Consent Mode v2, in one lesson

Consent Mode is not the banner. The banner is a UI. Consent Mode is a signal — a small piece of state that Google tags read before deciding what to send. Most "we installed Cookiebot and we're compliant" setups have the banner and not the signal, and the scanner reports exactly that.

The signal

There are two calls. The first sets the default state, before any tag runs:

gtag('consent', 'default', {
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  analytics_storage: 'denied',
  functionality_storage: 'denied',
  personalization_storage: 'denied',
  security_storage: 'granted',
  wait_for_update: 500
});

The second updates it when the visitor chooses:

gtag('consent', 'update', { analytics_storage: 'granted', ad_storage: 'granted', ad_user_data: 'granted', ad_personalization: 'granted' });

ad_user_data and ad_personalization are the "v2" additions (2024). Without them, Google Ads in the EEA stops attributing conversions. If your CMP predates them, it isn't sending them.

Where the default lives: in GTM, either your CMP's template tag on the Consent Initialization – All Pages trigger, or a Custom HTML tag with the snippet above on the same trigger. That trigger exists precisely so this runs before your Google tag on Initialization. Order matters; get it wrong and the first page_view goes out with no consent state at all.

What tags do with it

Google tags (GA4, Ads, Floodlight) have consent behaviour built in:

• Basic Consent Mode: the tag doesn't load until consent is granted. Nothing sent while denied.
• Advanced Consent Mode: the tag loads regardless and sends cookieless pings while denied — no cookies, no identifiers, used for conversion modeling. When consent is granted, normal hits resume.

Advanced is the default when the Google tag is on the page and defaults are set; you get modeled conversions back in exchange for the pings. Either is legitimate. What isn't: no default set at all, so tags run as if everything were granted.

Non-Google tags (Meta, TikTok, Custom HTML) know nothing about Consent Mode. For those you use GTM's Additional Consent Checks on each tag — Require additional consent for tag to fire: ad_storage — so GTM itself holds the tag until the state allows. The auditor flags non-Google tags with this set to Not set, because "not set" means "fires regardless."

Reading it on a hit

Every GA4 request carries gcs=G1xy: x is ad_storage, y is analytics_storage, 1 granted, 0 denied.

• gcs=G100 — both denied. If you also see cookieless pings, you're in Advanced mode and it's working.
• gcs=G111 — both granted.
• gcs=G101 — ads denied, analytics granted; the typical "analytics only" choice.
• newer tags add gcd=…, a longer encoding that includes the v2 signals.

No gcs at all on a page with a CMP → the banner isn't talking to Google. That is the single most common consent finding.

gcs=G111 on the very first request with no click on the banner → defaults are granted. Correct for a US-only site by choice; a problem for EEA/UK traffic. The scanner reports it as a warning with exactly that caveat, because region defaults are a business decision, not a bug — as long as it was a decision.

Regions

Defaults can vary by region:

gtag('consent', 'default', { analytics_storage: 'denied', ad_storage: 'denied', region: ['EEA', 'GB', 'CH'] });
gtag('consent', 'default', { analytics_storage: 'granted', ad_storage: 'granted' });

Most CMPs do this for you with a "GDPR regions only" toggle. If yours does, the scanner (which runs from the US) will see granted defaults — and that's fine. Test the EEA path by connecting a VPN or by using a CMP's built-in region override, and check gcs again.

What the CMP is actually for

Now the banner makes sense: a CMP is a UI that (1) sets the default, (2) collects the choice, (3) calls update, (4) remembers it in a cookie so it doesn't re-ask. A CMP that does (2) and (4) but not (1) and (3) is decoration. Choose one that's in Google's certified CMP list and that has a GTM template — then verify with the network tab that gcs changes when you click Accept.