Consent Mode v2 — what's required and what goes wrong?

What is Consent Mode v2?

Consent Mode is a signalling system between your cookie banner and Google's tags. When the visitor makes a choice in the banner, a set of signals is updated controlling what Google's tools may do: store analytics cookies, store advertising cookies, use data for advertising and use data for personalised ads. Version 2, mandatory for advertising features in the EEA since March 2024, added the last two signals — without them Google throttles features like remarketing and audience targeting.

Important distinction: Consent Mode is not a cookie banner and does not replace one. It is the plumbing between the banner and Google's tags. The legal requirement — that non-essential cookies and tracking requests need consent before they are set or sent — applies exactly the same with or without Consent Mode.

What does the law say?

The ePrivacy rules (in Sweden the Electronic Communications Act) require consent before non-essential cookies are set, and the GDPR requires that consent to be valid: freely given, informed and as easy to refuse as to give. Consent Mode changes none of this — it is a tool for technical compliance, not an exemption.

Concretely, the default state must be denied. All consent signals must be "denied" until the visitor actively chooses otherwise. An installation defaulting to "granted" sends data to Google from the first page view — regardless of what the banner then says.

Common issues we measure

• Defaults set to "granted" — often a Tag Manager implementation mistake. Data flows to Google before consent.
• Consent Mode exists, but the banner never updates the signals — the visitor's "accept" or "reject" never reaches Google's tags. The result is either data loss or, worse, rejections being ignored.
• GA4 or Ads tags load entirely outside Consent Mode and fire before consent — the framework is in place but the tags don't obey it.
• The default command runs too late, after the tags have already fired — the ordering in the tag setup is wrong.
• Consent Mode used as an excuse to skip the banner — "Google models it anyway". That is not compatible with the consent requirement.

How CompliantHQ tests this

The scanner visits the website in a real browser without touching the cookie banner and measures what is actually sent to Google: which requests go out, and which consent signals they carry. It is a deterministic measurement — we read the actual network traffic, not what the site claims about its configuration.

You see whether Consent Mode is present, which default states apply before consent, and whether data is sent to Google before the visitor has answered.

How to fix it

• Set all consent signals to "denied" by default, and make sure the default command runs before any Google tag.
• Connect the banner to Consent Mode — most established consent platforms (CMPs) have built-in support; verify the update is actually sent when the visitor chooses.
• Put Google's tags under Consent Mode control instead of loading them independently.
• Verify with the browser's network tab or a fresh scan: no requests to Google carrying granted signals before consent.

Common questions

More deep dives

• Cookies before consent
• The reject button
• Banner dark patterns
• YouTube & embeds