Google Consent Mode v2: The Basics

[Updated 3/22/24] Consent mode is a privacy mechanism by which your website can communicate visitor privacy choices made on a cookie consent banners. Those choices get related to Google tags, which can adjust how they fire and process data. You are running consent mode and your website is honoring visitor choices related to advertising and analytics tracking.

Understanding consent mode in Google Analytics requires knowledge of the newest Google consent mode (consent mode v2), how consent management works, and how advertising and analytics cookies relate to consent.

Read on below or jump to a specific section in the table of contents.

What is Consent Mode v2
What is a consent management platform (CMP)
How does consent mode work
The 4 types of consent in consent mode v2
The legislation behind consent mode
Basic vs. Advanced consent mode v2
Consent mode and modeled conversions
Consent mode and enhanced conversions
Wrapping up

For an in depth and technical read, check out Simo Ahava’s blog. Or watch the linked video below.

Consent mode is the mechanism by which a website receives tracking consent choices from visitors and then adjusts how Google cookies for advertising and analytics products are created and read.

Google first released Consent Mode in 2020. Google rolled out Consent Mode v2 in November of 2023. Consent mode v2 provides functionality for both analytics cookies (GA4 cookies) and advertising cookies (Google Ads cookies).

Look in the blue box below to see what Google says is the primary purpose of consent mode: communicating consent status to Google.

The information in the red box is just as important. Consent mode does not provide a cookie consent banner or other mechanism to gather visitor consent. It only communicates the consent choices to Google for the purposes of setting and reading cookies.

To gather consent on your website, you can implement a custom consent solution, or you can use third party Consent Management Platform (CMP).

What is a Consent Management Platform (CMP)?

A consent management platform is a website technology you can use to obtain legal consent from your visitors regarding the cookies your site uses to gather and process data.

Google has more than 15 “Google CMP Partners” that integrate with Consent Mode. Complianz is the CMP running on this website. I’ll be creating some future resources about using Complianz to set up tags that honor consent choices.

Google put together this CMP comparison guide if you’d like to do more research on what might be best for your situation.

Consent Mode gives instructions to tags on your website related to what data they can collect.

Tags are little snippets of code that perform a variety of functions. For example, Google Analytics collects data on your website when a specific javascript tracking code is installed. The Google Ads platform has tags that help register when your customers and prospects click on one of your ads and then come to your website and convert.

Tags adjust their behavior based on what they learn about user preferences. Those privacy and consent choices are received by the CMP and filtered to your tags through Consent Mode.

Here’s an example of a cookie consent banner from one of the Google CMP Partners (Complianz). Here is what happens in consent mode in relation to this cookie banner:

A visitor sees the cookie consent banner and either accepts cookies or does not accept cookies
The CMP sends the consent status to Google
Google tags determine how to process the user’s data, according to the consent status provided
Tags for analytics and advertising adjust their behavior

If the user provides consent, the Google tags will perform their standard jobs. If the user does not consent, the tags may still collect data depending on whether the website is using “Basic” or “Advanced” consent mode. We’ll explore Basics vs. Advanced consent mode in greater detail below, but the general idea is that Advanced consent mode can still collect *some* data even if the visitor denies consent. For example, it could collect analytics data but do it without a client ID (CID).

What is Google Analytics Client ID

The client ID is a unique browser and device combination. It’s what allows Google Analytics to recognize the difference between new users and returning users. When Google Analytics recognizes the same client ID in its cookie (the _ga cookie), it will know that device has been on their site in the past and will log a returning user.

You can check your client ID using your browser. You don’t need to do this, but it will demonstrate what’s happening with the _ga cookie.

How to Find Your Client ID

If you’re using Chrome, just right click on the page you’re browsing and click ‘Inspect’ to open Chrome developer tools. Then, do these three steps:

Go to “COOKIES” in your Storage area and select your domain (yellow arrow)
Click “APPLICATION” in the horizonal navigation
Look for the cookie name of “_ga” – this is the name of the Google Analytics cookie. The Client ID is the value beginning with GA (below it is GA1.1.3850027…).

When it comes to consent, there is more than just analytics consent. In fact, there are four specific consent types in Google Consent v2. Let’s take a look.

There are four types of consent in Google Consent Mode v2. Each of them manages something different related to consent.

ad_storage manages advertising cookies for the visitor
analytics_storage manages analytics cookies for the visitor
ad_user_data manages whether the visitor allows their data to be used for advertising purposes
ad_personalization manages whether the visitor consents to their data being used for retargeting (remarketing) ads

Two of these consent types were first rolled out in the original Google Consent Mode back in 2020.

ad_storage manages advertising cookies for the visitor
analytics_storage manages analytics cookies for the visitor

These other two were added with Consent Mode v2 in November of 2023.

ad_user_data manages whether the visitor allows their data to be used for advertising purposes
ad_personalization manages whether the visitor consents to their data being used for retargeting (remarketing) ads

The different combinations of different consent choices that your visitors can influence how the Google tags operate. But before we look at that, let’s look at why we need to care about consent mode.

Google seems to be rolling out consent mode in response to legislation, most notably in the European Union. The most significant piece of legislation (for Google, at least) may be the DMA, the Digital Markets Act. But there are others that are worth mentioning as well.

Let’s briefly review some of the noteworthy legislation in the space of digital privacy.

GDPR (General Data Privacy Regulation)

GDPR went into effect on May 25, 2018 and billed itself as the the “toughest privacy and security law in the world.” GDPR was drafted and passed by the European Union and deals with data collection, data processing, security, and user rights as it relates to personal data.

Google has been fined millions of dollars by the EU for things it claims were violations of GDPR.

CCPA (California Consumer Privacy Act)

The CCPA was signed on June 28, 2018 and went into effect on January 1, 2020. The stated purpose of the CCPA was to provide consumer protection and privacy rights to residents of California.

DMA (Digital Markets Act)

The DMA was implemented on November 1, 2022 but didn’t come fully into effect at that time. Unlike GDPR and CCPA, the Digital Markets Act is specifically focused on large tech companies operating within the EU. These large tech companies are called “gatekeepers.”

These gatekeepers were officially appointed on September 6, 2023 and are required by the DMA to comply with the DMA by March 6, 2024.

The DMA aims at ensuring a higher degree of competition in European digital markets by preventing large companies from abusing their market power and by allowing new players to enter the market
Digital Markets Act, Wikipedia

Along with companies like Apple, Amazon, ByteDance, Meta, and Microsoft, Google’s parent company Alphabet is one of the gatekeepers.

And since Google cares about complying with the DMA, that means that advertisers and marketers who use Google products must also care about the DMA. Of course, Google also has other incentives. That could help explain why there is a “Basic” and an “Advanced” consent mode.

Note: Google published an update on its preparations for DMA in January 2024. In addition to consent, it includes things like changes to search results and data portability.

Consent mode v2 has two different versions: a basic mode that will strictly honor visitor privacy choices and an advanced mode that (some might say) isn’t quite as strict. The prior version of consent mode did not have multiple options for applying consent mode.

If you use basic consent mode you can collect data when you get consent. If you use advanced consent, you can still collect some data (although without cookies) even without consent.

What is Basic Consent Mode

Basic consent mode means that consent mode is active and Google tags are prevented from running and collecting data until your visitor consents to data collection.

If you implement basic consent mode you will only be able to track visitors who grant consent to be tracked with Google Analytics. As you can see in the comparison table below, you do not have access to behavioral modeling in GA4 with basic consent mode.

How Do You Implement Basic Consent Mode?

You do it and can configure your individual tags in Google Tag Manager. You can block tags from firing until consent has been granted. Once consent has been granted, you can give those tags the freedom to fire.

What is Advanced Consent Mode

Advanced consent mode means that consent mode is active and Google tags will load before the consent banner appears on the page. If a visitor does not consent to cookies, the tags will still send “pings” (without cookies) to Google.

Note: Do you see those asterisks next to conversion modeling on the basic implementation? This is is what Google says about this very basic modeling. it is different from the modeling reviewed below.

When tags are blocked due to consent choices, no data is collected, and conversion modeling in Ads is based on a general model. The models use features such as browser type, conversion action type, time of day, and other high-level, non-identifying variables.
Consent on websites and apps, Google

What if You’re Not Using Consent Mode at All?

It seems that if you’re not using consent mode at all, Google will still collect and process all data from Google tags. There is an implied assumption of consent. But if you are operating with consent mode v2, Google will model conversions in both GA4 and Google Ads.

What happens when a visitor does not give consent to ads or analytics cookies? At baseline, advertisers and marketers lose data that would have been collected about advertising performance and visitor behavior. Without cookies, advertisers can’t tie ad clicks to conversions. That is where conversion modeling can come into play.

Conversion modeling can be active when the lack of cookies means that there is no visibility to what happens between the time an ad is clicked and a visitor converts. Here’s what Google says:

Conversion modeling uses Google AI to analyze observable data and historical trends, quantifying the relationship between consented and unconsented users. Then, using observable user journeys where users have consented to cookie usage, our models will assess attribution paths for the unconsented journeys.
About consent mode modeling, Google

These modeled conversions show up in conversion reports the same way as observed conversions.

Here is how Google shows it working (source) in a hypothetical example of 1,000 ad clicks where half had visitor consent for tracking and half did not. Note: Google says that their analysis shows users who grant consent for tracking are “…typically 2-5x more likely to convert than unconsented users.” Presumably that’s why there are 9 modeled conversions and 50 cookie-observed conversions in the example.

modeled conversions in google ads consent mode

Google is a fan of more data rather than less data. The same linked Google support article on “About consent mode modeling” makes this clear with the text below.

As you can see, Google recommends using consent mode to send “cookieless pings” for more accurate modeling. You’ll recall these pings without cookie consent are the feature of Advanced consent mode and not Basic consent mode.

What is a “Cookieless Ping”?

Cookieless pings seem to be another way to provide “cookie-like” data to Google for the purposes of measurement and attribution, but they work without personally identifiable cookies. Here is what Google says about them.

In Consent Mode, a ping captures an individual’s consent without the use of cookie storage. If consent is not granted, a ping with only functional, non-identifying information is sent.
Recover conversions lost due to consent choices, Google Ads

I don’t really understand what is happening here, but it seems that these are generated in the Advanced (not Basic) application of consent mode with or without the consent of the user. They are used in both Google Analytics and Google Ads to help generate a more complete picture of visitor behavior.

They seem to have some relationship to the enhanced conversions feature in Google Ads. Let’s look at that area.

Google Ads enhanced conversions and consent mode are both related to how Google tracks and models conversions. But they are distinct from one another. Some brief comments on enhanced conversions.

What are Enhanced Conversions?

Enhanced conversions in Google Ads make it possible for advertisers to send encrypted and anonymous conversion data to Google. This is “first party cookie” data, meaning it is data that your website is generating, that gets sent to Google.

First introduced in May of 2021, enhanced conversions supplement Google tags with first-party data your website collects from your visitors. Sharing this data (in an anonymous “hashed” fashion, Google says) allows Google to more accurately track conversion details.

What is the Relationship Between Enhanced Conversions and Consent Mode

This Google support article seems to imply that there is a clear relationship between the two (“Enhanced conversions for web and Consent Mode go hand in hand…”), but I don’t think there is any technical integration. Instead, it’s more likely that Google wants advertisers to use both consent mode (Advanced Mode, presumably) and Enhanced Conversions in order to get as much data as possible.

What is more clear is that both Consent Mode and Enhanced conversions have some clear requirements as it comes to data collection and privacy. If you’re working in Google Ads, you’ll see this “Learn more” link when you look at turning on enhanced conversions in your settings.

google ads enhanced converson requirements

This is where you’ll learn about the requirements Google has for using enhanced conversions.

Ensure that you disclose to customers (for example, in your privacy policy) that you share their information with third parties to perform ad measurement services on your behalf, and that you obtain customer consent for such sharing and use where legally required.
Comply with all applicable laws and regulations, including any data protection or privacy laws, as well as self-regulatory or industry codes that may apply. Data that you upload to Processor Services will be subject to Google Ads Data Processing Terms. Consent signals are required for personal data sent to Google from end users in the European Economic Area for advertising purposes, including for Enhanced Conversions and Store Sales (uploads).
Comply with Google’s EU User Consent Policy to the extent applicable.
You may not upload information that is prohibited by law, including information about minors. Don’t upload any data (1) that you know relates to individuals under the age of 13 or (2) that was collected from any site or app directed to children under the age of 13.
You may not upload transaction information related to the sensitive categories, described below. You may only use Google’s approved API or interface to upload customer information.
If you instruct Google to automatically generate Customer Match lists using the data you upload, you must also comply with Customer Match policies.

There is a lot here to review.

Wrapping Up

This is the first of at least a couple articles that will explore Google Consent Mode. If you’ve had success using a CMP and quickly setting up Google Consent mode v2 for your Google Ads and / or GA4 tags in Google Tag Manager, drop a comment if you’d like to share your success.

Google Consent Mode (Consent Mode v2) Basics

Table of Contents