Google Consent Mode v2 Setup in Google Tag Manager: Cookie Banners, Advanced vs Basic Mode, and Meta Pixel

Cookie banners confuse people because two different things get mixed together: the legal question of when you are allowed to track, and the technical question of how your tags respond to the answer. This guide covers the technical side, specifically how to set up Google Consent Mode v2 in Google Tag Manager and what to do about tags that do not support it. It is not legal advice.

The Idea in One Sentence

No permission, no tracking. The banner collects the visitor's choice, Consent Mode passes that choice to Google tags, and GTM blocks every other tag until the right permission exists.

The Four Consent Signals

Consent Mode v2 uses four signals:

• analytics_storage controls analytics cookies, used by GA4.
• ad_storage controls advertising cookies, used by Google Ads and Floodlight.
• ad_user_data controls whether user data can be sent to Google for advertising.
• ad_personalization controls remarketing and personalised ads.

The last two were added in version 2 and are required for Google Ads features in the EU and UK. Always implement version 2.

Advanced vs Basic Mode

Advanced Consent Mode. Google tags load on every page view. Before consent, they run with all four signals denied, which means no cookies and only limited cookieless pings. After the visitor accepts, they work normally. Google uses the denied-state pings to model conversions and behaviour you could not observe. This is the mode that keeps the most data.

Basic Consent Mode. Google tags do not fire at all until consent is granted. If the visitor rejects, nothing is sent. Modelling is more limited. This is the mode to choose if your organisation does not want any Google request before consent.

For most businesses I set up Advanced mode for Google tags and Basic style blocking for everything else.

Step 1: Choose a Consent Management Platform

Use a CMP that supports Consent Mode v2 natively and has a Google Tag Manager template: Cookiebot, CookieYes, Usercentrics, Complianz, Iubenda and OneTrust all do. The CMP is responsible for showing the banner, storing the choice and sending the consent update to Google.

In GTM, add the CMP's template tag from the Community Template Gallery and fire it on the Consent Initialization trigger. That trigger exists specifically to run before every other tag, including All Pages tags.

Step 2: Set the Default Consent State

The CMP template sets the default state for the four signals, which should be denied for EU and UK regions and may be granted elsewhere, depending on your policy. If you configure defaults by region, test with a VPN. Defaults must be set before any Google tag fires, which is why the Consent Initialization trigger matters.

Step 3: Configure Google Tags for Advanced Mode

Open each Google tag in GTM: Google tag, GA4 Event, Google Ads Conversion Tracking, Conversion Linker, Google Ads Remarketing. Under Advanced Settings, then Consent Settings, the built-in consent checks are listed. Choose No additional consent required. The tag will read the Consent Mode signals and adjust itself automatically.

Step 4: Block Non-Google Tags Until Consent

Meta Pixel, TikTok, LinkedIn Insight, Pinterest, Hotjar and similar do not understand Consent Mode. For each, open Consent Settings and choose Require additional consent for tag to fire, then add:

• ad_storage for advertising pixels such as Meta and TikTok
• analytics_storage for analytics and heatmap tools

GTM will hold the tag until that signal is granted. If the visitor grants consent after the page loaded, GTM fires the queued tag when the CMP sends the update, provided your trigger setup allows it. Most CMP templates push a consent update event you can use as an additional trigger for tags that should fire immediately after acceptance.

If you prefer Basic mode for Google tags as well, apply the same consent requirements to them: analytics_storage for GA4 tags, ad_storage for Google Ads tags.

Step 5: Handle the Update Event

When the visitor clicks Accept, the CMP calls the consent update and usually pushes a dataLayer event. Tags that were held by a consent requirement and whose trigger already passed will not re-fire on their own. For the Google tag and the Meta base pixel, add the CMP's consent update event as a second trigger so they fire right after acceptance without a page reload.

Step 6: Test It Properly

Test as a brand new visitor each time, because the CMP remembers your choice.

1. Clear cookies for the site, or use a fresh incognito window.
2. Open GTM Preview and load the site. On the first event, open the Consent tab. All four signals should show denied by default. No Meta or TikTok tags should have fired.
3. Click Accept. Confirm the four signals change to granted and the held tags fire.
4. Clear cookies again. Click Reject. Confirm Google tags in Advanced mode send only cookieless pings and that blocked tags stay blocked. Browse several pages to be sure nothing leaks.
5. Trigger a conversion event, for example a form submission or view_item, in both states and confirm behaviour follows the consent.
6. Use a tag debugger such as the Insighter Debugger extension to see which network requests actually leave the browser in each state. The Preview panel shows intent; the network shows reality.

Step 7: Verify on the Google Side

• In Google Ads, Goals, then Conversions, then Diagnostics, check that Consent Mode is active and signals are being received.
• In GA4, Admin, then Data collection and modification, then Data collection, check consent signal status.
• After a couple of weeks, GA4 reporting identity with Blended will begin including modelled data if thresholds are met.

Common Mistakes

• CMP tag firing on All Pages instead of Consent Initialization, so Google tags fire before defaults are set.
• A hard-coded GA4 or Meta snippet in the theme that ignores GTM entirely. Remove it.
• Consent defaults set to granted everywhere, which makes the banner cosmetic.
• Meta Pixel left without a consent requirement because "Consent Mode handles it". It does not.
• Testing while your own consent choice is cached, so the banner never shows.

Outcome

With this setup, your tags do what the visitor agreed to, Google Ads and GA4 keep modelled data for the visitors you cannot observe, and your Meta and other pixels stay quiet until permission exists. That is the balance between respecting consent and keeping your measurement usable.