Home Compliance & Regulations. Google Consent Mode in CookieLet

Google Consent Mode in CookieLet

Last updated on Sep 14, 2026

Google Consent Mode is the way Google's tags — Google Analytics 4, Google Ads, Floodlight — find out whether a visitor has agreed to cookies and tracking. Instead of blocking those tags outright, Consent Mode lets them load and adjust their own behaviour based on the signals your consent banner sends.

CookieLet sends those signals for you. Once you switch Consent Mode on, every banner interaction updates Google's tags automatically — you don't need to write any code.

Why Consent Mode matters

Google requires advertisers and publishers serving traffic in the European Economic Area and the UK to collect and forward consent signals for Google Analytics and Google Ads. Without them, remarketing audiences stop populating, conversion data becomes incomplete, and some Google features stop working for EEA traffic altogether.

Consent Mode was extended in November 2023 with two additional signals, commonly called Consent Mode v2. If your current setup only sends ad_storage and analytics_storage, it is out of date. CookieLet sends the full v2 signal set.

The consent signals

Each signal carries one of two values: granted or denied.

  • ad_storage — storage related to advertising, such as advertising cookies

  • ad_user_data — sending user data to Google for advertising purposes (v2)

  • ad_personalization — using data for personalised advertising, including remarketing (v2)

  • analytics_storage — storage related to analytics, such as the visit duration cookie

  • functionality_storage — storage that supports site functionality, such as language preference

  • personalization_storage — storage related to personalisation, such as recommendations

  • security_storage — storage related to security, such as authentication and fraud prevention

The first four are the ones Google's advertising and analytics products act on. The last three are informational for most sites, but CookieLet sends all seven so your consent record is complete.

Basic and Advanced modes

Consent Mode can be implemented in two ways. The difference is when Google's tags are allowed to load.

Basic

Google tags are blocked entirely until the visitor accepts. Nothing reaches Google before consent — not even an anonymous ping. Visitors who decline are simply absent from your reporting, and Google cannot model the gap.

Choose Basic if your legal position is that no contact with Google may happen before consent.

Advanced

Google tags load on every page with all signals set to denied. Before consent they send cookieless pings — no cookies are written, no identifiers are sent. Once the visitor accepts, the signals switch to granted and normal measurement resumes.

Because Google receives those anonymous pings, it can model conversions and behaviour for the visitors who declined, which usually recovers a meaningful share of the reporting you would otherwise lose.

Which should you pick? Advanced is the more common choice and preserves far more measurement. Basic is the more conservative reading of consent law. This is a decision for your legal or privacy team, not a technical one.

How CookieLet maps your cookie categories

CookieLet's banner works in cookie categories. Google works in consent signals. CookieLet translates between the two automatically.

One category can drive several signals. Accepting Advertisement grants all three advertising signals at once; declining it denies all three.

Necessary maps to security_storage and is always granted, because those cookies are required for the site to function and cannot be refused.

Turning Consent Mode on

  1. In your CookieLet dashboard, select your website, then open Advanced in the left-hand menu.

  2. Switch on Google Consent Mode. This enables Basic mode.

  3. To use Advanced mode, switch on the Advanced mode option as well.

  4. Save your changes.

Nothing else is required. The signals begin flowing on your next page load.

Consent Mode settings are per website. If you manage several sites in CookieLet, switch it on for each one.

What CookieLet does on the page

You don't need to write this code — it's here so you can recognise it when debugging.

1. It sets a default before any Google tag runs

On every page load, before the Google tag has a chance to fire, CookieLet declares the starting state:

gtag('consent', 'default', {
  'ad_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied',
  'analytics_storage': 'denied',
  'functionality_storage': 'denied',
  'personalization_storage': 'denied',
  'security_storage': 'granted'
});

Order is critical. If the default is set after your Google tag has already loaded, it has no effect and your tags behave as though consent was never configured. This is the single most common Consent Mode mistake, and it's why the CookieLet script belongs at the very top of your <head>.

2. It waits briefly for the visitor

Because the banner loads asynchronously, CookieLet sends a wait_for_update value alongside the default. Google's tags hold their data for that window — 2000 milliseconds by default — giving the visitor a moment to choose before anything is sent.

3. It sends an update when the visitor decides

The moment someone accepts, rejects, or saves a custom selection, CookieLet pushes the new state:

gtag('consent', 'update', {
  'ad_storage': 'granted',
  'ad_user_data': 'granted',
  'ad_personalization': 'granted',
  'analytics_storage': 'granted'
});

The update is sent on the same page where the choice was made, before any navigation. That matters: if the update only arrived after a page reload, Google would lose the events from the original page and your reports would show incomplete sessions.

4. It remembers the choice

CookieLet stores the decision in a first-party cookie and re-applies it on every subsequent page, so the visitor isn't asked again and Google's tags start each page in the right state.

5. It handles changes of mind

If a visitor reopens the preference centre and withdraws consent, CookieLet sends another update switching the affected signals back to denied. Consent Mode treats this like any other change of state.

Region-specific defaults

You can apply different starting states to different parts of the world — for example, deny everything by default in the EEA while leaving analytics granted elsewhere. CookieLet's geo-targeting handles this for you when you use a worldwide legislation preset.

Regions are identified by ISO 3166-2 codes, such as DE for Germany or US-CA for California.

Where two rules overlap, the more specific one wins. If ad_storage is granted for US and denied for US-CA, a visitor in California gets the denied setting. A rule with no region attached covers everyone not matched by a more specific rule.

Ads data redaction

When ad_storage is denied, Google's tags already stop writing advertising cookies. Ads data redaction goes further: ad click identifiers are stripped from the network requests Google Ads and Floodlight tags send, and that traffic is routed through a domain that doesn't use third-party cookies.

It has no effect when ad_storage is granted. Leaving it on is the more privacy-protective configuration and is recommended.

URL passthrough

When cookies are denied, information about which ad a visitor clicked can't be stored locally, so conversions become harder to attribute. URL passthrough carries that information in the page URL instead of a cookie as the visitor moves through your site.

The parameters it may append include gclid, dclid, gclsrc, _gl and wbraid.

Turn it on if you run Google Ads. Before you do, check that:

  • any redirects on your site preserve those query parameters

  • your analytics tools ignore them when grouping page URLs

  • your site doesn't use query parameters to control navigation in a way these would disturb

If you install CookieLet through Google Tag Manager

The GTM template handles Consent Mode the same way, using Tag Manager's own consent APIs rather than raw gtag commands. You set the default state directly in the tag, in the Default Consent Settings table, and Ads Data Redaction and URL Pass Through appear as checkboxes under Other Settings.

The tag must fire on the Consent Initialization – All Pages trigger so it runs before every other tag in the container. See our Google Tag Manager installation guide for the full setup.

If you use IAB TCF

When the IAB Transparency and Consent Framework is enabled on your banner, the three advertising signals — ad_storage, ad_user_data and ad_personalization — are no longer driven by your Advertisement cookie category. They are derived from the TC string instead, following Google's own rules for TCF participation.

The remaining four signals continue to follow your cookie categories as normal.

Your Advertisement category still governs everything else: blocking non-TCF advertising scripts such as Meta Pixel, LinkedIn Insight and TikTok Pixel, and classifying the cookies those vendors set.

Checking that it works

With CookieLet

Open Advanced in your dashboard and use the consent checker. It reads the live signal state from your site and reports what Google is currently receiving.

With Google Tag Assistant

  1. In Tag Manager, select Preview and enter your website URL.

  2. Open the Consent tab.

  3. Before you interact with the banner, every signal except security_storage should read denied in the On-page Default column.

  4. Accept cookies, then check the On-page Update column. The signals you consented to should read granted.

With your browser console

Open the developer console on your site and inspect dataLayer. You should see a consent entry with default before your Google tag entry, and an update entry after you interact with the banner.

Common issues

Every signal stays denied after I accept

  • Confirm Consent Mode is switched on in Advanced for this website.

  • Test in a private window — a stored decision from an earlier visit may be replaying.

  • If you use GTM, check the CookieLet tag is on the Consent Initialization trigger.

The defaults never appear at all

Your Google tag is loading before CookieLet. Move the CookieLet script above every Google tag in your <head>, or above the GTM container snippet.

Sessions in GA4 look incomplete

This happens when consent changes across a page transition rather than on the page where the visitor clicked. CookieLet sends the update on the same page, so if you're seeing this, check whether your site reloads immediately after the banner is dismissed — a reload triggered too quickly can cancel the network request carrying the update.

Analytics traffic dropped after enabling Consent Mode

Expected, and correct: visitors who decline are no longer measured with cookies. Advanced mode recovers part of that gap through modelling. If the drop is severe, check whether your banner is denying more categories by default than your jurisdiction requires.

I'm using ga.js, analytics.js or conversion.js

Those legacy tags don't support Consent Mode. Move to gtag.js or Google Tag Manager first.

A note on compliance

Consent Mode is a measurement feature, not a legal guarantee. Sending the correct signals is necessary for compliance with Google's policies, but it doesn't by itself make your site compliant with GDPR or any other regulation. Your banner configuration, cookie categorisation and privacy notices all form part of that picture.

Still need help?

Email support@cookielet.com with your website URL and a description of what you're seeing in Tag Assistant, and we'll check the signal flow for you.