How to Configure Consent Mode in Google Analytics

Privacy regulations like GDPR and ePrivacy don't just require a cookie banner — they require that your analytics and advertising tags actually respect the choice a visitor makes. Google Consent Mode is Google's answer to this: instead of an all-or-nothing "load GA4 or don't," it lets your tags adjust their behavior based on the specific consent state a user has granted, and even model missing data when consent is denied.

This guide walks through what Consent Mode actually does, how to implement it with gtag.js and Google Tag Manager, and how it interacts with your cookie consent banner.

What Consent Mode Actually Controls

Consent Mode uses named consent signals, each set to granted or denied:

• ad_storage — whether advertising cookies can be set
• ad_user_data — whether user data can be sent to Google for advertising purposes
• ad_personalization — whether data can be used for personalized advertising
• analytics_storage — whether analytics cookies (like GA4's) can be set

ad_user_data and ad_personalization are part of Consent Mode v2, which Google made effectively mandatory in March 2024 for advertisers serving ads to users in the EEA — if you use Google Ads alongside GA4, you need v2, not just the original analytics_storage/ad_storage pair.

Step 1: Set a Default Consent State

Before your GA4 tag fires, you need to tell it what to assume by default — almost always "denied" until the user actively consents:

window.dataLayer = window.dataLayer || [];
function gtag() {
  dataLayer.push(arguments);
}

gtag("consent", "default", {
  ad_storage: "denied",
  ad_user_data: "denied",
  ad_personalization: "denied",
  analytics_storage: "denied",
  wait_for_update: 500,
});

This snippet must load before your GA4 configuration tag (gtag('config', 'G-XXXXXXX')) or your GTM container. The wait_for_update parameter tells Google tags to wait up to 500ms for a consent update before sending anything, which gives your cookie banner script a moment to run first.

Step 2: Update Consent When the User Responds

When someone interacts with your cookie banner, update the consent state accordingly:

function onAcceptAll() {
  gtag("consent", "update", {
    ad_storage: "granted",
    ad_user_data: "granted",
    ad_personalization: "granted",
    analytics_storage: "granted",
  });
}

function onRejectAll() {
  gtag("consent", "update", {
    ad_storage: "denied",
    ad_user_data: "denied",
    ad_personalization: "denied",
    analytics_storage: "denied",
  });
}

function onAcceptAnalyticsOnly() {
  gtag("consent", "update", {
    ad_storage: "denied",
    ad_user_data: "denied",
    ad_personalization: "denied",
    analytics_storage: "granted",
  });
}

Wire these functions to your cookie consent banner's actual buttons (or, more commonly, to the callback your consent management platform (CMP) exposes).

Step 3: Implementing via Google Tag Manager

If you manage tags through GTM instead of hardcoded gtag calls:

1. Go to Admin → Container Settings in GTM and enable Consent Overview (this exposes built-in consent checks on tags).
2. Set your Default Consent either through a Consent Initialization tag (fires before all other tags) or, more commonly, through your CMP's GTM template if you're using one from the Consent Mode partner list.
3. On your GA4 Configuration tag, go to the Consent Settings section and require analytics_storage consent before the tag fires.
4. Preview and test both the "denied" and "granted" paths in Preview mode, confirming the GA4 tag is blocked or fires accordingly.

Most CMPs (Cookiebot, OneTrust, Usercentris, CookieYes) provide an official GTM template that handles the default/update consent signals for you — it's usually less error-prone than hand-rolling this yourself, especially for keeping up with Google's evolving Consent Mode v2 requirements.

What Happens When Consent Is Denied

This is the part that surprises people: GA4 doesn't just stop tracking entirely when analytics_storage is denied. Instead, it uses cookieless pings — anonymous, aggregated signals sent without any cookie or identifier — combined with behavioral modeling to estimate the conversions and traffic you're missing from users who declined. This modeled data shows up in reports as an estimated adjustment, not as if it were directly measured, and Google requires a meaningful volume of both consented and non-consented traffic before modeling kicks in.

Regional Consent Settings

Not every visitor needs the same default. GTM's Consent Mode setup lets you configure regional defaults, which matters if you serve both EEA/UK visitors (where opt-in consent is generally required before tracking) and visitors from regions with different expectations:

1. In your GTM Consent Initialization tag (or CMP template), set the default to denied for the EEA region (and any other regions with similar requirements).
2. Optionally set a more permissive default — for example, analytics_storage: granted — for regions where your legal counsel has confirmed that's acceptable, while still keeping advertising signals denied by default everywhere.
3. Always let the actual banner interaction override the default once the user makes an explicit choice, regardless of region.

Treat the regional default as a starting assumption, not a substitute for asking — most privacy frameworks expect a genuine, informed choice rather than a technically-compliant default that nobody actually sees or interacts with.

Verifying Your Implementation

1. Open your site in an incognito window.
2. Open the Network tab in DevTools and filter for requests to google-analytics.com or analytics.google.com.
3. Before accepting the cookie banner, confirm requests either don't fire or carry gcs=G100 (denied) parameters.
4. Accept the banner, and confirm subsequent requests carry a gcs value reflecting granted consent.
5. Cross-check in GA4 DebugView that events are still arriving (as cookieless pings) even before consent is granted.

FAQ about Configuring Consent Mode in Google Analytics

Is Consent Mode required by law?

Consent Mode itself isn't a legal requirement, but respecting user consent choices for tracking generally is, under regulations like GDPR and ePrivacy. Consent Mode is Google's supported mechanism for doing that while still using Google tags.

What's the difference between Consent Mode v1 and v2?

V1 covered ad_storage and analytics_storage. V2 added ad_user_data and ad_personalization, which Google now effectively requires for advertisers serving ads to EEA users.

Does Consent Mode work without a cookie consent banner?

No — Consent Mode needs a consent management system (custom-built or a CMP) to actually capture the user's choice and call the gtag('consent', 'update', ...) function. It's the plumbing, not the banner itself.

Will I lose all my analytics data if a user declines?

No — GA4 uses cookieless pings and statistical modeling to estimate aggregate behavior from non-consenting users, though individual-level tracking is respected and not collected.

Do I still need Consent Mode if I only serve users outside the EEA?

Legal requirements vary by jurisdiction, but since Consent Mode primarily affects EEA/UK traffic behavior by default, sites with no EEA/UK visitors are less affected — though many teams implement it globally for consistency and to prepare for evolving regulations elsewhere.

Can I test Consent Mode without going live?

Yes — use GTM's Preview mode combined with the browser's Network tab to inspect outgoing requests under both consent states before publishing your container.

Conclusion

Consent Mode is what lets Google Analytics coexist with real privacy compliance instead of choosing between "track everyone" and "track no one." Set a safe default, wire up your CMP correctly, and verify both the granted and denied paths before you trust the data. Get it right, and your analytics stays both legally sound and genuinely useful for understanding your website's traffic.