Google Consent Mode lets your tags adapt their behavior based on a visitor's consent choices. When someone declines analytics cookies, for example, Google Analytics stops storing cookies but can still collect cookieless pings for conversion modeling. The result: you keep some measurement capability without violating the visitor's decision.
This guide walks through setting up Consent Mode inside Google Tag Manager (GTM), the environment where most websites manage their tracking tags. By the end, your GTM container will default to a privacy-safe state, update consent signals when a visitor interacts with your cookie banner, and let Google's tags respond accordingly.
Prerequisites
You need a Google Tag Manager container already installed on your site, plus a cookie consent banner (like CookieBeam) that fires consent events. This guide assumes you have both in place.
What Consent Mode Actually Does
Consent Mode is not a cookie banner and it is not a consent management platform. It is a signaling layer between your CMP and Google's tags. Your banner collects the visitor's choices. Consent Mode translates those choices into a format that Google Analytics, Google Ads, and Floodlight understand.
There are seven consent types that Consent Mode recognizes:
| Signal | Controls | Default |
|---|---|---|
| ad_storage | Advertising cookies (Google Ads, remarketing) | denied |
| ad_user_data | Sending user data to Google for advertising | denied |
| ad_personalization | Personalized advertising and remarketing | denied |
| analytics_storage | Analytics cookies (GA4, Universal Analytics) | denied |
| functionality_storage | Functional cookies (language preferences, UI state) | granted |
| personalization_storage | Personalization cookies (recommendations, content) | denied |
| security_storage | Security cookies (authentication, fraud prevention) | granted |
When a signal is set to denied, the corresponding Google tag adjusts its behavior. GA4, for instance, stops writing _ga and _gid cookies but still sends cookieless pings. Google Ads stops writing conversion cookies but can still model conversions from the aggregated, cookieless data. This is what Google calls conversion modeling and behavioral modeling.
Step 1: Set the Default Consent State
Before any tags fire, your container needs to declare the default consent state. In the EEA and UK, the safe default is to deny everything except functionality and security storage. Visitors outside those regions can get different defaults if your legal team permits it.
In GTM, this is done with a tag that fires on the Consent Initialization trigger, which runs before all other triggers.
Create the default consent tag
Open your GTM container and create a new tag
Go to Tags > New. Name it something clear like Consent Default - Denied.
Choose the tag type
If you use the CookieBeam GTM template (recommended), select it from the Community Template Gallery. It handles both the default and update commands automatically. If you prefer manual setup, choose Custom HTML.
Configure the default state
For the CookieBeam template, the default state is preconfigured. For a Custom HTML tag, add this script:
<script>
gtag('consent', 'default', {
'ad_storage': 'denied',
'ad_user_data': 'denied',
'ad_personalization': 'denied',
'analytics_storage': 'denied',
'functionality_storage': 'granted',
'personalization_storage': 'denied',
'security_storage': 'granted',
'wait_for_update': 500
});
</script>The wait_for_update parameter tells Google tags to wait up to 500ms for a consent update before firing. This gives your cookie banner time to load and check for a returning visitor's saved preferences.
Set the trigger to Consent Initialization - All Pages
This built-in trigger fires before any other trigger in GTM, ensuring consent defaults are in place before tags attempt to run.
Save the tag
Do not publish yet. You still need the update command.
Step 2: Send Consent Updates When the Visitor Decides
When a visitor clicks "Accept All" or saves their preferences in your cookie banner, the banner needs to fire a consent update. This tells Google's tags to switch from denied to granted for the categories the visitor accepted.
With CookieBeam, this happens automatically. The banner pushes a consent_update event to the dataLayer with the updated consent state. The CookieBeam GTM template listens for this event and calls gtag('consent', 'update', ...) with the correct values.
If you are wiring this manually, you need a second tag:
1 <script> 2 // Listen for your CMP's consent event 3 // Replace 'cookie_consent_update' with your banner's actual event name 4 gtag('consent', 'update', { 5 'ad_storage': {{ad_storage_consent}}, 6 'ad_user_data': {{ad_user_data_consent}}, 7 'ad_personalization': {{ad_personalization_consent}}, 8 'analytics_storage': {{analytics_storage_consent}}, 9 }); 10 </script>
The {{ad_storage_consent}} placeholders are GTM variables that resolve to either 'granted' or 'denied' based on the dataLayer values your banner pushed. You will need to create these as Data Layer Variables in GTM, mapped to the keys your CMP writes.
Step 3: Configure Your Tags for Consent Checks
GTM has a built-in consent checking feature. When you enable it on a tag, GTM will only fire that tag when the required consent types are granted.
Enable consent checks on a tag
Open any tag (e.g., GA4 Configuration)
Click on the tag to edit it.
Expand Advanced Settings > Consent Settings
You will see two sections: Built-in Consent Checks and Additional Consent Checks.
Check 'Require additional consent for tag to fire'
For a GA4 tag, add analytics_storage. For a Google Ads tag, add ad_storage and ad_user_data. For remarketing tags, also add ad_personalization.
Save the tag
The tag will now only fire when the visitor has granted the required consent types. If consent is later revoked (e.g., through a preferences center), the tag will not fire on subsequent pages.
Do not confuse consent checks with Consent Mode
Consent checks block a tag entirely when consent is denied. Consent Mode lets the tag fire in a degraded mode (cookieless pings). For Google's own tags (GA4, Google Ads), Consent Mode is usually better because it preserves conversion modeling. For third-party tags that have no degraded mode, consent checks are the right approach.
Step 4: Handle Regional Differences
Not every visitor needs the same default consent state. A visitor from the United States may not need prior consent for analytics under current US federal law, while a visitor from Germany certainly does under the TTDSG.
Google Consent Mode supports region-specific defaults. You can set different defaults for different countries or regions:
1 gtag('consent', 'default', { 2 'ad_storage': 'denied', 3 'ad_user_data': 'denied', 4 'ad_personalization': 'denied', 5 'analytics_storage': 'denied', 6 'region': ['AT', 'BE', 'BG', 'HR', 'CY', 'CZ', 'DK', 'EE', 7 'FI', 'FR', 'DE', 'GR', 'HU', 'IE', 'IT', 'LV', 'LT', 'LU', 8 'MT', 'NL', 'PL', 'PT', 'RO', 'SK', 'SI', 'ES', 'SE', 'GB', 9 'NO', 'IS', 'LI'] 10 }); 11 12 gtag('consent', 'default', { 13 'ad_storage': 'granted', 14 'ad_user_data': 'granted', 15 'ad_personalization': 'granted', 16 'analytics_storage': 'granted' 17 // No region = global fallback for non-EEA visitors 18 });
CookieBeam handles this automatically through its regional consent rules feature. You configure which regions require prior consent in the dashboard, and the banner + Consent Mode signals adjust per visitor.
Step 5: Verify Your Setup
A misconfigured Consent Mode setup can either block all your data (too strict) or collect data without proper consent (too permissive). Both are bad. Here is how to verify it works correctly.
Verification checklist
Open GTM Preview mode and load your site
Check the Consent tab in the Tag Assistant. You should see the default state set before any tags fire.
Verify the default state shows 'denied' for ad_storage and analytics_storage
If these show 'granted' before the visitor interacts with the banner, your default tag is misconfigured or firing too late.
Dismiss the banner without accepting and check the Consent tab
The state should remain 'denied'. GA4 should fire but show '(cookieless ping)' in its tag details.
Accept all cookies and verify the consent update fires
The Consent tab should now show 'granted' for the accepted categories. GA4 should fire normally with cookies.
Clear cookies, reload, and verify returning-visitor behavior
Your banner should remember the previous choice. The consent update should fire before tags, within the wait_for_update window.
Check the GA4 real-time report for consent_state values
In GA4 > Admin > Data Streams > your stream, look at the consent overview. You should see a mix of granted and denied traffic.
Common Mistakes to Avoid
| Mistake | Consequence | Fix |
|---|---|---|
| Default tag fires on All Pages instead of Consent Initialization | Tags fire before defaults are set; first pageview ignores consent | Move the default tag to the Consent Initialization trigger |
| Missing wait_for_update | Returning visitors' saved consent is ignored on the first pageview | Add wait_for_update: 500 to the default command |
| ad_user_data and ad_personalization not set | Google Ads rejects conversion data from EEA visitors | Add both signals to your default and update commands |
| Consent update fires but with wrong values | Tags remain in denied mode even after the visitor accepts | Verify your Data Layer Variables match the keys your CMP pushes |
| Using consent checks AND Consent Mode on Google tags | Tags are blocked entirely instead of firing in degraded mode | For Google tags, rely on Consent Mode alone; use consent checks for third-party tags |
How CookieBeam Simplifies This
CookieBeam integrates with Google Consent Mode out of the box. When you install the CookieBeam banner, it automatically:
- Sets the correct default consent state before any tags fire
- Sends consent updates when the visitor makes a choice
- Maps cookie categories to Consent Mode signals (analytics cookies to
analytics_storage, marketing cookies toad_storage, etc.) - Handles regional differences through configurable rules
- Supports the CookieBeam GTM template from the Template Gallery for one-click setup
If you are using the CookieBeam GTM template, you do not need to create Custom HTML tags or Data Layer Variables manually. The template handles the entire consent lifecycle.
Frequently Asked Questions
Do I need Consent Mode if I already have a cookie banner?
A cookie banner collects consent, but Google's tags need to know about that consent through Consent Mode signals. Without Consent Mode, your GA4 and Google Ads tags either fire normally (ignoring consent) or are blocked entirely (losing all data). Consent Mode is the bridge that lets tags adapt their behavior based on the banner's output.
Will I lose data if I implement Consent Mode?
You will lose some precision compared to unrestricted tracking, but you will retain more data than if you simply blocked tags for non-consenting visitors. Google uses the cookieless pings from denied-consent sessions to build conversion models that estimate what the full data would look like. Most sites see 70-90% data recovery through modeling.
Is Consent Mode required by Google?
Since March 2024, Google requires Consent Mode v2 for any site that uses Google Ads or GA4 and serves visitors in the EEA or UK. Without it, Google Ads will not build remarketing audiences from EEA traffic, and GA4 will show gaps in your EEA data. It is not a legal requirement, but it is a practical one for maintaining your advertising and analytics capabilities.
What is the difference between Basic and Advanced Consent Mode?
Basic mode blocks Google tags entirely until consent is granted. No cookieless pings are sent, so there is no conversion modeling for denied sessions. Advanced mode lets tags fire in a degraded state (no cookies, limited data) even when consent is denied, which enables Google's modeling. Advanced mode collects more data but requires clear disclosure in your privacy policy. CookieBeam supports both modes.
Can I use Consent Mode with Microsoft Clarity and Bing Ads?
Yes. Microsoft has its own consent mode implementation that follows the same pattern. CookieBeam supports Microsoft Consent Mode alongside Google Consent Mode. The signals are sent to both platforms simultaneously based on the same visitor consent choices.
Next Steps
Once your GTM Consent Mode setup is verified:
- Deep dive into Consent Mode v2 parameters to understand each signal in detail
- Troubleshoot common Consent Mode failures if your verification reveals issues
- Set up server-side consent enforcement to extend consent beyond the browser
- Optimize Google Ads for denied consent to maximize your ad performance despite consent restrictions