Laptop showing a cookie consent banner with Reject and Accept buttons, the choice Consent Mode v2 passes to Google tags

Part of every Tracking Build

Consent Mode v2 and cookie consent, wired into every tag

Consent Mode v2 makes every tag obey the visitor's banner choice, while GA4 and Google Ads keep the signals they are allowed to use. We connect Cookiebot, OneTrust, CookieYes or Usercentrics, set basic or advanced mode, hold every other Tag Manager tag to its consent, and test each banner state for GDPR, UK GDPR, CCPA and the DPDP Act.

Do your tags wait for the banner? Check with the test script below. Open the script

Test script

Check Consent Mode v2 yourself: a test script for each banner state

Three runs in one browser, one for each state of the banner. Each run says what to open, what to look for and the result that passes. Basic and advanced mode pass on different evidence, which is why the script asks for your mode first.

Fresh windowOpen a new incognito window. A stored choice from an earlier visit would skew the runs.
Blockers offPause ad blockers and privacy extensions. They hide the very requests the script looks for.
Tag Assistant onConnect Tag Assistant to the page through your container's Preview mode.
DevTools openNetwork tab, Preserve log ticked. Testing regional defaults? Run from that region, for example over a VPN.

Consent Mode v2 test scriptTag Assistant and Chrome DevTools, one browser

Your mode

Defaults denied, vendor tags silent, analytics and ad cookies absent.
Updates denied, and nothing new fires on the next page.
Updates granted, and vendor tags fire on the click itself.

Run 1 of 3

No choice yet

Banner open, nothing clicked

Tag Assistant
In the Summary, select the earliest Consent event and read its API Call. A tag's Consent tab shows the same values in the On-page Default column.
Passad_storage, analytics_storage, ad_user_data and ad_personalization all denied for EEA and UK visitors, set before any tag fired.
FailA signal missing, or Tag Assistant reporting that a tag fired before the default was set.
DevTools, Network
Filter the request list for collect and open any GA4 hit.
PassNo request to google-analytics.com, and nothing to Google Ads./g/collect requests carrying gcs=G100 and no _ga cookie: the cookieless pings advanced mode sends.
FailAny GA4 or Google Ads request before a choice: a Google tag is loading early.A gcs value other than G100, or a hit with no gcs at all, which means the tag never received a consent state.
DevTools, Network
Filter for facebook.com/tr and px.ads.linkedin.com, plus any other vendor your container loads. Microsoft Clarity may still send cookieless requests here; its cookies are checked in the next step.
PassAn empty list.
FailAny request. That tag has no consent check in Tag Manager.
DevTools, Cookies
Under Application, open Cookies for your domain.
PassNone of _ga, _ga_ plus your measurement ID, _gcl_au, _fbp, or Clarity's _clck and _clsk. The consent platform's own record of the choice is expected.
FailAny analytics or ad cookie written before a click.

Run 2 of 3

Reject all

Click Reject, then reload

Tag Assistant
Click Reject all, then select the newest Consent event, or read the On-page Update column.
PassAll four signals updated to denied.
FailNo update event: the banner recorded the refusal and never told Google's tags.
DevTools, Network
Keep the collect filter on, reload, then open a second page.
PassStill nothing sent to Google, on either page.Pings continue, still carrying gcs=G100.
FailAny request to Google after the Reject.G101, G110 or G111 on any hit after the Reject.
DevTools, Network
Repeat the vendor filters on both pages.
PassStill empty after the reload and on the second page.
FailA vendor tag firing on the next page view, a sign its trigger ignores the stored choice.
DevTools, Cookies
Check Cookies again after the reload.
PassStill no analytics or ad cookies. The consent platform stores the refusal.
Fail_ga or _fbp appearing once the page reloads.

Run 3 of 3

Accept all

New window, click Accept

Tag Assistant
Open a new incognito window, click Accept all, then read the newest Consent event.
PassAll four signals updated to granted.
FailOne signal left denied, for example ad_user_data on a CMP template that predates Consent Mode v2.
DevTools, Network
Filter for collect again.
PassGA4 hits now carry gcs=G111 in both modes, and Google Ads requests follow the click with full consent.
Failgcs stuck at G100 after the Accept.
DevTools, Network
Filter for the vendors once more.
Passfacebook.com/tr and the other vendors fire straight after the click, on the consent platform's event in Tag Assistant.
FailNothing until the next page view: the tags are triggered by page views instead of the consent event.
DevTools, Cookies
Read Cookies one last time.
PassThe cookies your tags use, such as _ga, _gcl_au and _fbp, now written.
FailAnalytics cookies still missing: a consent category mapped to the wrong signal in the CMP.

Reading gcsThe consent value inside each GA4 and Google Ads request

G100ad_storage deniedanalytics_storage denied
G110ad_storage grantedanalytics_storage denied
G101ad_storage deniedanalytics_storage granted
G111ad_storage grantedanalytics_storage granted

Requests also carry gcd, a longer code that covers all four signals. Tag Assistant's Consent tab is the easier place to read those. The script follows Google's Consent Mode and Tag Assistant documentation; run 1 is the state our free GA4 audit tool checks from outside, and Waftr runs all three before a consent build goes live.

Definition and modes

Consent Mode v2: basic or advanced?

Consent Mode v2 is Google's way of passing each visitor's choice to Google tags through four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization. Both modes respect that choice. They differ in what Google tags do while consent is denied: stay unloaded, or load and send cookieless pings.

Basic

Google tags wait

Before a choice: Google tags are blocked from loading. Nothing reaches Google.
After Reject: Still nothing, not even the consent state.
After Accept: Tags load and measure with cookies.
Modeling: Google Ads conversion modeling from a general model.
Test evidence: No /g/collect request before Accept.

Advanced

Google tags load, denied

Before a choice: Google tags load with every signal denied and send cookieless pings.
After Reject: Pings continue, without cookies or identifiers.
After Accept: Full measurement with cookies.
Modeling: An advertiser-specific model in Google Ads, plus GA4 behavioral modeling once the property meets Google's thresholds.
Test evidence: gcs=G100 on hits before Accept.

Privacy laws

Who has to opt in, and who can opt out: GDPR, UK GDPR, CCPA and the DPDP Act

What GDPR, UK GDPR, CCPA and the DPDP Act require for analytics comes down to timing. The EU, UK and Indian laws expect consent before non-essential tracking; California's expects a clear way to opt out. Each row shows what that means for analytics and ad tags, and what Waftr configures in the consent platform.

What each privacy law requires for analytics tags
Law	Who it covers	Analytics and ad tags	What Waftr configures
GDPR and ePrivacyOpt-in	People in the EU and EEA	No non-essential cookies or tags before a clear, affirmative choice. Withdrawing consent must be as easy as giving it.	Defaults denied for EU and EEA visitors, reject as visible as accept, choices logged by the consent platform.
UK GDPR and PECROpt-in	People in the UK	Opt-in for non-essential cookies. The Data (Use and Access) Act 2025 adds narrow exemptions, including some analytics, so confirm scope with counsel.	UK rules kept separate from EU rules in the consent platform wherever your counsel decides they differ.
CCPA, as amended by CPRAOpt-out	California residents, for businesses that meet its thresholds	Notice at collection, a Do Not Sell or Share My Personal Information link where ad tags share data, and Global Privacy Control signals honoured.	Opt-out flow, Global Privacy Control detection, and ad signals set to denied when a visitor opts out.
India DPDP Act 2023Consent	Digital personal data of people in India	Consent that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action after a plain notice, and as easy to withdraw.	For DPDP Act website compliance: notice and banner in English and Indian languages where needed, consent records, and withdrawal from every page.

This summarises what each law means for analytics tags. It is not legal advice: your counsel sets the policy, and Waftr implements it in the consent platform and Tag Manager.

CMP wiring

Google Consent Mode in Tag Manager: wiring your CMP step by step

Google Consent Mode works only when the consent platform runs first and each tag reads its result. The wiring takes the same four moves whichever CMP you use.

Consent Initialization - All Pages
Connect Cookiebot or OneTrust to Google Tag Manager
The CMP's template, or its script above the container snippet, sets a default for each of the four signals, per region, before anything else runs.
Initialization - All Pages
Let Google tags read the state
The Google tag and the Google Ads tags apply their built-in consent checks. Nothing extra is needed for them in Tag Manager.
CMP data layer event
Update on the visitor's click
The CMP sends the consent update and pushes its own event. That event becomes the trigger for tags that need consent.
Require additional consent
Hold the other vendors
Meta, LinkedIn and other non-Google tags get an additional consent check mapped to the right signal, and fire on the CMP's event.

Run 1, no choice yetNexTranslate, before and after the Build

NexTranslate consent test with no banner choice made: each tag before and after the Tracking Build
Tag	Before	After
GA4	Fired before a choice	Waits for Accept
Google Ads	Fired before a choice	Waits for Accept
Meta Pixel	Fired before a choice	Waits for Accept
Other marketing tags	Fired before a choice	Waits for Accept

Tags waiting for consent, beforeNone

After, verified by test100%

Case study

NexTranslate case study: Consent Mode v2 tested tag by tag

Before the build, GA4, Google Ads, the Meta Pixel and the other marketing tags all fired before the translation startup's visitors had made a choice in the banner. The Tracking Build set up Cookiebot, Consent Mode v2, GA4 and Google Tag Manager to the strictest of three laws, so a single setup covers all of them.

Stack: Cookiebot and Consent Mode v2, with GA4 and Google Tag Manager
Standards: GDPR, CCPA and the DPDP Act
Proof: The no-choice test, repeated after the build: 100% of tags wait for consent

Read the NexTranslate case study

FAQ

Before you change your cookie banner

Platforms, laws, data loss and the quote. Container work sits with our Google Tag Manager consultant service, and consent on a tagging server is covered under server-side tracking.

What is cookie consent implementation?

Cookie consent implementation is the setup that makes tags obey each visitor's privacy choice. A consent platform shows the banner and records the choice, Consent Mode v2 passes it to Google tags, and Tag Manager holds back other tags until their consent is granted. The job ends with tests in the no-choice, Reject and Accept states.

Do I need Consent Mode v2?

If you run Google Ads or GA4 and get visitors from the European Economic Area or the UK, yes. Google requires Consent Mode v2 signals to keep using measurement, ad personalization and remarketing for those visitors, and the signals make conversion modeling possible. Our free GA4 audit tool checks your Consent Mode v2 defaults from outside.

How do Cookiebot and OneTrust connect to Google Tag Manager?

Through Consent Mode v2. Cookiebot or OneTrust runs on the Consent Initialization trigger, sets a default for each signal before any tag fires, then sends an update when the visitor chooses. Google tags read that state directly. Other tags get an additional consent check and fire on the platform's consent event. Waftr has set up both, plus CookieYes and Usercentrics.

Cookiebot or OneTrust: which consent platform should we use?

Both work with Google Tag Manager and Consent Mode v2. Cookiebot suits smaller sites that want automatic cookie scanning and a quick setup. OneTrust suits larger organisations with several regions, a preference centre and privacy workflows. CookieYes and Usercentrics are also options, and the choice comes down to your traffic, regions and budget.

What does a GDPR cookie consent setup need on a website?

A GDPR cookie consent setup needs five things: no non-essential tags before a clear, affirmative choice; defaults denied for EU and EEA visitors; Reject as visible as Accept; withdrawal as easy as giving consent; and each choice logged by the consent platform. UK visitors fall under UK GDPR and PECR. This is a summary and is not legal advice.

Will cookie consent reduce our GA4 numbers?

Yes. Observed numbers drop when visitors decline, and that drop is expected. In advanced mode, GA4 can fill part of the gap with behavioral modeling once the property meets Google's data thresholds. A tested setup loses only the data visitors refused, and a Google Analytics audit measures how large that share is.

Does the DPDP Act apply to our website?

It can, even if you are outside India. The Digital Personal Data Protection Act covers digital personal data processed in India, and processing outside India when you offer goods or services to people in India. Your counsel confirms the scope. For DPDP Act website compliance, Waftr implements the notice, the consent and the withdrawal flows.

How much does cookie consent implementation cost?

Cookie consent implementation is quoted inside a Tracking Build, in writing, after an Audit or the free scan. The quote depends on the sites and consent regions in scope, the tags to hold back and any server-side container. A Core Build takes 3 to 4 weeks, and the CMP licence is billed by the vendor.

Tracking Build

Cookie consent implementation inside a Tracking Build

Consent goes in before Tag Manager is rebuilt. Retrofitting it after the tags are live is the most common way consent setups fail.

Core Build3 to 4 weeks

Consent platform set up or repaired
Consent Mode v2, basic or advanced
Non-Google tags held to their consent
The three test runs, per region, before publishing

Advanced Build5 to 8 weeks

Also passes consent to a server container for server-side tracking.

Tracking Care3-month minimum

Keeps the CMP, cookie declarations and tag mappings current after each site release. Plus and Pro add release QA.

CMP licences, such as Cookiebot or OneTrust, are billed to you by the vendor. Not sure what fires today? A GTM audit lists every early tag first.

The Waftr team holds OneTrust, Google Analytics and Google Tag Manager certifications, from 13 years in digital analytics across 10+ industries and 50+ global teams.