Consent Mode v2 and your cookie banner: what to check

Consent Mode v2 is the setting through which your website tells Google tags what the visitor chose in the cookie banner. If the banner and Consent Mode don’t talk to each other, you have one of two problems: either you collect data without consent, or you lose conversions and audiences without knowing why.

This guide is not legal advice. It is the checklist we work through when a Google Ads account reports fewer conversions than expected, or when a company wants to know whether its measurement is built correctly.

What is Consent Mode v2?

Consent Mode is a Google API through which your site communicates consent status to Google Ads, Google Analytics and other Google tags. It doesn’t show a banner and doesn’t ask for consent; for that you use a consent management platform (CMP). Version 2 uses four signals, according to Google’s documentation:

• ad_storage: storage, such as cookies, related to advertising.
• analytics_storage: storage related to analytics, for example visit duration.
• ad_user_data: consent for sending user data to Google for online advertising purposes.
• ad_personalization: consent for personalised advertising, for example remarketing.

Google’s documentation for users in the European Economic Area states that ad_user_data is required for measurement use cases, including tag-based conversion tracking and enhanced conversions, and that both ad_user_data and ad_personalization must be granted for personalised advertising.

Basic or advanced: what’s the difference?

Google describes two implementation modes. Choosing between them is a compliance decision as well as a technical one, so we discuss it with whoever is responsible for data protection.

• Basic: Google tags don’t load until the visitor interacts with the banner. If they refuse, nothing is sent. Google can use a general model to estimate missing conversions.
• Advanced: tags load with consent defaulted to “denied”. If the visitor refuses, no cookies are written, but cookieless pings are sent, and Google builds a more detailed, advertiser-specific model from them.
• In both cases modelling only works above certain data thresholds, so small accounts may see little effect.

What does the law say about cookies?

The core rule comes from the ePrivacy Directive (2002/58/EC), which each member state has transposed; in Romania this is Law 506/2004. Its article 4(5) allows storing or accessing information on a user’s device only if the user has given consent after being informed. The exceptions in paragraph (6) essentially cover what is strictly necessary to deliver the service requested. Advertising and analytics cookies generally fall outside that exception.

The GDPR sets the standard for consent: recital 32 says explicitly that silence, pre-ticked boxes or inactivity do not constitute consent, and the EU Court of Justice confirmed in Planet49 (C-673/17, 2019) that a pre-ticked checkbox is not valid consent for cookies. In the European Data Protection Board’s cookie banner taskforce report of January 2023, the vast majority of national authorities considered it an infringement when a layer with an accept button offers no option to reject. On top of the law, Google’s EU user consent policy requires those using its products to obtain valid consent for cookies and for the use of personal data to personalise ads.

An 8-step checklist for a banner and Consent Mode that work

Work through the steps in order. The first three concern the banner, the rest concern tags and data.

1. The banner shows “Reject” on the first screen, as visible as “Accept”. No non-essential category is pre-ticked.
2. Categories are described in plain language and vendors (Google, Meta, etc.) are named in the cookie policy.
3. Consent can be withdrawn as easily as it was given, for example via a permanent footer link (GDPR art. 7(3)), and choices are recorded so you can prove consent (art. 7(1)).
4. Consent Mode’s default state is set before any Google tag loads, for visitors in the EEA.
5. The banner updates all four signals, not just ad_storage and analytics_storage.
6. Other platforms’ tags (Meta Pixel, TikTok, LinkedIn) are blocked until consent by the same consent platform. Consent Mode only controls Google tags.
7. You have tested the three scenarios (accept, reject, no interaction) with Tag Assistant or the browser’s developer tools and checked which cookies are written in each.
8. You have noted the date of the change and compare conversions before and after, using real sales as the benchmark.

Illustrative example: why conversions drop after a compliant banner

The figures are hypothetical. A store receives 100 real orders in a week from paid Google traffic. Before the banner, Google Ads reported 85 of them, with the rest lost for other technical reasons. After a compliant banner, assume 40% of visitors reject advertising cookies.

• Directly observed conversions: around 51 (85 × 0.6), because refusals are no longer tracked with cookies.
• With advanced mode and enough volume, Google can fill part of the gap in reporting with modelled conversions estimated from the cookieless pings.
• Real orders are still 100. Performance didn’t change; visibility did.
• If the bid strategy has a target CPA or ROAS, a sudden drop in observed conversions can push the algorithm to lower bids. Adjust targets only after comparing with real sales.

What do you do about the missing data?

A compliant banner means, by definition, less observed data. The answer isn’t a banner that pressures people into accepting, but a measurement architecture that doesn’t depend on a single cookie. In practice that means three things: Consent Mode implemented correctly so modelling has something to work with; first-party data passed with consent, through enhanced conversions or CRM imports; and a monthly reconciliation of platform conversions against real sales. We describe the reconciliation logic in the note on conversions vs sales.

What comes next

Consent Mode is a small piece of a measurement system, but one that, if implemented badly, distorts everything downstream: automated bidding, audiences and reports. If you’re not sure how your site is set up, the check is part of the acquisition-system diagnostic, and we build the full architecture in marketing measurement projects. For the legal side, have the banner and policy texts validated by a data-protection specialist.