# Consent Mode v2 and CMPs in Google Tag Manager

> Implement Google Consent Mode v2 in GTM with CMP templates: ad_storage, analytics_storage, ad_user_data, ad_personalization, basic vs advanced. Nov 2026.

Source: https://mentionx.ai/learn/gtm/gtm-consent-mode-v2  
Author: Dipuck Jones, founder of MentionX  
Updated: 5 November 2026  
Level: Practitioner

**Consent Mode tells Google tags how to behave based on the user’s cookie and advertising consent. Consent Mode v2 adds `ad_user_data` and `ad_personalization` beside `ad_storage` and `analytics_storage`. In GTM you set defaults early (Consent Initialization), update state when the CMP responds, and let consent-aware tags adjust.**

> **Key takeaways**
>
> - Set default consent before ads/analytics storage tags fire.
> - Use a CMP or consent template that calls GTM consent APIs (`setDefaultConsentState` / `updateConsentState`), not late `gtag consent` hacks when possible.
> - Cover all four v2 parameters for EEA-relevant traffic.
> - Verify with Tag Assistant consent debugging, not only a visual banner click.

*Checked 5 November 2026 (CET) against Google Tag Manager Help, Google tag platform developer docs, Google Ads Help, Analytics Help and Meta Business Help where cited. Google Tag Manager, GA4 and Ads UIs change often, so confirm labels in your own accounts. "Our view" marks MentionX opinion. Ledgerline is a fictional company used for illustration.*

## The four parameters you must know

Per Google’s consent mode documentation:

| Parameter | Meaning |
|---|---|
| `ad_storage` | Advertising cookies/storage |
| `analytics_storage` | Analytics cookies/storage |
| `ad_user_data` | Sending user data to Google for online advertising |
| `ad_personalization` | Personalised advertising |

Additional types exist (`functionality_storage`, `personalization_storage`, `security_storage`) for finer CMP setups.

## Default then update

Google’s template guidance: set defaults immediately using the **Consent Initialization - All Pages** trigger, then update when the user chooses. Defaults for EEA traffic are often `denied` until grant — align with legal counsel and your CMP’s regional rules.

**Caveats.** Using raw `gtag('consent', ...)` inside Custom HTML can queue later than you think. Google’s template docs recommend Tag Manager consent APIs (`setDefaultConsentState`, `updateConsentState`) inside sandboxed templates.

## CMP options

1. **Community Template Gallery CMP** that supports Consent Mode v2 (Cookiebot, OneTrust, and others — verify current gallery listings).
2. **Custom consent template** built by your developers per Google’s consent template APIs.
3. **Banner outside GTM** that still calls the consent update APIs in a supported way.

Whatever you pick, the banner must appear promptly and record choices for all required types.

## Basic vs advanced (marketer summary)

Covered in depth in [GA4 Consent Mode v2](https://mentionx.ai/learn/ga4/ga4-consent-mode-v2-basic-advanced) and [Ads consent mode](https://mentionx.ai/learn/google-ads/google-ads-consent-mode-eea-uk):

- **Basic:** wait for consent before firing storage-using tags; less modelling signal.
- **Advanced:** tags may send cookieless / limited pings when denied; Google may model gaps when requirements are met.

Your legal and analytics leads should choose deliberately. GTM implements the plumbing either way.

## Tag consent settings

In GTM, tags can require specific consent types to fire. Built-in Google tags are generally consent-aware. Custom HTML tags often need additional care — they may not magically know consent unless you gate them with consent checks or Consent Mode-aware templates.

*Our view:* treat unmanaged Custom HTML pixels as the highest consent risk in the container. Replace with templates where possible.

## Server-side note

With server-side tagging, Google documents that consent is typically established in the web container and passed to the server. You still configure Consent Mode properly client-side (lesson 17).

## Worked example: Ledgerline

*Ledgerline is a fictional accounts-payable software company. Details are illustrative.*

Ledgerline’s CMP showed a banner but never fired `updateConsentState` for `ad_user_data` and `ad_personalization`. Ads conversion modelling looked odd after policy enforcement dates. Updating the CMP template to v2 parameters restored expected consent signals in Tag Assistant.

They also found a Custom HTML LinkedIn tag firing regardless of consent. It was moved behind additional consent checks / a consent-aware template approach.

### Walkthrough

1. In Preview, open a fresh session from an EEA test VPN or region setting if you use regional defaults.
2. Before interacting with the banner, inspect consent state in Tag Assistant / GTM consent debug.
3. Accept ads + analytics; confirm updates flip to granted for all four v2 params.
4. Reject all; confirm Google tags respect denied storage behaviour.
5. Publish only after legal signs off the banner copy and categories.

> **Pro move:** add a quarterly "consent fire drill" — 20 minutes in Preview checking grant, deny and partial accept paths.

## Regional defaults

You can set different default consent by region (for example deny ads storage in EEA, grant in regions where your policy allows different defaults). Mis-set regions cause either compliance risk or unnecessary data loss. Legal owns the matrix; GTM implements it.

## Modelling expectations

Advanced mode may allow Google to model conversions when requirements are met — it is not magic recovery of every denied hit. Read the GA4 lesson for what modelling can and cannot do. Never promise finance "Consent Mode restores 100%".

## Tag Assistant consent debugging

During Preview, confirm each Google tag’s consent status on grant and deny paths. If a Custom HTML tag still fires under deny for ad storage, treat it as a defect even if "everyone uses that pixel".

## CMP template updates

CMP vendors ship Consent Mode v2 template updates. Pin a quarterly reminder to check the Community Template version and release notes. An outdated template is a quiet compliance risk.

## Custom HTML pixels under consent

For each Custom HTML tag, ask: does it understand Consent Mode? If not, either replace it with a consent-aware template, wrap firing in additional consent checks, or remove it. "We'll fix consent later" is how containers fail audits.

## Implementation sequence that fails less often

1. Legal signs off default states by region.
2. Install CMP with official GTM template (or vendor-supported pattern).
3. Confirm Consent Initialization tag / default runs first in Preview.
4. Map banner categories to the four v2 parameters.
5. QA grant path and deny path with Tag Assistant consent debug.
6. Only then enable Ads remarketing tags that depend on storage.
7. Document the matrix in the same sheet as the event dictionary.

Skipping step 1 and "just denying everything globally" can kneecap measurement outside the EEA without legal benefit. Skipping step 5 ships a pretty banner that never updates GTM state.

## Wait for update vs fire anyway

Advanced Consent Mode may send cookieless pings when denied (per Google’s model). That is different from firing a raw Meta Pixel Custom HTML that ignores consent. Treat Google’s Consent Mode-aware tags and rogue Custom HTML differently in the audit.

## Coordination with Meta and others

Consent Mode is Google’s API. Meta, LinkedIn and TikTok need their own consent handling via CMP integration or trigger conditions. A green Consent Mode setup does not automatically silence a Custom HTML pixel. Inventory every non-Google tag against the CMP.

## Banner UX that breaks consent wiring

Watch for:

- Soft walls that let users browse without a choice while tags already set granted defaults.
- "Accept all" that updates UI only and never calls `updateConsentState`.
- Preference centre toggles that do not map to `ad_user_data` / `ad_personalization`.
- Geo mis-detection showing the wrong banner script.

Have legal and marketing ops click through together with Tag Assistant open once per quarter.

## Documentation pack for auditors

Keep: CMP contract + DPA, parameter matrix, screenshots of deny/grant Tag Assistant, list of tags with Additional Consent Checks, and the date of last template update. When a prospect’s security questionnaire asks about tracking consent, you answer from this pack — not from memory.

## Google tags vs non-Google tags under consent

Consent Mode primarily governs Google tags (Google tag / GA4, Ads, Floodlight, and other consent-aware Google tags). A Custom HTML Meta Pixel, LinkedIn Insight Tag, or TikTok Pixel does **not** automatically become compliant because you enabled Consent Mode v2. For those:

- Use CMP integrations that gate their scripts, or
- Apply GTM **Additional Consent Checks** on the tag (where the tag type supports it), or
- Fire only on a Custom Event your CMP pushes after the relevant category is granted.

Audit non-Google tags as a separate column in the inventory sheet: `consent_method = CMP script | additional check | custom trigger | NONE`. Anything marked NONE is a finding.

## Basic vs advanced — decision framing for marketers

**Basic:** tags wait until consent updates. Simpler mental model; less data before consent.

**Advanced:** tags may load in a restricted way before consent and send cookieless or limited pings; when the user grants, behaviour upgrades. Google may model conversions when eligibility requirements are met — modelling is statistical, not a full restore of every denied hit. Read the modelling caveats in the [GA4 consent and modelling material](https://mentionx.ai/learn/ga4/ga4-for-marketers) and never promise finance a fixed recovery percentage.

Pick basic vs advanced with legal + analytics together. GTM implements the choice; it should not invent it.

## Try it yourself

List every non-Google tag in the container. Mark each Consent Mode aware / unknown / not aware. Make a plan for the unknowns.

## Quick quiz

**1. Name the two Consent Mode v2 parameters added beyond ad_storage and analytics_storage.**

*Answer:* `ad_user_data` and `ad_personalization`.

**2. Which trigger is used for consent defaults?**

*Answer:* Consent Initialization - All Pages (for setting defaults early).

**3. Does a banner alone equal Consent Mode?**

*Answer:* No. The CMP must communicate choices via consent APIs to Google tags.

## What should you check before the next lesson?

- CMP supports v2 parameters.
- Defaults fire on Consent Initialization.
- Tag Assistant shows expected grant/deny behaviour.

Previous: [Meta Pixel and CAPI basics](https://mentionx.ai/learn/gtm/gtm-meta-pixel-capi). Next: [Form, click and scroll tracking](https://mentionx.ai/learn/gtm/gtm-form-click-scroll-tracking). Or return to the [GTM for Marketers track](https://mentionx.ai/learn/gtm/gtm-for-marketers).

## Common questions

**What changed in v2?** Added `ad_user_data` and `ad_personalization`.

**Basic vs advanced?** Timing/limited pings and modelling trade-offs — see GA4 lesson.

**Banner = Consent Mode?** No; need API updates.

## Sources

- Google Tag Platform, [Consent mode on websites](https://developers.google.com/tag-platform/security/guides/consent)
- Google Tag Platform, [Create a consent mode template](https://developers.google.com/tag-platform/tag-manager/templates/consent-apis)
- All accessed 5 Nov 2026.

## Frequently asked questions

### What changed in Consent Mode v2?

Two parameters were added: ad_user_data and ad_personalization, required alongside ad_storage and analytics_storage for Google’s EU user consent policy updates.

### Basic vs advanced?

Basic waits to load tags until consent; advanced loads tags in a limited way before consent and upgrades when granted. See GA4 track for modelling implications.

### Does GTM replace my cookie banner?

No. A CMP collects choices; Consent Mode communicates them to Google tags.

---

Written and reviewed by Dipuck Jones for MentionX Learn. The HTML version of this page: https://mentionx.ai/learn/gtm/gtm-consent-mode-v2