Google Consent Mode v2 for people who ship: the seven signals, basic against advanced, and the June 2026 change

What Consent Mode is, and is not

Consent Mode is an API that Google’s tags listen to. Before any tag runs, your page tells Google what the visitor has and has not agreed to; when the visitor decides, your page updates the message; Google’s tags change their behaviour accordingly. That is the whole mechanism. It does not block anything by itself, it does not ask anyone anything, and it does not make a banner compliant. What it does is let Google Ads and GA4 keep working, in a reduced form, for the people who said no, and work fully for the people who said yes.

That distinction matters because a lot of “Consent Mode v2 ready” banners set the signals and load the tags, and call it a day. Under the ePrivacy Directive, a tag that writes a cookie before consent is a violation whatever signal it received. The banner still has to block; Consent Mode is what you do in addition, so that blocking does not cost you your measurement.

The seven signals

Consent Mode started with two signals in 2020: ad_storage for advertising cookies and analytics_storage for analytics cookies. Version 2, which Google made mandatory for EEA advertisers in March 2024, added two more: ad_user_data, whether user data may be sent to Google for advertising, and ad_personalization, whether ads may be personalised. Those four are the ones Google Ads and GA4 act on. Three further signals cover functionality, personalisation and security storage; the last is always granted.

The signals are set twice. A default call runs before any tag loads and says denied for visitors in the EEA, the UK and Switzerland (and granted, if you like, elsewhere). An update call runs the moment the visitor chooses and carries the actual decision. The order is the thing people get wrong: if a Google tag loads before the default call, it starts with no consent state at all, which Google treats as granted. That is why the consent runtime has to be the first script in the head, and why afterInteractive in Next.js or a tag manager that loads first are both bugs.

Basic against advanced

Google offers two ways to implement the mode. In basic mode, Google tags do not load at all until consent is granted; a visitor who refuses sends nothing to Google. In advanced mode, the tags load immediately but in a restricted state: before consent, and after a refusal, they send cookieless pings with no identifiers, which Google uses to model the conversions it cannot observe. After consent, they behave normally.

Both are compliant as long as the defaults are denied before the first tag. The difference is measurement. Basic mode gives you a clean story for a data protection officer: nothing goes to Google without consent, full stop. Advanced mode gives your marketing team modelled conversions for the 30 to 40 percent of European visitors who say no, at the price of explaining cookieless pings in your privacy policy. Most sites that run Google Ads choose advanced; most sites that only run analytics choose basic. CookieCrumbs supports both and defaults to basic.

The 15 June 2026 change

Since 15 June 2026 Google uses ad_storage as the controlling signal for Google Ads data. Before that date a banner that mapped only analytics_storage to a “statistics” category and left the ads signals in their default state could still see Ads conversions arrive; since then it does not. The practical consequence: your banner’s Marketing category has to drive ad_storage, ad_user_data and ad_personalization together, and Analytics has to drive analytics_storage. A mapping that treats all four as one blob is legal but wasteful; a mapping that forgets ad_storage loses the measurement you set the whole thing up for.

CookieCrumbs maps the categories to the signals automatically and ships the same mapping in its Google Tag Manager template, so the triggers in your container fire on the right signal without a hand-written listener. If you maintain your own mapping, check it against the table in the Consent Mode guide.

Setting it up properly

1. Runtime first. The consent runtime is the first script in the head, before gtag.js, before GTM, before anything.
2. Defaults denied by region. EEA, UK and Switzerland get denied; elsewhere follow the local rule (US states are opt-out).
3. Categories mapped to signals. Analytics → analytics_storage. Marketing → ad_storage, ad_user_data, ad_personalization. Preferences → functionality_storage, personalization_storage.
4. Update on every decision, including withdrawals and later changes from the reopened banner.
5. Verify in Tag Assistant. Load the page with consent denied, open Tag Assistant, and read the consent state on the first tag. It should say denied for all four ads and analytics signals before you click anything.

Three mistakes that lose data

• GTM loads first. The container fires its tags with no consent state, Google treats that as granted, and your first pageview is a violation. Move the runtime above GTM.
• Marketing does not drive ad_storage. Since June 2026 that means no Ads conversions for anyone. Check the mapping.
• Advanced mode without the privacy policy line. Cookieless pings are still a transfer to Google. Say so in the policy, or use basic mode.

One more thing that is not a mistake but a limit: Consent Mode is not IAB TCF and does not make you a Google-certified CMP. For AdSense, Ad Manager and AdMob in the EEA you need one of those; for Google Ads and GA4 you need Consent Mode v2, which is what this page is about.

Sources

1. Simo Ahava, “Consent Mode v2 for Google tags”, 2024
2. Cookie Information, “Basic vs. Advanced Consent Mode v2”
3. Cookie Script, “Basic vs Advanced Google Consent Mode v2”
4. CookieCrumbs regulation watch, “Google Consent Mode change: ad_storage became the controlling signal for Google Ads data”, June 2026
5. CookieCrumbs docs, Google Consent Mode v2 guide

Written by the CookieCrumbs team, published 5 September 2026. Facts carry their dates; if one has moved on, tell us and we will correct it.