Consent Mode and CMPs

Under GDPR and ePrivacy, you generally need explicit consent before setting non-essential cookies or sharing data for advertising. But blocking all tags when consent is denied means losing measurement entirely.

Google Consent Mode is a bridge: tags read the user's consent choices and adjust their behavior, sending either full data, privacy-preserving signals, or nothing at all.

Consent Mode v2 defines four key states. Two existed before: analytics_storage and ad_storage. Two were added for v2: ad_user_data and ad_personalization.

Each is either 'granted' or 'denied'. ad_user_data governs whether user data may be sent to Google for ads; ad_personalization governs whether it may be used for personalized advertising and remarketing.

The flow has two steps. First, a default command runs before any tags fire, usually setting everything to denied for EU users. Then, after the user clicks the banner, an update command reflects their actual choice.

Setting the default before tags load is critical, otherwise tags may fire with full tracking before consent is captured, which is a violation.

Basic Consent Mode blocks Google tags entirely until consent is granted; no pings are sent before. Advanced Consent Mode loads tags immediately but, when consent is denied, sends cookieless 'pings', anonymous signals with no identifiers.

Advanced mode feeds Google's conversion modeling, which estimates the conversions you cannot observe directly. It usually recovers more data, but is a bigger compliance discussion.

In advanced mode with consent denied, Google still receives a minimal, cookieless ping: a timestamp, page URL, the consent state itself, and a random identifier that is not stored.

These pings carry no personal data and set no cookies, so they can be defensible. They give Google's models enough aggregate signal to estimate the unobserved conversions.

A Consent Management Platform (CMP) is the tool that shows the banner, records the user's choices, stores proof of consent, and exposes that choice to your tags.

Examples include Cookiebot, OneTrust, Usercentrics, and Didomi. The CMP is the source of truth for consent; Consent Mode is how Google's tags react to it.

For Consent Mode v2, Google requires a certified CMP for products like Google Ads remarketing and EEA traffic. A certified CMP integrates the v2 signals correctly and is on Google's approved list.

The CMP must pass the four consent parameters and integrate with the IAB Transparency and Consent Framework (TCF) where applicable. Using an uncertified or hand-rolled banner risks features being disabled.

The IAB Transparency and Consent Framework is an industry standard that encodes consent into a 'TC string', a compact token listing which purposes and vendors the user allowed.

Ad tech partners read the TC string to know if they may process data. Many CMPs emit it automatically; it is heavy machinery, so smaller sites often use a lighter Google-certified setup without full TCF.

The integration pattern: the CMP loads first and sets the Consent Mode default to denied. When the user chooses, the CMP triggers the consent update and fires a dataLayer event.

Your GTM tags then either react to Consent Mode automatically (built-in consent checks) or use triggers gated on the consent event. Order matters: CMP before GTM, default before update.

Consent travels with the event into your tagging server. Each server-side tag can check the consent state in the payload before forwarding to a destination.

So even after the browser, a denied ad_user_data signal should stop the Meta CAPI or Google Ads tag from sending. Consent enforcement must exist on both client and server.

Done right, Consent Mode plus a certified CMP lets you respect choices and still measure, through modeling, without setting unauthorized cookies. Done wrong, it becomes a fig leaf over illegal tracking.

Audit regularly: confirm defaults are denied, banners offer a genuine reject option, proof of consent is logged, and no identifying tags fire before consent.

Test your understanding of Consent Mode and CMPs.

Consent Mode v2 uses four signals (analytics_storage, ad_storage, ad_user_data, ad_personalization) set to granted or denied, with a denied-by-default then update flow. Advanced mode sends cookieless pings on denial to power modeling.

A Google-certified CMP is the source of truth that shows the banner, records consent, and feeds these signals (and the IAB TC string). Enforce consent on both client and server, and audit that defaults are denied before any tag fires.