Google Consent Mode v2: A UK Setup Guide

Google Consent Mode v2 is how Google’s tags read a UK visitor’s cookie choice and adjust what they collect. When someone accepts, the tags behave normally. When someone declines, the tags either stay off (basic mode) or switch to sending anonymous, cookieless signals instead (advanced mode). It exists so you can respect UK consent law under PECR while still measuring Google Ads and GA4 with reasonable accuracy. Set it up correctly and your reporting holds together. Ignore it and you quietly lose conversions, modelled data and, potentially, compliance.

This piece is the dedicated consent layer. If you still need to install Analytics itself, our GA4 setup guide for UK websites covers that end to end, and this guide stays focused on getting consent right whatever you have already installed. It is also vendor-neutral: there is no single cookie tool to buy here, only a sequence to get correct.

What Consent Mode v2 is, and why it exists

Consent Mode v2 is a signalling layer that sits between your cookie banner and Google’s tags. It is not the banner, and it is not a consent tool in its own right. It is the agreed language your tags use to find out what the visitor chose, and then behave accordingly.

The “v2” matters. The original consent mode handled storage signals only. Version 2 added two advertising-specific signals, ad_user_data and ad_personalization, in response to tighter rules on how user data reaches advertising platforms. Google then began enforcing its consent requirements. Since March 2024, Google has required these consent signals for Google Ads features such as conversion measurement and remarketing audiences across the UK and EEA, so accounts without them stop capturing new users into audience lists (Google Ads Help, FAQs about the EU user consent policy).

That requirement flows from Google’s EU user consent policy, which obliges you to get legally valid consent for cookies and for the use of personal data in ad personalisation, to keep records of that consent, and to tell people how to withdraw it. Consent Mode v2 is simply the mechanism that carries those choices into Google’s own tags.

The UK law in plain terms: PECR, UK GDPR and the ICO

In the UK you generally need consent before setting non-essential cookies, and most Google tags set non-essential cookies. That single sentence is the whole reason this work exists.

The Privacy and Electronic Communications Regulations (PECR) require consent before you store or read information on someone’s device, unless a narrow exception applies. Analytics and advertising cookies are non-essential, so they need consent. Valid consent, borrowing the UK GDPR standard, has to be freely given, specific, informed and unambiguous. In practice that means no cookies before the choice is made, no pre-ticked boxes, granular options that separate analytics from advertising, and rejecting made as easy as accepting.

Two 2026 changes are worth knowing. The Data (Use and Access) Act 2025 commenced its next phase on 5 February 2026, which added a narrow “statistical purposes” exception and raised the maximum PECR fine to £17.5 million or 4% of global turnover (ICO, Statement on the commencement of the DUAA). The ICO then finalised its guidance on the use of storage and access technologies, which explains how consent and the exceptions fit together, and which the ICO continues to interpret narrowly.

The catch is how narrow the statistical exception really is. It covers aggregate statistics used to improve your own service, and GA4 works at user level, so most UK sites still need consent before it runs. This is general guidance rather than legal advice, so treat the ICO’s own material as the authority and get sign-off from whoever owns compliance before you finalise your approach.

The four consent signals

Consent Mode v2 works through four consent signals, each set to a simple granted or denied. Your cookie banner decides the value of each one, and Google’s tags read them before they do anything.

The first two existed before. The last two, ad_user_data and ad_personalization, are what version 2 added, and they are the ones Google now insists on for UK and EEA advertising. Google’s developer reference sets out all four and how tags respond to them (Google for Developers, Set up consent mode on websites).

Basic versus advanced consent mode

Consent Mode v2 comes in two implementations, and the difference is a genuine trade-off between simplicity and data completeness.

• Basic: Google tags are blocked until the visitor consents. Nothing fires before opt-in, which is the cleanest story to tell under PECR, but you collect nothing from anyone who declines, so your reports carry visible gaps. In this setup, conversion modelling in Google Ads falls back to a general model built from aggregate industry data rather than your own.
• Advanced: the tags load with consent defaulted to denied and send cookieless pings when a visitor has not consented. No cookies and no personal identifiers are stored, and Google uses those pings for behavioural and conversion modelling to fill the gaps, so your data is more complete.

Google leans towards advanced because of the modelling it enables (Google Analytics Help, Consent mode on websites and mobile apps). Many UK teams are comfortable with it because the pre-consent pings are cookieless by design, but this is a legal judgement as much as a technical one. If you are unsure, start with basic and move to advanced once compliance has signed it off. Note too that modelling only kicks in once you have enough traffic volume, so very small sites may see little benefit from advanced at first.

How a CMP wires into Consent Mode

A consent management platform (CMP) is the piece that actually captures the visitor’s choice and passes it to Google. Consent Mode listens; the CMP speaks. The exact clicks vary by tool, but the order never does.

1. Choose a Google-certified CMP. It has to be one Google recognises for Consent Mode v2. The certification is what matters, not the brand, and any certified tool can do the job, so pick on fit and budget rather than hype.
2. Configure the banner properly. Granular categories, opt-in behaviour, no non-essential cookies before consent, and reject as easy as accept.
3. Set the default consent state to denied for all four signals, firing before any other tag loads (in Google Tag Manager, on Consent Initialisation). This is the step that keeps tags quiet until the visitor decides.
4. Let the CMP update the state when the visitor makes a choice, granting or keeping each signal denied.
5. Confirm your Google tags honour the signals. GA4 and the Google tag have built-in consent checks and will respect analytics_storage and ad_storage automatically once the signals flow.

Make sure your own cookie policy describes what you actually set, in plain terms, so the information you give people matches the behaviour of your tags. A banner that says one thing while the tags do another is its own compliance risk.

How to verify it is working

Never trust a consent setup you have not tested with cookies rejected. The common failure is a banner that looks right while tags fire underneath it regardless, so test the deny path as carefully as the accept path.

• Tag Assistant and GTM Preview: load your site through Preview and check the consent state reads as denied before any choice, then updates when you accept or reject.
• Reject, then inspect: decline on your banner and confirm no analytics or advertising cookies are set. On advanced mode, confirm cookieless pings are sent instead of nothing.
• DebugView and Realtime: accept, then watch events arrive in GA4 to confirm the granted path works too.
• Check both regions and both answers: it is easy to get accept right and deny wrong, which is exactly the half that carries the legal risk.

If you would rather not sit in Tag Assistant yourself, wiring and checking the consent layer is part of our analytics and measurement work.

What breaks if you ignore it

Skip Consent Mode v2 and the damage shows up in three places: your advertising, your data, and your legal exposure. None of them announce themselves, which is why this gets missed until something dips.

• Google Ads. Conversion measurement and remarketing audiences degrade for UK and EEA visitors, and you stop adding new users to audience lists. Campaigns optimise on thinner data and bidding suffers, which is a slow, expensive leak. If you are setting up tracking from scratch, pair this with proper Google Ads conversion tracking so the two work together.
• GA4 and modelling. Without the cookieless pings from advanced mode, Google has nothing to model from, so visitors who decline simply vanish from your numbers. Your reports undercount, and the gap grows with every declining visitor.
• Compliance. Tags that fire before consent breach PECR, and the stakes rose this year. With maximum fines now up to £17.5 million or 4% of global turnover, a decorative banner over live tags is a risk worth closing properly.

Where to start

Start by testing your deny path, because that is where the problems hide. Reject cookies on your own site and watch what the tags actually do. If anything fires before you choose, or nothing recovers after you decline, you have found your gap. Most sites we look at are strong on the accept path and blind on the reject path, which is the exact half that matters for both compliance and data.

If you would rather have it built and checked for you, book a free growth review and we will look at how your consent is wired, flag what is off, and tell you what to fix. Prefer to talk it through first? Get in touch and we will point you in the right direction, no lock-in.