FREE TOOLNO ACCOUNT NEEDED

Is Google Consent Mode actually working?

We watch the gtag calls in the order the page makes them, read the consent signal off the requests that leave, and tell you which of the four v2 requirements is failing.

01Default before tagsConsent declared before any Google tag runs
02v2 parametersad_user_data and ad_personalization present
03Update on changeThe banner pushes choices back to Google
04Region and waitScoped defaults, and time for the CMP to answer
THE FOUR REQUIREMENTS

What Consent Mode v2 actually asks for.

Four things, in order. Most implementations get the first two right and quietly miss the last two.

01

Default state set before tags

The default has to be declared before gtag.js or the GTM container runs. If it arrives later, Google records the first hits as fully consented. A container that sets its own default through a Consent Initialization trigger is fine — what matters is that nothing was measured first.

gtag("consent", "default", {
  ad_storage: "denied", analytics_storage: "denied",
  ad_user_data: "denied", ad_personalization: "denied",
  wait_for_update: 500
});
02

v2 parameters present

Consent Mode v2 added two parameters in March 2024. Without them Google Ads stops building EEA audiences and modelling conversions, and the implementation is not accepted under Google’s EU user consent policy.

ad_user_data: "denied",
ad_personalization: "denied"
03

Update on consent change

The banner has to push the visitor’s choice to Google as soon as it changes, otherwise tags keep running on the default. We do not click your banner, so an update we do not see is reported as unconfirmed rather than failed — accept a category yourself and watch the console.

gtag("consent", "update", {
  analytics_storage: "granted"
});
04

Region and wait_for_update

A region array keeps non-EEA traffic unrestricted, and wait_for_update stops early pings firing with the wrong state. Denying globally without a region is safe — just stricter than it needs to be.

region: ["EEA", "GB", "CH"],
wait_for_update: 500
05

The gcs parameter is the proof

Reading your source tells you what a page intended. The gcs value on outgoing Google requests tells you what actually reached them: G1 followed by ad_storage and analytics_storage, so G100 is both denied and G111 is both granted. A page can contain a perfect consent block and still send no gcs at all.

Stop maintaining gtag calls by hand.

Katla's banner declares all four signals denied before anything loads, then updates them from the visitor's actual choice. Want to see what the page stores regardless? Run the cookie checker.