Consent Mode v2: technical guide and GDPR compliance

Google Consent Mode v2 sends four consent parameters to all Google products — analytics_storage, ad_storage, ad_user_data and ad_personalization — and directly determines access to advertising and measurement features for traffic from the European Economic Area. Since March 2024, any site using Google Ads or Google Analytics 4 (GA4) with EEA traffic must send these four signals to retain full access to conversion reporting, remarketing audiences and modeling. The priority action is simple: check that your consent management platform (CMP) correctly maps its categories to the four API parameters, and initialize all these parameters to denied for the EEA before loading any Google tag.

Three points to keep in mind before going further:

Pro tip: Before any change, export a snapshot of your Google Ads conversions and GA4 reports for the last 30 days. This baseline will be essential for measuring the impact after deployment.

Consent Mode v2 requires sending the four consent parameters (analytics_storage, ad_storage, ad_user_data, ad_personalization) before loading any Google tag, initialized to denied for the EEA — this is the minimum condition for remaining compliant and preserving conversion modeling.

The Consent API relies on two distinct gtag calls, whose execution order is non-negotiable according to Google's official documentation:

If default is called after a Google Tag Manager tag or gtag.js loads, the parameters are ignored for that session. This is the most common production error.

Google distinguishes two behaviors depending on the mode chosen:

Google products incorporating Consent Mode checks include GA4, Google Ads, Floodlight, Conversion Linker and Google Tag. In server-side tagging (sGTM), the consent signal must be explicitly propagated to the server container: it is not automatically transmitted from the browser.

Pro tip: In advanced mode, check in the network console that cookieless pings are sent with all four consent parameters in the payload. A ping without `ad_user_data` indicates incomplete CMP mapping.

Pro tip: The most common errors according to field audits are a CMP loading too late (after GTM), incomplete mapping that omits `ad_user_data`, and failure to send the signal to the sGTM container. Check these three points first during acceptance testing.

Consent Mode v2 is a signal transmission channel, not a standalone compliance system. This confusion underlies most legal risks observed in production.

The most common operational risks, documented by field audits:

Consequences of a faulty implementation may include CNIL formal notices, fines for placing trackers without valid consent, and an obligation to demonstrate compliance over a retrospective period. Involve your DPO in acceptance testing, retain initialization logs and document every version of the CMP mapping.

This article provides general information and does not constitute legal advice. Consult your DPO or specialist counsel to validate compliance for your specific situation.

A poorly executed Consent Mode v2 deployment does more than break compliance: it silently distorts Google Ads automated bidding, which relies on conversion signals to optimize campaigns. When input data is corrupted by incorrect mapping or a faulty call sequence, the bidding algorithm makes decisions on a biased basis. Marketing teams then see CPA deteriorate without identifying the cause, because the problem is invisible in standard reports.

What I observe on audit projects is that most problems do not stem from a lack of Consent Mode knowledge, but from silos between teams. Marketing configures the CMP without consulting the CIO about script loading order. The CIO deploys GTM without validating the mapping with the DPO. The result: an implementation that is technically present but functionally faulty, passing superficial checks and failing in production.

The right approach is a joint project, with documented acceptance testing and post-deployment monitoring for at least 14 days. Clients following this method with Pharelia, such as those documented in our Applewood client cases and M2A, were able to stabilize measurement and resume optimization decisions based on reliable data. Data continuity is not a technical detail: it is the condition for any credible marketing decision.

Faulty CMP mapping or incomplete acceptance testing can cost weeks of corrupted data and Google Ads campaigns optimized on bad signals. Pharelia handles the complete audit of your Consent Mode v2 implementation: tag inventory, call-order verification, CMP mapping to the four parameters, multi-scenario GTM acceptance testing and post-deployment monitoring.

The project starts with a free audit, then continues as monthly support or a one-off project depending on your needs. You leave with an audit report, an implementation playbook and a secured GTM container. For teams also managing visibility in generative engines, our resources on AI search visibility naturally complement this measurement work.

Contact us.

The resources below are arranged in recommended reading order: Google technical documentation first, legal texts next, practical guides last.

Google technical documentation

European legal texts

French practical guides

Yes, since March 2024, any site using Google Ads or GA4 with traffic from the EEA must implement Consent Mode v2 to retain full access to measurement and conversion features.

Basic mode completely blocks Google tags before consent; advanced mode loads them in a restricted state and sends cookieless pings to feed conversion modeling, at the cost of greater technical complexity.

No. Consent Mode is a technical signaling channel that transmits consent states to Google. Collection, storage and evidence of consent remain the responsibility of your CMP and organization.

The first effects on conversion reports are generally visible after 7 days, but a monitoring period of at least 14 days is recommended to distinguish Consent Mode's impact from natural traffic variation.

Enhanced Conversions and advertising audience lists do not work properly. Google cannot associate conversion data with users, degrading the quality of automated bidding signals in Google Ads.