Google Consent Mode v2 protects a visitor only when three things are true: the default consent state is denied before any Google tag runs, the banner sends an update the moment someone chooses, and the tags that need consent wait for it. Most broken setups fail one of the three, and the banner then changes nothing. Here is what each failure looks like in the page, and the fix for each.
What Consent Mode v2 actually does
Consent Mode is not a cookie banner. It is a set of four signals, analytics_storage, ad_storage, ad_user_data and ad_personalization, that tell Google's tags what they are allowed to do. With a denied default, gtag sets no cookies and sends only cookieless pings; with granted, it behaves as if the visitor had accepted everything. A banner has one job: flip the signals when the visitor decides. If the signals are wrong, the banner is decoration.
Mistake 1: the default is granted
The most common failure is a default of granted, sometimes copied from a snippet that was written for a site with no banner. The visitor sees a banner, but the tags were already collecting with cookies before it appeared, so accepting or declining changes nothing. Fix: declare every signal as denied in the default call, and let the banner grant on accept. Add wait_for_update so a returning visitor's stored choice is applied before the first hit.
Mistake 2: the default is declared after the tag loads
gtag.js starts sending as soon as it executes. If the consent default sits below the loader in the HTML, or your framework hoists the async loader script into the head above your snippet, the first hits of every session leave before the default applies. Auditaar's own site had exactly this: a React framework moved the loader ahead of the consent snippet. Fix: declare the default in the same inline script that then creates and appends the loader, so the order cannot change, whatever the framework does with script tags.
Mistake 3: the banner never sends an update
A banner built by a designer rather than wired by an engineer often stores a choice and hides itself, and never calls gtag with a consent update. The default stays denied forever, so the site collects nothing from anyone, and the analytics look broken. Fix: on accept, push consent update with every signal granted; on decline, push it with every signal denied; and re-apply the stored choice on every page load before anything else runs.
Mistake 4: a region-scoped default that grants everyone else
Consent Mode lets you scope a default to a list of regions, and a popular pattern is denied for the EEA and UK, granted for the rest of the world. The visitor inside the list is protected. Everyone else is tracked with cookies before they see a banner, which is the opposite of what the banner claims. Fix: if the banner shows everywhere, the default should be denied everywhere. Region scoping only makes sense when the banner itself is region-scoped, and even then a denied default is the safer floor.
Mistake 5: tags outside Google ignore the signals
Consent Mode governs Google tags. A Meta pixel, a session recorder or a chat widget does not read those signals and fires on page load regardless. Fix: gate every non-Google tag in its own right, either through a consent platform that blocks scripts until consent, or by loading each tag only after the banner grants. A tag that fires before the visitor gives consent is the finding that comes up most often in an audit. You can watch the network requests before you accept the banner, so you can see which tags fire without waiting for consent.
How to check your own setup in two minutes
- View the page source and find the consent default call. Every signal should read denied, and the call should appear before the Google loader.
- Open the browser's developer tools before accepting anything and look at the cookies for your domain. A _ga cookie already present means the default is not denied.
- Accept the banner and check the dataLayer for a consent update with the signals granted. If nothing appears, the banner is not wired.
- Reload the page. The stored choice should apply before the first hit, with no banner shown again.
- Run a free Snapshot of your homepage. It reports tracking that runs with no consent gate and whether Consent Mode is present.
Consent Mode v2 FAQ
Does a denied default break GA4 reporting?
No. With a denied default GA4 still receives cookieless pings, so page views and conversions are counted without identifying the visitor. Once a property clears Google's thresholds, behavioral modeling fills in the users and sessions that consent removed.
Is Consent Mode v2 mandatory?
It is required to keep using Google's advertising features for visitors in the EEA and UK, and it is the mechanism Google's own tags expect everywhere. Under Google's Consent Mode v2 rules, a site that runs Google tags without it loses Google's ads measurement features for any visitor who is in those regions.
Do I still need a consent platform if I use Consent Mode?
You need a consent mechanism. A first-party banner that sets a denied default and sends updates is one; a consent platform adds script blocking for tags Google's signals do not govern, which matters as soon as a non-Google tag is on the page.
How do I know the banner sends the update?
Accept it with the developer tools open and inspect the dataLayer. A consent update entry with the four signals granted means it is wired. No entry means the banner only hid itself.
Auditaar's Measurement pillar checks all five of these on every audit: the default state, its position relative to the loader, whether the banner sends an update, and every tag that runs before consent. Start with the free Snapshot of your homepage, and read Consent Mode and the cookieless future for where measurement is heading next.