Last month an e-commerce client showed me his Google Ads dashboard, slightly panicked: "We're spending the same, but the algorithm isn't optimizing anymore, and remarketing has stopped." Opening his GTM, the diagnosis took two minutes: no Consent Mode, a cookie banner blocking the Google tags… and therefore no signal sent back to Google about conversions. Technically "compliant", but blind. It's the most common scenario I meet in 2026, and it can be fixed cleanly.
Consent Mode v2 is the mechanism that lets your Google tags (GA4, Google Ads, Floodlight) adapt their behavior to each visitor's consent choice. Since March 2024, deploying it has become the technical condition to keep remarketing and Google conversion measurement for audiences in the EEA and the UK. No consent signal transmitted, no optimization: Google switches the affected features off.
Blocking your tags out of GDPR caution isn't protecting yourself: it makes your tracking blind while losing your advertising audiences. The right move is to transmit consent cleanly, not to cut the wire.
What GDPR changed for tracking
GDPR's "privacy by default" principle requires that nothing is stored or collected until the user says yes. In plain terms: by default, your Google tags must be set to "Denied" for analytics and advertising storage, and only fully activate after consent. Until now, many integrations translated that rule into a blunt fix, simply blocking the Google tag until the banner is accepted.
The problem is that this binary approach loses a lot: most refusals or non-responses become a black hole in the data. With consent rates often running between 50 and 80% depending on the sector, you steer your campaigns on a fraction of reality. Consent Mode was designed precisely to escape that "all or nothing" dilemma.
Consent Mode v2, in plain terms
Rather than blocking the tag, Consent Mode sends it the user's consent state through four parameters, and the tag adapts accordingly:
| Parameter | What it governs |
|---|---|
| ad_storage | Advertising cookies (remarketing, conversion measurement) |
| analytics_storage | Audience measurement cookies (GA4) |
| ad_user_data | Sending user data to Google for advertising purposes |
| ad_personalization | Use of data for ad personalization (remarketing) |
The last two parameters, ad_user_data and ad_personalization, are precisely the v2 novelty, added to meet European requirements. Their absence is what cuts remarketing: if you stayed on the old version, your audience lists no longer fill up.
Basic or advanced mode: the real trade-off
Consent Mode comes in two implementations, and that's where most of the decision lies.
Basic mode
In basic mode, as long as the user hasn't consented, nothing is sent: the Google tag isn't even loaded, no data, no ping. As soon as the user accepts, the tag loads normally and transmits its data. It's the most legally conservative approach, but also the one that loses the most: on a refusal, you have strictly nothing.
Advanced mode
In advanced mode, the Google tag is loaded upfront, but on a refusal it only sends "cookieless pings": functional, anonymous signals with no cookie or identifier. These pings feed Google's conversion modeling, which statistically reconstructs part of the lost conversions from observed behavior. The concrete result: far more complete measurement and a bidding algorithm that gets material to optimize again.
| Criterion | Basic | Advanced |
|---|---|---|
| On a refusal | Nothing is sent | Cookieless pings sent |
| Conversion modeling | No | Yes |
| Data completeness | Low | High |
| Legal exposure | Minimal | To weigh with your DPO |
The legal point not to brush aside
Advanced mode sends a signal to Google even for users who refused. These pings are anonymous, but their transmission may be analyzed as processing under GDPR and the ePrivacy Directive. Before enabling it, this is a decision to make with your DPO or legal counsel, not a setting you tick silently. My rule: document the choice, own it, and align it with the banner and the privacy policy.
How I deploy it cleanly
A Consent Mode v2 deployment that holds up always follows the same backbone.
1. A certified CMP, not a homemade script
Consent Mode doesn't collect consent, it transmits it. So you need a CMP (consent management platform) upstream: it displays the banner, records the choice and pushes it to Consent Mode. In 2026 Google requires a certified CMP for reliable transmission. Axeptio, Didomi, Cookiebot, Usercentrics and the like do the job. A banner hacked together in JavaScript is the best way to break the chain without noticing.
2. Default values on "Denied"
Before any loading, the default state must be "Denied" for ad_storage and analytics_storage. That's what materializes "privacy by default". The CMP then only flips certain signals to "Granted" according to the user's actual choice.
3. The wiring in GTM
In Google Tag Manager, you make sure the default consent command fires before any other tag, that the CMP properly updates the signals, and that the GA4 and Google Ads tags respect the consent state. It's also the ideal moment to consider a server-side tracking and CAPI architecture, which pairs very well with Consent Mode to strengthen first-party data.
4. Testing, a non-negotiable step
You check in the console (and via the Tag Assistant extension) that signals do move from "Denied" to "Granted" on click, that pings fire on a refusal if you're in advanced, and that conversions come back on the Google Ads side. A Consent Mode "installed but never tested" is half the cases I take over.
What you actually recover
Properly deployed in advanced mode, Consent Mode v2 usually recovers a significant share of invisible conversions through modeling, refills remarketing audiences, and gives the bidding algorithm material to optimize again. Above all, it puts tracking back on a healthy footing: you collect with consent, model the rest, and stop steering blind. That's exactly the GDPR-first logic I stand for: compliance and performance don't conflict, provided you wire things in the right order.
If you want a full picture of your measurement (GA4, Consent Mode, server-side, attribution), I detailed the approach on the Analytics & tracking expertise page. And if the stake is mainly advertising, the SEA / Google Ads expertise page explains how clean tracking directly feeds campaign performance. For the basics of GA4 itself, my GA4 migration guide for marketers remains the starting point.
Take back control of your tracking
I audit your Consent Mode, your GTM and your GA4 / Google Ads measurement, and hand you a prioritized GDPR-first action plan.