Google Consent Mode v2 explained for small online stores

If you run Google Ads or GA4 on a UK online shop, you've probably been told you "need Consent Mode v2". Your cookie banner app may even have a toggle for it. But few store owners are told what it actually does, so it's hard to know whether yours is working.

This guide explains it in plain English, then shows you how to check it in a few minutes.

What Consent Mode is (and isn't)

Google Consent Mode is a way for your website to tell Google's tags (GA4, Google Ads, Floodlight) what a visitor agreed to in your cookie banner. The tags then adjust: with consent they work normally, and without consent they don't set cookies.

Two things it is not:

• It is not a cookie banner. It doesn't ask visitors anything. Your banner (often called a CMP, consent management platform) asks, then passes the answer to Consent Mode.
• It doesn't control non-Google tags. Meta Pixel, TikTok, Pinterest, Hotjar and Microsoft Clarity ignore it. They need to be blocked by your banner, gated in Google Tag Manager, or controlled by their own consent features. (More on Meta in our Meta Pixel guide.)

The four signals in v2

The original Consent Mode had two signals. Version 2 added two more, and Google requires all four for its advertising features to work fully for visitors in the UK and EEA, in line with its EU user consent policy.

Signal	What it means	Usually tied to
ad_storage	May advertising cookies be stored?	Marketing
analytics_storage	May analytics cookies (like GA4's _ga) be stored?	Analytics
ad_user_data	May user data be sent to Google for advertising?	Marketing
ad_personalization	May data be used for personalised ads such as remarketing?	Marketing

Each signal is either granted or denied. A typical banner maps "Analytics" to analytics_storage and "Marketing" to the three ad signals.

The one thing that must be right: default first, then update

The most common broken setups get the order wrong. On every page load, this has to happen:

1. Default. Before any Google tag runs, the page sets all four signals to denied for UK visitors.
2. Banner loads. It either shows the choice to a new visitor or reads a returning visitor's saved choice.
3. Update. The banner sends the visitor's choice to Google, both when they click and on every later page for returning visitors.

In code, the default looks like this. It must sit above your Google Tag Manager or gtag.js snippet, unless your banner's GTM template sets it for you:

window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('consent', 'default', {
  'ad_storage': 'denied',
  'analytics_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied',
  'wait_for_update': 500
});

And when someone accepts everything, the banner sends:

gtag('consent', 'update', {
  'ad_storage': 'granted',
  'analytics_storage': 'granted',
  'ad_user_data': 'granted',
  'ad_personalization': 'granted'
});

If the default comes after GA4 has already fired, or the update only happens on the click and not on later visits, your data and your compliance both suffer. Speed and caching plugins that defer or delay JavaScript are a frequent cause, especially on WordPress.

Basic vs advanced mode

There are two ways to implement Consent Mode. Neither is "the right one" for everyone.

• Basic: Google tags are blocked completely until the visitor consents. Nothing goes to Google without consent. It's easy to explain and easy to audit.
• Advanced: Google tags load immediately with consent "denied". They don't set cookies, but they send cookieless pings that Google uses to model the conversions and behaviour you can't observe directly.

Advanced mode recovers more data in Google's reports, but it means some information is sent to Google before or without consent, which some businesses aren't comfortable with. Google also applies minimum traffic thresholds before GA4's behavioural modelling kicks in, so a small shop may not see modelled data in GA4 either way. If you're unsure, basic mode is the conservative choice. Whether the trade-off is right for your business is a decision for you (and your adviser), not your banner app's default setting.

What changes in your reports

Once Consent Mode is working, GA4 will show fewer users, sessions and purchases than your store actually had, because visitors who reject analytics aren't measured (or are only modelled). That's expected. Your Shopify or WooCommerce orders remain the source of truth for sales. If the gap looks too big, our guide to why GA4 revenue doesn't match Shopify orders explains how to tell normal consent loss from broken tracking.

How to check yours in 5 minutes

1. Open a private window and go to tagassistant.google.com. Connect it to your store's URL.
2. Before clicking the banner, open the first event and select the Consent tab. You should see all four signals as denied under "On-page default".
3. Click Accept all. The next events should show an "On-page update" with all four granted.
4. Repeat in a fresh private window with Reject all: the update should keep everything denied.
5. Close the tab after accepting and reopen your site in the same window. The saved choice should be applied straight away, with no burst of "denied" hits.

Prefer the Network tab? Filter for collect and look at the gcs parameter on Google requests: G100 means ads and analytics are both denied, G111 means both are granted, G101 means only analytics is granted, and G110 means only ads is granted.

Common mistakes

• v1 only: the banner sets ad_storage and analytics_storage but never the two v2 signals, so Google Ads flags missing consent.
• Default too late: GA4 fires before the default is set. Tag Assistant usually warns about this.
• Granted by default: the default is set to "granted" for everyone, which defeats the purpose for UK visitors.
• Double installs: GA4 added by a platform app and again in GTM, with only one of them respecting consent.
• Forgetting Meta and friends: Consent Mode is set up perfectly, but the Meta Pixel fires regardless.

Next steps

If you're on WooCommerce, our WooCommerce consent setup guide walks through plugins, GTM and caching. For a quick health check of any store, run the 10-minute cookie consent audit.

This article is technical guidance, not legal advice. Platform menus change; check the vendor's current documentation if a setting has moved.