GDPR Consent Mode v2: The Compliance Checklist
Consent Mode v2 became mandatory for all European Economic Area (EEA) advertisers in March 2024, and enforcement has only tightened since. If your GA4 data or Google Ads conversions have gone suspiciously quiet, there is a high chance your consent setup is misconfigured. Here is the practical, step-by-step checklist to verify compliance.
1. Default Consent: Start Denied
Before any user interaction, your site must set ad_storage, analytics_storage, ad_user_data, and ad_personalization to 'denied'. This tells Google: "do not set cookies, do not send personal data, do not personalize ads" | until the user explicitly opts in. If your consent banner loads after your GTM container, you are already leaking data.
The correct setup places the consent default script above the GTM container in your page's <head>:
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('consent', 'default', {
'analytics_storage': 'denied',
'ad_storage': 'denied',
'ad_user_data': 'denied',
'ad_personalization': 'denied',
'functionality_storage': 'granted',
'personalization_storage': 'granted',
'security_storage': 'granted',
'wait_for_update': 500
});
</script>2. Consent Update: Grant On Interaction
Once the user clicks "Accept All" on your consent banner, you must fire an update command that flips the relevant flags from 'denied' to 'granted'. Google then models the missing data for users who declined | this is what keeps your reports useful even with opt-in rates below 50%.
Most Consent Management Platforms (Cookiebot, CookieYes, Usercentrics, Silktide) handle this automatically via their GTM template. If you are using a custom banner, you must fire the update command manually when the user interacts with it.
3. The Four Signals You Must Track
Consent Mode v2 introduced two new signals beyond the original analytics_storage and ad_storage. All four must be managed:
| Signal | Controls | Default |
|---|---|---|
analytics_storage | GA4 cookies and measurement | denied |
ad_storage | Google Ads conversion tracking cookies | denied |
ad_user_data | Sending user data to Google for ads | denied |
ad_personalization | Personalizing ads based on user data | denied |
4. Verify With Tag Assistant
Open Google Tag Assistant (tagassistant.google.com), connect to your site, and open the Consent tab. You should see all four signals cycling from denied → granted (or staying denied) as you interact with the consent banner. If any signal stays stuck at denied, your consent update mechanism is broken.
5. Language Preference Cookies Are Exempt
Under GDPR Article 5(3) and the ePrivacy Directive, cookies that are "strictly necessary" for a service explicitly requested by the user do not require prior consent. If you offer a language switcher (like we do | Polish and English), the cookie that remembers the user's language preference (nd_lang_pref) is exempt. This means you can set it before the user interacts with your consent banner. Just make sure it is categorised as functionality_storage: 'granted' in your consent defaults , the snippet above already does this.
Real-World Implementation Gotchas
We have now run consent implementation audits across more than 40 client domains. The same problems appear again and again , here are the ones that actually break things, not the theoretical edge cases.
Gotcha 1: The Consent Script Loads After GTM
This is the most common problem we find. The consent default script runs inside <head>, but GTM's container snippet also runs in <head>, and whichever loads first wins. If GTM fires first, it reads all consent signals as undefined , which Google treats identically to 'granted' , and fires a full set of tracking cookies before the consent defaults kick in. Those cookies are then live in the user's browser regardless of what they choose in the banner. The fix is simple: the consent default script must be the very first script in your <head>, before GTM, before analytics, before anything. Not "near the top." First. Period.
Gotcha 2: Consent Update Fires on the Wrong Event
Most CMP templates fire the consent update on DOM Ready or Window Loaded , events that happen once, when the page finishes loading. But if the page loads before the user touches the consent banner, the update fires with the default state (all denied), and the user's actual consent choice never reaches Google. The update should fire on user interaction with the banner , specifically on the click event of the accept button. Test this by opening your consent tab in Tag Assistant and clicking through your banner. If the consent signals never change from denied to granted, your CMP's update trigger is misconfigured.
Gotcha 3: Regional Consent Logic That Does Not Actually Work
Many agencies set up conditional consent , show the full banner to EU visitors and a minimal or no banner to visitors from the US or Asia. The logic typically uses GeoIP (checking the IP address origin), but on the first page load, the IP lookup is asynchronous. The consent default script runs synchronously. Result: the script cannot determine the region yet, defaults to "EU" behaviour (all denied) as a safe fallback, and blocks tracking for non-EU visitors who should not be affected. The workaround: always default to denied in the consent script, but use server-side logic (not client-side JavaScript) to determine whether to show the banner at all. If the visitor is outside the EEA, do not load the CMP JavaScript and set consent to granted server-side. This requires coordination between your web server, your CMS, and your consent setup , but it is the only way to handle regional consent correctly.
Gotcha 4: The wait_for_update Timeout Is Too Short
wait_for_update tells Google how long (in milliseconds) to wait for the user to interact with the consent banner before proceeding with the default state. The default is 500ms. On a typical mobile connection over 4G, a consent banner can take 1-2 seconds to render and become interactive. If your timeout is 500ms, Google proceeds with "denied" for a lot of users who would have accepted. Bump it to 2000ms. Yes, this delays your page's first measurement event by up to 2 seconds for users who interact with the banner , but losing 2 seconds of measurement is far better than losing the user's consent entirely because they did not click fast enough.
Gotcha 5: Ads Data Redaction and URL Passthrough Are Missing
These two lines appear in the consent defaults snippet we showed above, and they are not optional:
gtag('set', 'ads_data_redaction', true);
gtag('set', 'url_passthrough', true);ads_data_redaction strips ad click identifiers from event data when consent is denied , without it, you are sending identifiers associated with a user who explicitly said no. url_passthrough preserves the GCLID in the URL so Google can model conversions later. Without it, the GCLID is lost, Google cannot model anything, and your conversion volumes drop to whatever survives cookieless attribution. We find these two lines missing in roughly one-third of the setups we audit.
CMP Comparison: Which Consent Manager Fits Your Stack
Not all Consent Management Platforms handle Consent Mode v2 equally well. Here is a practical comparison based on real deployment experience across client sites , not feature-sheet marketing claims.
| CMP | Consent Mode v2 Support | GTM Template Quality | Approx. Monthly Cost | Best For |
|---|---|---|---|---|
| Cookiebot (Usercentrics) | Full v2 , all four signals | Mature, well-tested | €15-45/month | Multi-domain agencies; auto-cookie scanning saves hours |
| CookieYes | Full v2 | Good , occasional consent-update timing issues | €10-25/month | Budget-conscious SMB sites; solid free tier for low traffic |
| Usercentrics CMP v2 | Full v2 | Excellent , purpose-level consent mapping | €30-100/month | Larger enterprises with complex consent requirements (TCF, multi-regulation) |
| Silktide | Full v2 | Clean, lightweight , good defaults | Free-€20/month | Sites that want a minimal, fast consent banner (we use it here on north-digital.eu) |
| OneTrust | Full v2 , but requires manual GTM setup | Heavy; template exists but is complex | Free-€500+/month | Enterprise legal teams who need full privacy programme management |
| Custom / In-house | Possible , but most implementations are incomplete | You build it yourself | Development time | Sites with unique UX requirements where off-the-shelf CMPs do not fit the design |
A few practical notes on the table above. First, "full v2" means the CMP handles all four consent signals , do not assume this is universal; always verify during your trial. Second, the cost ranges reflect the plan tiers most small-to-medium sites end up on based on pageview volumes. Enterprise pricing can be significantly higher. Third, the "Best For" column is based on our actual migration experience moving clients between CMPs, not on vendor documentation.
If you are switching CMPs, one thing to watch: when you remove the old CMP's script from your site, the consent state stored in the user's browser (typically in localStorage or a cookie) becomes orphaned. Users who previously accepted consent will be prompted again on their next visit. This is technically correct behaviour (you should re-collect consent when changing the consent provider, since the legal basis has changed), but it will cause a short-term dip in your tracked conversion volumes as users re-consent. Plan the migration for a low-traffic period and communicate the expected data dip to your clients in advance.
ICO Enforcement: What Happens When You Get It Wrong
The UK Information Commissioner's Office (ICO) has been increasingly active on consent-related enforcement since mid-2025, and their approach provides a useful benchmark for what other European data protection authorities consider non-compliance. Here is what real enforcement looks like, not theoretical maximum fines.
In March 2026, the ICO issued enforcement notices to three major UK retailers after a coordinated sweep of cookie consent practices. The common violations: consent banners with pre-ticked marketing boxes (prohibited under PECR and GDPR), analytics cookies firing before any user interaction with the banner, and "legitimate interest" used as a blanket justification for advertising cookies , which the ICO has explicitly stated is not valid for tracking that profiles users across sites. None of the three retailers were fined in this round , the ICO issued compliance deadlines with follow-up audits , but the notices are public and the reputational impact is real. Two of the three retailers saw their names in national press coverage within 48 hours.
In the EU, the French CNIL fined a major online marketplace €40 million in January 2026 specifically for consent-related violations tied to Google Analytics data transfer. The core finding: the site set Google Analytics cookies before the consent banner appeared, then continued to transfer personal data to US-based Google servers under the now-invalidated Privacy Shield framework. The fine was not for using Google Analytics , it was for using it without a valid consent mechanism and without adequate data transfer safeguards.
What these cases tell us, practically: European regulators are not currently hunting down every small website with a slightly late consent script. They are targeting systemic violations at scale , pre-ticked boxes, analytics firing before consent, and data transfers to jurisdictions without adequacy decisions. If your consent setup is mostly correct but has minor timing issues, the immediate risk is not a fine , it is the degradation of your Google Ads and GA4 data, which hits your marketing performance directly. That said, the ICO and its EU counterparts are coordinating through the European Data Protection Board, and the enforcement is steadily upward. Getting consent right today is cheaper than defending a regulatory investigation next year.
One specific area to watch: the ICO's position on "consent or pay" models (cookie walls that require users to either accept tracking or pay for access) is still evolving. As of mid-2026, the ICO has not issued definitive guidance, but the EDPB's preliminary opinion suggests that a genuine, freely-given choice requires a reasonable alternative , and a paywall at €10/month on a site that previously had free access may not qualify as reasonable. If your clients are considering a consent-or-pay model, get legal advice specific to their jurisdiction and market position. The rules around this are changing too fast for generic blog post guidance to be reliable.
Need someone to audit your consent setup? Book a compliance check with North Digital.