Consent Mode v2 for Small Businesses: What You Need and Why

If you advertise with Google and some of your visitors are in Europe, you have probably seen warnings about “Consent Mode v2”. The short version: it is a small piece of code that tells Google’s tags what each visitor chose on your cookie banner. Without it, Google’s tags can’t tell which visitors agreed, and for European traffic Google says you need to share those consent choices to keep using its tags for measurement and remarketing.

What Consent Mode v2 is

Google describes consent mode as a way to adjust tag behavior based on user consent choices. In plain terms:

1. Your cookie banner asks the visitor what they agree to.
2. Consent mode passes that answer to Google’s tags as a set of signals, each either granted or denied.
3. Google’s tags change what they do to match. For example, if a visitor denies advertising cookies, Google’s consent-aware tags don’t store cookies.

These are the four signals that matter for ads and analytics, in Google’s words:

Signal	What it covers
ad_storage	Storage such as cookies related to advertising
ad_user_data	Sending user data to Google for online advertising
ad_personalization	Personalized advertising, such as remarketing
analytics_storage	Storage such as cookies related to analytics, for example visit duration

Google’s consent mode overview lists the tags with consent checks built in, including the Google tag, Google Analytics, Google Ads conversion tracking and remarketing, Floodlight and the Conversion Linker. They read these signals on their own. You don’t have to rebuild each tag.

What changed from v1 to v2

The first version had two main signals, ad_storage and analytics_storage. Google updated consent mode in November 2023 and added two more: ad_user_data and ad_personalization. That update is what people call “v2”.

The new signals split “can Google use cookies?” from “can Google use this person’s data for ads?”. That matters for features that don’t depend on cookies:

• Enhanced conversions. Google’s consent mode overview says that when ad_user_data is denied, personal data collection for online advertising is turned off. That includes the hashed first-party data, such as email addresses, that enhanced conversions uses.
• Customer Match. Google’s Customer Match consent FAQ says that since March 2024, Customer Match lists used in the EEA need both ad_user_data and ad_personalization set to granted. Data from EEA users without that consent is not processed. Note that this consent is sent with the list when you upload it. Your website’s consent mode doesn’t set it for you.
• Personalized ads. When ad_personalization is denied, the overview says remarketing in Google Ads and other personalized advertising don’t receive that visitor’s data. Google’s EEA page adds that if it conflicts with an older personalization setting, personalization is turned off.

If your banner was set up before 2024 and only sends the two old signals, it is probably running v1. Updating it is usually a setting in your consent tool, not a rebuild.

Do you need it?

Google’s EU user consent policy covers end users in the European Economic Area (EEA), the UK and Switzerland. The EEA is the 27 EU countries plus Iceland, Liechtenstein and Norway, as the EU’s statistics office defines it. If you use Google Ads or Google Analytics and get visitors from those places, Google’s EEA update page says you must collect consent from EEA users and share consent signals with Google to keep using its tags for measurement, ad personalization and remarketing.

That page sorts advertisers into four situations, which make a handy checklist:

Your situation	What Google asks
Consent mode already set up, no personalized ads	No action needed
Consent mode set up, you want personalized ads	Make sure your banner sends v2 signals. Google says certified consent tools update automatically, so check you are on the latest version
A banner, but no consent mode	Turn on consent mode in the banner, or add it
No banner and no consent mode	Set up a banner, use the Google tag (gtag.js) or Google Tag Manager, then add consent mode

What if all your customers are in the US, Canada or Australia? Google’s EEA rules then matter less for you. But privacy laws exist outside Europe too, and they change. Whether you need a banner for those visitors is a question for a privacy adviser, not for a tag setting. What consent mode can do is apply different defaults by region. For example, it can start EEA, UK and Swiss visitors as denied and everyone else as granted.

You still need a consent banner

This is the most common misunderstanding. Google says plainly that consent mode doesn’t provide a consent banner or widget. It also says you are responsible for obtaining users’ consent, and suggests you consult your legal team on the right consent solution.

So you need two separate things:

• A consent banner or consent management platform (CMP). A CMP is a service or plugin that shows the banner, records each visitor’s choice and lets them change it later. Google’s EU user consent policy also asks you to keep records of consent and give clear instructions for withdrawing it.
• Consent mode. The code that hands the banner’s answer to Google’s tags.

Many CMPs include consent mode as a setting you switch on, and Google names some of them as certified partners. For most small businesses, a tool like that is the simplest route: one product asks the question, stores the answer and passes it to Google.

Basic vs advanced consent mode

Google offers two ways to set it up. The difference is what happens before and after a visitor says no.

Google’s overview compares them like this:

• Basic. Google tags are blocked until the visitor interacts with the banner. No data is sent before they consent, not even the consent status. Conversion modeling uses a general model. Google’s EEA update page also warns that when tags are blocked this way, Google can’t verify consent choices, which may lead to data loss.
• Advanced. Tags load straight away with defaults set to denied. While consent is denied, they send the consent state and measurements without cookies, often called “cookieless pings”. Conversion modeling uses an advertiser-specific model.

“Conversion modeling” means Google estimates the conversions it couldn’t observe directly, for visitors who declined. Two honest notes for small businesses:

• Modeling needs volume. Google’s verification guide gives a threshold of 700 ad clicks over 7 days for a domain and country group before modeling starts. Below that, you mostly see the conversions from visitors who said yes.
• Advanced sends some data before consent. It is cookieless, but it is not nothing. Whether that fits your privacy approach is a decision for you and your adviser, not a technical one.

Basic is simpler and sends less. Advanced keeps more measurement. Neither one changes what your banner must ask.

What to set up

Whichever mode you pick, a working setup has the same four parts. Google’s setup guide says “the order of the code here is vital”, so the order below matters.

1. A default, on every page, before any Google tag. A short gtag('consent', 'default', …) command sets the starting signals, usually denied for the regions your policy covers. It must run before the Google tag or Tag Manager snippet sends anything. If it runs later, the defaults don’t work.
2. The Google tag or Tag Manager. Your normal Google Ads and Analytics setup, loading after the default.
3. Your banner. It asks the visitor and stores the answer.
4. An update when the visitor chooses. A gtag('consent', 'update', …) command sends the new signals on the page where the visitor clicked. On later pages, your banner sends the saved choice again.

How that looks depends on how your site is built:

• A consent tool with consent mode built in. Turn on its Google consent mode or “v2” setting, and set the regions. This covers most small sites.
• Google Tag Manager. Add your consent tool’s tag and set it to run on the built-in trigger called Consent Initialization - All Pages. Google’s Tag Manager help says this trigger always fires before every other tag, so the consent default is in place before anything else runs.
• Your own banner code. Write the default and update yourself. The Consent Mode v2 code generator builds both pieces for the Google tag code in your page, Tag Manager or a Shopify theme. You choose basic or advanced and the regions, and it can also check the order of code you already have.

Two region details catch people out. Region codes follow the ISO standard, so the United Kingdom is GB, not UK. And a default without a region applies to everyone not covered by a region-specific default.

How to check it is working

You can check it yourself in a few minutes with Google Tag Assistant. These steps follow Google’s verification guide:

1. Start a Tag Assistant session on your site’s address.
2. Check the default. Select the earliest Consent event and open the Consent tab. The On-page Default column should show “Denied” for the signals your banner covers. If you set defaults only for some regions, test as a visitor from one of them.
3. Accept the banner, then check the update. Select the latest Consent event. The On-page Update column should now show “Granted”.
4. Check the tags. In the Tags tab, click a tag to see whether it fired or was held back as expected.

Google’s troubleshooting page covers the usual problems. An empty Consent tab means consent mode isn’t on the page or the Google tag was blocked. “Default consent set too late” means the default must move above the Google tag. If the state never changes after you click, your banner isn’t sending the update.

Then check Google Ads. Consent mode status appears in the Diagnostics tab of each website conversion action. Google says it can take 48 hours to appear, and up to 2 weeks in some cases. If Tag Assistant shows a correct setup, give the status time before you change anything.

Microsoft, Meta and other ad platforms

Google’s Consent Mode passes signals to Google’s tags. Don’t assume any other platform’s tag follows them.

Microsoft Advertising has its own version. Microsoft’s UET and user consent FAQ says advertisers using its Universal Event Tag (UET, Microsoft’s tracking tag) must send consent signals, through either Consent Mode for UET or the IAB’s Transparency and Consent Framework (TCF). Microsoft enforces this for all advertisers with end users in the EEA, the UK and Switzerland, from its adoption date of May 5, 2025. Without those signals, Microsoft says it “will stop tracking your UET-based conversions and populating your remarketing lists”. The same FAQ says Microsoft currently enforces consent based on ad_storage, recommends advanced mode, and lists consent tools with UET consent mode built in. If you run Microsoft Ads, switch on its consent mode in your consent tool as well.

For the Meta Pixel, the TikTok pixel and the rest, your banner or CMP still has to decide when those tags may load. Many consent tools do this by sorting tags into groups, such as “marketing”, and loading them only after the visitor agrees to that group. Check your consent tool’s settings for every ad platform you use, not just Google.

The same goes for data you send from your own server, such as a Meta Conversions API event or an offline conversion upload. Consent mode doesn’t cover those, so ask your adviser how your consent choices should apply to them. For how click IDs from Meta ads are passed to its server API, see Meta Conversions API parameters.

The setup is not big for a small business: a banner that asks properly, consent mode switched on in the right order for each ad platform, and ten minutes in Tag Assistant to prove it works.