Google Consent Mode V2

Google Consent Mode V2 is an updated version of the original Consent Mode developed by Google. As we have already described in our previous article about consent mode, this tool allows websites to communicate users' cookie consent choices to Google tags more effectively. However, implementing Google Consent Mode V2 has been mandatory for all websites using Google services since March 2024. 

Here we will discuss what’s new in Google Consent Mode V2, how it differs from the last version and if there’s an impact on server-side tracking. 

Consent Mode V2 introduces more granular control over the data types collected based on user consent.

Google added two parameters to the existing ones (analytics_storage and ad_storage) in Consent Mode V2:

These new parameters are specifically designed to enhance user privacy. The settings determine if personal data is sent to Google based on user consent, which applies to services like Google Ads, Google Shopping, Google Play, etc.  

Two more parameters that were already used in the previous version:

Google Consent Mode OneTrust and Consent Mode V2 CookieYes are common consent management platforms used to manage this consent process.

Google Consent Mode offers two levels of implementation - Basic and Advanced.

Basic Consent Mode V2 implementation

If a user consents to cookies, the website behaves normally, firing all tags and collecting full data. However, if a user does not consent, no data is collected, and cookieless pings are not sent. It’s a little bit straightforward but limits data collection significantly when users do not consent.

To implement Basic Consent Mode, website owners need to:

Advanced Consent Mode V2 implementation

It offers a more nuanced approach. Even when users do not consent to cookies, it allows anonymous, cookieless pings to be sent to Google for modeling purposes. This enables websites to recover some level of data for Google Ads and GA4, even without user consent.

In Advanced Consent Mode, implementation involves:

The Digital Markets Act (DMA) and Google Consent Mode V2 are closely interconnected, especially in the context of digital advertising and data privacy regulations. This legislation requires "gatekeepers" like Google to obtain explicit consent for collecting and using European citizens' personal data. In response to this and other privacy regulations, Google has updated its Consent Mode to version 2, making it compulsory for advertisers who wish to use Google Ads for remarketing and auto-bidding.

Advertisers and publishers, especially in the European Economic Area (EEA), must ensure compliance and maintain the quality of their audience and measurement data in Google Ads. Without implementing Consent Mode V2, advertising platforms like Google Ads and GA4 will not capture data about new EEA users after March 2024, significantly impacting advertising strategies and effectiveness.  

To use Google Consent Mode V2, you must have a cookie banner in place. This means you need to have, or get, CMP running that aligns with Google's standards, server-side tracking, GDPR, and the e-privacy directive. The Consent Mode V2 functionality is contingent on the language of the banner being in line with Google’s standards for compliance.

How it works: when a user consents, the cookie banner communicates this to Google via the Google Consent Mode, allowing normal data collection. And vice-versa: if consent is rejected, Google reduces data collection of those users. In this scenario, Google employs conversion modeling, which uses machine learning to infer connections between user interactions and conversions. 

Google Consent Mode is required regardless of whether you use browser or server-side tracking. It's a widespread misconception that server-side tracking exempts the need for user consent before tracking, but this is incorrect. User consent is still necessary even when tracking occurs on the server side.

This is particularly relevant under the server side tracking General Data Protection Regulation and the EU User Consent Directive, which require explicit, informed consent for data processing and handling. 

When a user interacts with a cookie banner on your site, their consent choice is passed to Google Tag Manager via the Consent Mode V2 signals. In a server-side setup, this process involves two layers working together.

On the client side, your web GTM container receives the consent state from your Consent Management Platform (CMP) and applies it to all tags before any data is sent. On the server side, your sGTM container receives the same consent signals forwarded from the web container and uses them to decide what data gets passed on to platforms like Google Ads or GA4.

When integrating Consent Mode with server-side tracking, you need to make sure that user consent is respected on both sides. This includes:

In Advanced Consent Mode, cookieless pings are still sent to Google even when consent is denied, which supports conversion modeling for GA4 and Google Ads. That said, it's worth consulting your legal team before enabling this – collecting any signals from users who haven't consented carries legal risk. It's also worth keeping in mind that technologically savvy visitors may notice Google signals firing without their consent, which could affect how they perceive your brand.

Google has not yet released any official documentation on Consent Mode V2. Still, according to our recent test, they integrated a new parameter responsible for handling the consent status. This is a new parameter named gcd. GCD is present in every interaction with Google services, regardless of whether Consent Mode is enabled or not. It also has information on how the consent signal was generated. This allows for a more precise interpretation of user consent decisions and helps Google maintain compliance with evolving privacy regulations. The parameter reflects whether consent was granted or denied and whether it was set by default or updated based on user interaction.

Here’s how the string looks like:

Below you can find a table with the values for the signals:

Examples of how gcd parameter may look:

gcd=11p1p1p1p5

gcd=11t1t1t1p5

1. Using GTM Preview mode.  Open your web GTM container → click Preview → navigate to your site and trigger a few events. In the GTM debugger, open the Consent tab for any event. You'll see the consent state for each parameter (ad_storage, analytics_storage, ad_user_data, ad_personalization) and whether it was granted or denied at the time the event fired.

2. Using browser DevTools. Open DevTools → go to the Network tab → filter by collect to find GA4 requests. Click on a request and look for two parameters in the URL:

If both parameters are present and the gcd value matches the consent state you'd expect based on user interaction, your setup is working correctly. You can use the values table earlier in this article to decode what each gcd string means.

Consent Mode V2 provides advertisers and website owners the flexibility to tailor their data collection strategies based on user consent, thereby balancing the dual needs of privacy compliance and data-driven insights. 

Server-side tracking significantly improves data accuracy and resilience, especially when integrated with Consent Mode V2. Together, they enable more innovative and more compliant data strategies.

We can highly recommend to:

And if you have other questions about server-side tracking and Stape, don’t hesitate to contact our support team.