Google Consent Mode v2

What Consent Mode does

Your site sends Google two kinds of message. A default says what is allowed before the visitor has chosen. An update says what they chose. Google Analytics, Google Ads and the other Google tags read that state, and decide for themselves which cookies they set and what they send.

The default has to arrive before any Google tag starts. A tag that starts first has nothing to read, and behaves as if your site had no consent tool at all. That is why the Cookiemark line goes first in the head.

What Cookiemark sends

As soon as the script runs, it sends this default. The last line is only there while Remove ad click data until consent is on, which it is unless you switch it off.

gtag('consent', 'default', {
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  analytics_storage: 'denied',
  functionality_storage: 'denied',
  personalization_storage: 'denied',
  security_storage: 'granted',
  wait_for_update: 500
});
gtag('set', 'ads_data_redaction', true);

For a returning visitor the script reads the stored choice and sends the update in the same moment. Their page view is then measured with the right state from the start. After a new choice, the banner sends the next update.

Consent Mode is on for every new site. You find its settings on the site's Google and GTM tab.

Which category grants which signal

Cookiemark has three optional categories and Google has six signals that a visitor can grant. This is the standard mapping, which suits nearly every site.

You can change the mapping in the table Which category turns on which signal. Give every signal one category. A signal without a category stays denied whatever the visitor chooses.

Basic or advanced

Google describes two ways to use Consent Mode. Every new site starts in basic mode.

In basic mode, Cookiemark holds back Google Analytics until statistics is allowed and Google Ads until marketing is allowed. Tag Manager waits for statistics. In advanced mode it leaves all three alone, because the tags follow the consent state themselves.

Most European regulators expect that nothing reaches Google before consent, which is what basic mode gives you. Choose advanced when you want Google's modelling and your own legal advice accepts the pings without cookies.

The other settings

Wait for a choice

This is the time in milliseconds that Google tags wait for an update before they act on the defaults. It is 500 unless you change it, and you can set anything from 0 to 5000. Returning visitors get their update straight away, so treat the setting as a safety margin.

Remove ad click data until consent

On unless you switch it off. While ad_storage is denied, Google's advertising tags leave ad click identifiers out of their requests. It has no effect once the visitor allows marketing.

Pass ad click information through links

Off unless you switch it on. Google tags then carry the click ID from page to page in the address while cookies are denied. That keeps conversion counts more complete, and it adds parameters such as gclid to your internal links. Check with whoever runs your campaigns before you switch it on.

Regions

When you show the banner in chosen countries only, Cookiemark adds those countries to the default as region. Google then applies the denied defaults in those countries only. Regions and privacy signals explains how Cookiemark decides where a visitor is.

Setting it in Tag Manager instead

Some teams prefer to manage Consent Mode inside Tag Manager, for example when one container serves several sites. Cookiemark has a Tag Manager template for that. Switch Google Consent Mode off in Cookiemark when you use it, so the defaults are not set twice. The template describes the setup.

Check that it works

Do these checks in a private window, so you start without a stored choice.

1. The order in the page source

View the page source, not the element inspector, which shows the page after scripts changed it. Search for cdn.cookiemark.com. Every googletagmanager.com address must come after it.

2. The consent state in Tag Assistant

1. In Tag Manager, press Preview and connect to your site.
2. Select the first Consent event and open its Consent tab. Every signal except security_storage should be denied.
3. Accept everything in the banner. The next Consent event should show the signals as granted.
4. Reload the page. The update should now arrive before Container Loaded, because the script restores the stored choice.

3. The requests in the network tab

Open the developer tools and filter the network tab on collect. In basic mode there must be no request to Google before you choose. In advanced mode requests go out, but no _ga cookie appears. Filter on the names of other vendors, such as facebook, to check them too.

4. The state in the console

Type this in the browser console to see what Cookiemark tells Google right now.

Cookiemark.googleConsentState()
// { functionality_storage: 'denied', analytics_storage: 'granted', ... }