How to Set Up GA4 with Google Consent Mode v2

What Consent Mode v2 does

Consent Mode tells Google tags what the visitor agreed to through four signals: analytics_storage, ad_storage, and the two added in v2, ad_user_data and ad_personalization. While a signal is denied, tags don’t set cookies for that purpose; in advanced mode they still send cookieless pings that Google uses to model conversions.

Step 1: set the default before any tag

The default must run before gtag.js or Google Tag Manager loads, at the top of <head>:

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('consent', 'default', {
    ad_storage: 'denied',
    ad_user_data: 'denied',
    ad_personalization: 'denied',
    analytics_storage: 'denied',
    functionality_storage: 'granted',
    security_storage: 'granted',
    wait_for_update: 500
  });
</script>

Generate this block together with your GA4 tag in the right order with the Google Tag Snippet Generator.

Step 2: update consent from the banner

When the visitor makes a choice, send an update with only what they accepted, and remember the choice for their next visit:

function onConsent(choice) {           // e.g. { analytics: true, marketing: false }
  gtag('consent', 'update', {
    analytics_storage: choice.analytics ? 'granted' : 'denied',
    ad_storage: choice.marketing ? 'granted' : 'denied',
    ad_user_data: choice.marketing ? 'granted' : 'denied',
    ad_personalization: choice.marketing ? 'granted' : 'denied'
  });
  localStorage.setItem('consent', JSON.stringify(choice));
}

On later page loads, call the same update right after the default, before tags fire. A consent management platform (Cookiebot, OneTrust, Usercentrics and others) can do this for you; or build a banner with script blocking using the Cookie Consent Banner Generator.

Step 3: regions (optional)

You can apply stricter defaults only where the law requires them by adding a region list, for example the EEA, the UK and Switzerland, and a granted default elsewhere. Check with your legal advisor which regions apply to you.

Step 4: verify it works

1. Open the site in a private window and don’t click the banner. No _ga cookies should exist, and requests to Google should carry gcs=G100.
2. Accept all. Requests should switch to gcs=G111 and the _ga cookie should appear.
3. Reject all and reload: nothing should be set again.

The Consent Mode Checker does this automatically: it loads your page in a real browser, reads the consent state and lists every tracker that fires before and after consent. Use the Tracking Tag Checker to see which tags a page loads at all.

Common mistakes

• Setting the default after the GA4 tag — the first hit is sent before consent is known.
• Forgetting ad_user_data and ad_personalization — that is still Consent Mode v1.
• Hard-coding Meta, TikTok or LinkedIn pixels outside the consent flow: Consent Mode only controls Google tags. Block other pixels until marketing consent is given.
• Sending custom events before consent. Create them with the GA4 Event Generator and send them through gtag so consent applies.