Businesses advertising to people in the European Economic Area must combine reliable measurement with valid consent. Google Consent Mode v2 communicates a visitor's choices to Google tags; it is not a banner and it does not collect consent by itself. When implemented with server-side Google Tag Manager, those choices travel with each eligible request to a controlled server container before data is routed onward.
What Consent Mode v2 adds
Consent Mode uses signals that tell Google whether storage and specific advertising uses are permitted. Version 2 added ad_user_data and ad_personalization to the existing ad_storage and analytics_storage signals. The four signals answer different questions and should not be treated as one global yes-or-no switch.
For EEA traffic, Google requires applicable consent signals for features such as ads personalization, remarketing and measurement. Your organization remains responsible for deciding which legal basis and banner design are appropriate.
How consent travels through server-side GTM
The consent management platform records the visitor's choice in the browser. The web container sets default consent before Google tags run and updates that state after the visitor responds. The Google tag then sends the consent state with requests to the first-party tagging endpoint.
The GA4 client in the server container reads the request. Google Analytics and Google Ads tags apply their built-in consent checks, while additional triggers or transformations can prevent data from reaching destinations that are not permitted. Server-side hosting centralizes enforcement, but it cannot repair a missing or incorrectly timed browser signal.
Basic mode versus advanced mode
In basic consent mode, Google tags are blocked until the visitor grants the relevant consent. This is easier to reason about, but Google receives no consent-denied pings from blocked tags.
In advanced mode, Google tags load with denied defaults and can send limited, cookieless measurements when consent is denied. Google may use eligible data for modeling. Advanced mode is not automatically the correct legal choice for every website: review the exact requests, your CMP configuration and guidance from the relevant national regulator before adopting it.
Mistakes that create unreliable data
The most common failure is timing: a pageview fires before the default consent command, or a consent update arrives after navigation and the conversion is lost. Other failures include mapping every CMP category to granted, omitting the two v2 advertising signals, configuring only some pages, or allowing custom server tags to ignore consent.
Test both acceptance and rejection. A successful acceptance test alone proves very little. Check a fresh session, a returning visitor, category-level choices, consent withdrawal and navigation across subdomains.
Consent Mode is not legal compliance by itself
Consent Mode transmits and enforces choices; it does not determine whether your banner, purposes, retention periods or international transfers comply with EU and national law. Consult the relevant national regulator's current guidance and obtain qualified legal advice for your specific processing.
Consent Mode v2 implementation checklist
Use this sequence for a new implementation or audit.
- 01
Inventory tags and purposes
List every analytics and advertising destination, the data it receives, its purpose and the consent category that controls it.
- 02
Configure the CMP
Offer clear choices and map each category to the four Google consent signals without assuming consent.
- 03
Set default consent first
Run the default command before Google tags or pageview events, using region-specific defaults where appropriate.
- 04
Send updates correctly
When the visitor chooses, update consent before firing events that depend on the newly granted state.
- 05
Pass consent to sGTM
Route the Google tag through your first-party server endpoint and confirm the GA4 client receives the consent parameters.
- 06
Test every state
Use Tag Assistant, browser network tools, sGTM Preview and vendor diagnostics to verify granted, denied and mixed choices.
Build consent into the data flow
A robust European implementation starts with a transparent CMP and correct consent timing. Server-side GTM then provides a controlled point for validation and destination-specific delivery.
Treat consent as event data that must remain accurate throughout the journey—not as a banner that can be installed once and forgotten.
Consent Mode v2 in Europe: common questions
Is Consent Mode v2 mandatory under EU law?
EU law does not name a Google product as mandatory. Consent Mode is Google's mechanism for communicating consent choices to its tags, while EU and national rules determine the underlying obligations.
Does server-side GTM remove the need for a CMP?
No. A server container does not ask the visitor for consent. You still need an appropriate consent solution and must pass its choices into your tagging setup.
Should denied users send cookieless pings?
That depends on your implementation, configuration and legal assessment. Advanced mode supports limited pings, but it should not be enabled without understanding exactly what is sent.
How do I verify the four consent signals?
Inspect Consent Mode in Tag Assistant, check outgoing requests and confirm the server container receives the expected state for acceptance, rejection and category-level choices.