default state must deny all storage before the visitor responds. Then an update command applies their actual choice. Order matters. The "default" fires first, when the page opens. The "update" follows as soon as the banner is clicked. Reversing that order produces data Google cannot use.

The consent default command sets all signals to "denied" as soon as the page loads. This is the setting that makes the install compliant: nothing leaves with an identifier before consent. When the visitor clicks "accept", the CMP sends consent update, which switches the accepted signals to "granted". Certified CMPs handle both commands automatically once the template is in place.

Take a seasonal online retailer with heavy volume in the last quarter. If its default is misconfigured and an Ads tag fires before the update, two problems arise. There's the legal risk. There's also the distorted data. Google receives conversions in an inconsistent consent state, which degrades the modeling. This kind of drift ties into the logic of a proper audit, like spotting the GA4 mistakes that distort data in small businesses.

Getting the configuration right comes down to a few things, but every detail counts. Here are the four settings to validate in this order, without skipping one:

• consent default set to "denied" for all signals when the page loads
• CMP template triggered on Consent Initialization - All Pages, before any other tag
• consent update handled by the CMP when the banner is clicked
• Each Google tag with its required signals declared in the Consent tab

The sequence looks simple on paper. In practice, it's the third point that goes wrong most often. The CMP sends the update, but the tag isn't listening. The Consent tab was left on "none required". The result: everything seems to work in the GTM preview, and nothing actually works on the modeling side.

How do you check that modeling really works?

The GTM preview proves nothing. The only reliable validation goes through GA4's Consent tab and Google Ads diagnostics. Seeing tags fire in Preview mode confirms the code runs, not that Google has turned on modeling.

In GA4, open Admin, then Data settings, then Data collection. The dedicated tab shows the transmission status of the signals. In Google Ads, the conversion tracking diagnostic flags whether Consent Mode is detected and active. These two dashboards are your only real proof. If I could only look at one indicator after an install, it would be the modeling status in Google Ads.

A cross-check between GA4 and Google Ads takes about thirty minutes by hand after every banner change. You can also run it continuously if you automate the monitoring of your conversion reporting. It's the kind of check people forget to redo three months later, when a developer touches the site theme. There's a quick browser-side test. Open the developer tools, Network tab, filter on google and reload the page without responding to the banner. You should see a ping go out with the parameter gcs=G100. This code (gcs stands for "Google consent status") means everything is denied by default. If you see gcs=G111 before any response, a signal is already granted and your default is misconfigured.

The mistakes that break your tracking (and how to avoid them)

Six mistakes come up again and again on Consent Mode v2 installs. They all share the same visible symptom. Conversions go missing, or audiences drain, with no alert in the interface. The first four take less than an hour to fix once spotted.

The last two are more insidious. They don't show up in the GTM dashboard and generate no visible error. A reversed default/update order gives Google an inconsistent consent state. The certified CMP template handles that order automatically, so never code it by hand. Validation limited to the GTM preview alone creates false confidence. You think you're compliant while modeling is dormant. Always check in GA4 and Ads, not just in GTM.

These settings on the Google tags become all the more critical as the market slides toward a cookieless model. According to IAB Europe, in its work on how the ad market is evolving, the gradual disappearance of third-party identifiers increases the weight of modeling. In other words, clean consent data becomes your main measurement lever.

What are the 3 types of cookies to distinguish?

Three families structure any compliant banner. Strictly necessary cookies run the site (cart, session, security) and require no consent. Audience measurement cookies feed GA4 and require consent, except under the CNIL's strict exemption conditions. Advertising cookies power targeting and remarketing. They always require explicit consent. Consent Mode v2 ties the last two families to its signals, with the first one falling outside the scope. This distinction directly guides how you configure your CMP.

This tracking hygiene shapes every media buying decision. Without reliable conversion data, it's hard to judge whether Google Ads is profitable or not for your small business. The cost-per-acquisition calculation rests entirely on this reporting. Getting consent configured right also feeds into reading your website traffic statistics to track correctly. A high refusal rate mechanically underestimates your measured traffic.

Make your post-consent tracking reliable and monitored with Lysible

At this stage, your Consent Mode v2 is set up and validated once. The real risk begins afterward. A theme change, a CMP update, a developer touching GTM, and your signals drop without warning. Nobody reopens the GA4 Consent tab every week by hand.

Regular monitoring of the consent rate and conversion reporting catches the drift before it distorts weeks of data. That's exactly the check we've built into Lysible. A conversion that stays invisible for a quarter costs more than a monitoring subscription. The verification time, not the data itself, is the real cost center for an organization without a dedicated data analyst.

Want tracking that holds up over time? Lysible monitors your consent signals

You've set up Consent Mode v2, checked GA4 and the Ads diagnostic. What's left is the hard part: keeping the setup reliable after every theme or CMP update. Lysible tracks the consent rate and your conversion reporting, and alerts you the moment a signal drops. To manage your tags cleanly without code, a clear Google Tag Manager guide for business owners covers the basic logic.