Google Consent Mode 2.0¶
Google Consent Mode v2 (GCM v2) became mandatory for all Google Ads advertisers targeting EU traffic from March 2024. Waulter supports both Basic and Advanced modes out of the box — the SDK handles all consent signalling automatically.
What is Google Consent Mode?¶
Google Consent Mode is an API that lets you communicate your visitors' consent state to Google tags (Analytics, Ads, Floodlight). Instead of blocking or loading tags based on consent, you signal the consent state and let Google adjust tag behaviour accordingly.
Key benefit: You maintain a single set of tags on the page. Google tags respond to consent signals without you having to add or remove tags.
The 7 consent types¶
GCM v2 defines seven consent signals:
| Consent Type | Controls | Required for |
|---|---|---|
analytics_storage | Google Analytics cookies | GA4, Universal Analytics |
ad_storage | Google Ads cookies | Google Ads, Campaign Manager |
ad_user_data | Sending user data to Google for advertising | Google Ads conversions |
ad_personalization | Personalised advertising and remarketing | Remarketing, similar audiences |
functionality_storage | Functional cookies (language, region) | Optional |
personalization_storage | Personalisation cookies | Optional |
security_storage | Security cookies (authentication, fraud prevention) | Always granted |
New in v2
ad_user_data and ad_personalization are new in GCM v2. They are required for Google Ads conversion tracking and remarketing in the EU.
Basic Mode vs Advanced Mode¶
| Basic Mode | Advanced Mode | |
|---|---|---|
| Before consent | No Google tags fire. No data is collected. | Google tags send aggregated, cookieless pings. No cookies are set. |
| After consent | Tags fire normally with full measurement. | Tags fire normally with full measurement. |
| Conversion modelling | Not available (no pre-consent data) | Google uses pre-consent pings for conversion modelling and audience estimation |
| Data collection before consent | None | Aggregated signals only — no user-level data, no cookies |
| Best for | Maximum privacy; compliance-first approach | Better analytics coverage while still respecting consent |
How Advanced Mode works¶
In Advanced Mode, Google tags operate in a privacy-preserving state before the visitor consents:
- Tags load but do not set cookies
- Tags send cookieless pings — aggregated signals without user identifiers
- Google uses these signals for conversion modelling (estimating conversions from unconsented visitors) and audience estimation
- Once the visitor consents, tags switch to full measurement mode
Advanced Mode is recommended
Google recommends Advanced Mode for better analytics accuracy. The cookieless pings contain no personal data and are fully compliant with GDPR when used with a CMP like Waulter.
Waulter's automatic GCM integration¶
When you deploy Waulter with useGtm: true, the SDK handles all GCM signalling automatically. You do not need to write any consent mode code yourself.
What happens automatically¶
sequenceDiagram
participant Page as Page Load
participant SDK as Waulter SDK
participant GTM as Google Tag Manager
participant Tags as Google Tags
Page->>SDK: SDK loads
SDK->>GTM: dataLayer.push({ event: 'gtm.init_consent' })
SDK->>GTM: gtag('consent', 'default', { all: 'denied' })
alt Advanced Mode
Tags-->>GTM: Send cookieless pings (no cookies set)
else Basic Mode
Note over Tags: Tags wait — no activity
end
Page->>SDK: Visitor clicks "Accept All"
SDK->>GTM: gtag('consent', 'update', { analytics_storage: 'granted', ... })
SDK->>GTM: dataLayer.push({ event: 'Waulter:Decision' })
GTM->>Tags: Consent granted — tags fire with full measurement Step by step:
- SDK starts — pushes
gtm.init_consentand sets all signals todenied - Banner appears — visitor sees consent options
- Visitor decides — SDK maps accepted purposes to GCM signals and pushes a
consent update - Tags respond — Google tags that were waiting for consent now fire
Default consent state¶
On every page load, the SDK sets all signals to denied:
gtag('consent', 'default', {
ad_personalization: 'denied',
ad_storage: 'denied',
ad_user_data: 'denied',
analytics_storage: 'denied',
functionality_storage: 'denied',
personalization_storage: 'denied',
security_storage: 'denied'
});
This ensures no Google tags collect data before the visitor has consented.
Default denied is expected — not a bug
When you check GTM's Consent tab, you will always see all signals as denied on initial page load — regardless of whether you use Basic or Advanced Mode. This is correct and required by GDPR/ePrivacy: no tracking storage is permitted until the visitor explicitly consents.
The difference between the two modes is what happens while signals are denied:
- Basic Mode — Tags do not fire at all. No data collection occurs until consent is given.
- Advanced Mode — Tags fire in a cookieless mode, sending aggregated signals without storing cookies. Google uses these signals for conversion modelling. Tags switch to full measurement once consent is
granted.
In both cases, denied is the legally required starting state. If you see denied in GTM Preview, your setup is working correctly.
Verify in GTM Preview
Open GTM Preview > Tag Assistant > Consent tab to inspect the default consent state and confirm signals update after the visitor interacts with the banner.
Consent update after decision¶
After the visitor decides, the SDK builds a consent update from the accepted purposes:
// Example: visitor accepted analytics + advertising purposes
gtag('consent', 'update', {
ad_personalization: 'granted',
ad_storage: 'granted',
ad_user_data: 'granted',
analytics_storage: 'granted',
functionality_storage: 'denied',
personalization_storage: 'denied',
security_storage: 'granted'
});
See Purposes — Purpose-to-GCM signal mapping for which purposes map to which signals.
Configuring GCM mode¶
In the Waulter dashboard¶
- Open your website configuration in the dashboard.
- Navigate to the Google Consent Mode section.
- Choose Basic or Advanced mode.
- Save the configuration.
The mode is stored on the configuration (not in the SDK). This means you can switch modes without changing any code on your site.
In the GTM template¶
If you use the Community Template, select the GCM Mode in the template fields:
| Field | Options |
|---|---|
| GCM Mode | Basic / Advanced |
Testing GCM integration¶
Using GTM Preview + Tag Assistant¶
- In GTM, click Preview and enter your site URL.
- The Tag Assistant panel opens alongside your site.
- Check the Consent tab in Tag Assistant:
| What to verify | Expected result |
|---|---|
| Default consent state | All signals show denied |
| After "Accept All" | Relevant signals change to granted |
| After "Reject All" | All signals remain denied |
| After "Mixed" selection | Only relevant signals change to granted |
gtm.init_consent event | Fires first, before any other events |
Using browser Developer Tools¶
- Open the Console tab.
- Enable
debug: truein your WaulterConfig. - Look for consent-related log entries showing default and update calls.
- Check the Network tab for Google tag requests — in Basic Mode, no requests should appear before consent.
Common testing scenarios¶
| Test | Steps | Expected |
|---|---|---|
| New visitor | Open site in incognito | Banner appears, default consent is all denied |
| Accept all | Click "Accept All" | All signals become granted, analytics/ad tags fire |
| Reject all | Click "Reject All" | All signals remain denied, no tags fire |
| Mixed consent | Open preferences, select only analytics | analytics_storage: granted, ad signals remain denied |
| Returning visitor | Accept, close, reopen site | Banner not shown, stored consent signals applied on load |
Clear consent for testing
To test as a new visitor, you must delete all Waulter storage — not just the cookie. In Chrome Developer Tools (F12) > Application tab:
- Cookies — delete
vaswaulterfrom both first-party (your domain) and third-party cookies - Local Storage — delete any Waulter-related entries (select your domain → find and remove Waulter keys)
- Reload the page
Deleting only the cookie is not enough — the SDK also checks localStorage for consent state. If either remains, the banner will not reappear. Always clear both to get a clean test.