Consent Mode v2 Implementation: CMPs, IAB TCF, Global Privacy Control, and US State Privacy Laws
A consent banner is only as good as the tags behind it. Often the banner shows and the tags fire anyway, or
the tags obey it and lose every conversion Google could have modeled. John Williams wires consent so each
visitor's choice reaches Google, Microsoft, and Meta, and measurement keeps working within those limits.
1,000 denied-consent events a day before GA4 can model behavior
Oct 23, 2026 TCF v2.4 deadline for CMPs on the web
TL;DR
Not legal advice. We implement the consent design your counsel approves. We'll explain the
trade-offs, but the legal call is yours.
Google's ads tags check four consent types: ad_storage, analytics_storage,
ad_user_data, and ad_personalization. Basic mode blocks tags until the visitor
chooses. Advanced mode sends cookieless pings while consent is denied, which Google says supports an
advertiser-specific model instead of a general one (Consent mode overview).
In the EEA, UK, and Switzerland, we deploy a Google-certified CMP and, where ad tech needs it, an IAB TCF
string. TCF v2.3 has been mandatory since March 1, 2026, and v2.4 web changes are due October 23, 2026.
In US states with opt-out laws, we honor Global Privacy Control and map opt-outs to Google's restricted data
processing and to the other platforms' equivalents.
Microsoft UET and the Meta Pixel get their own consent handling, because Google's consent mode doesn't
control them.
Who this is for
Advertisers with traffic from the EEA, UK, or Switzerland who need to keep remarketing and conversion
measurement working.
US businesses selling or sharing data for targeted ads that now have to process GPC and show visitors their
opt-out status.
Teams whose consent banner was installed by a developer years ago and never connected to Google Tag Manager.
Publishers on AdSense, Ad Manager, or AdMob who need a certified CMP with TCF.
What's included
Consent inventory. Every tag, pixel, cookie, and SDK on the site, which vendor it sends data
to, and which consent purpose it needs.
CMP selection or repair. A Google-certified CMP with regional rules, a reject option as easy
as accept where required, your counsel's wording, and TCF or GPP strings where ad partners need them.
Google consent mode v2. Defaults set before any tag runs, region-specific defaults, updates
on every choice, and the basic or advanced decision documented.
US opt-out handling. GPC detection, Google's restricted data processing, and the on-page
opt-out status California now requires.
Microsoft, Meta, and other vendors. UET consent mode, Meta Pixel consent calls, and GTM
consent checks on every tag that has no built-in support.
Verification report. Accept, reject, and partial-consent journeys tested in each region, with
the request parameters that prove what each vendor received.
How John implements consent mode
Inventory what actually fires
We load the site with a clean browser in each target region and record every request before and after the
banner. Our free Marketing Analytics Auditor runs the first pass and
checks for consent mode v2.
Agree the consent design with counsel
Basic or advanced mode, which regions default to denied, how US opt-outs work, and how long choices are
stored. We bring the technical options and trade-offs; your counsel makes the call.
Configure the CMP
Publishers using AdSense, Ad Manager, or AdMob must use a Google-certified CMP that integrates with the TCF
to serve personalized ads in the EEA and UK (since January 16, 2024) and Switzerland (since July 31, 2024)
(Google CMP requirements). Advertisers aren't bound by that publisher rule, but a certified CMP is still the easiest way to get
consent mode updates right. If you use TCF, strings created after February 28, 2026 need the
disclosedVendors segment that v2.3 made mandatory (IAB Europe).
Set defaults before tags load
The consent default has to run before the Google tag or any GTM tag. We set it per region (denied in the
EEA, UK, and Switzerland, for example) and send an update the moment the visitor chooses, then on every
later page.
Handle the vendors Google doesn't control
Microsoft enforces consent mode for EEA, UK, and Swiss traffic, where ad_storage defaults to
denied and you have to send granted when a visitor accepts (Microsoft Learn). Enforcement for all clients with users in those regions began May 5, 2025 (UET consent FAQ). The Meta Pixel has its own consent grant and revoke calls (Meta for Developers). Everything else gets a GTM additional consent check.
Verify with evidence
We test accept, reject, and partial choices in every region and read the gcs and
gcd parameters in Tag Assistant to confirm what Google received (Troubleshoot consent mode). For Microsoft we check the asc value, and for Meta, the consent state in Events Manager
test events.
Common consent mistakes John fixes
Default set after the tag. The Google tag fires before the CMP loads, so the first hit goes
out with no consent state at all.
Only two of the four types. Sites that set ad_storage and analytics_storage but not
ad_user_data or ad_personalization, so remarketing and enhanced conversions lose consent signals in the EEA.
Banner shown, choice ignored. Tags that keep firing, or cookies that keep being read, after
the visitor clicks reject. This was one of the breaches in the CNIL's SHEIN decision.
Double blocking. Built-in consent checks plus a GTM trigger that blocks the same Google tags,
which turns advanced mode into basic mode by accident.
GPC detected nowhere. California and Colorado treat GPC as a valid opt-out, and many sites
never read the signal.
The rules behind the banner (as of October 2026)
Not legal advice. This is an implementer's summary of public guidance from regulators and
platforms. Your obligations depend on where you operate, what you collect, and how you use it. Confirm your
design with qualified counsel.
Where
What regulators and platforms expect
What we configure
EEA
Prior consent for non-essential storage and access under the ePrivacy Directive. The EDPB reads that to
cover tracking pixels and URL-based tracking, not just cookies (EDPB Guidelines 2/2023). Its cookie banner taskforce flagged banners with no reject option on the first layer (EDPB report). The GDPR then governs what happens to the data. Separately, the Digital Markets Act requires
designated gatekeepers, Google and Meta among them, to get consent before combining personal data across
their services (European Commission), and Google requires consent signals for EEA users under its EU user consent policy.
Certified CMP, reject on the first layer, all four consent types denied by default, TCF where needed
France
The CNIL enforces cookie rules directly. In September 2025 it fined SHEIN 150 million euros for cookies
set before consent and for continuing to read cookies after users refused (CNIL).
Same as EEA, with tests proving nothing is set or read after a refusal
UK
PECR, with the ICO's storage and access technologies guidance, finalized in April 2026 after changes from
the Data (Use and Access) Act. It covers exceptions such as statistical purposes and how advertising
measurement is treated (ICO guidance).
Consent by default; any exception documented and approved by counsel
California
Businesses that sell or share personal information must treat an opt-out preference signal such as GPC as
a valid opt-out (CPPA).
Since January 1, 2026 they must also show whether the signal was processed (11 CCR 7025).
GPC detection, restricted data processing, ad_personalization denied, visible opt-out status
Colorado and other opt-out states
Colorado has required controllers to honor recognized universal opt-out mechanisms since July 1, 2024, and
its published list includes GPC (Colorado AG).
Same GPC handling, scoped to the states your counsel names
What advanced mode actually buys you
Advanced mode doesn't recover data from people who said no. Denied pings carry no cookies. Google uses them to
model conversions, and GA4 uses them for behavioral modeling only once a property sends at least 1,000 events a
day with analytics_storage denied for seven days, and has at least 1,000 consented daily users on
seven of the previous 28 days (GA4 behavioral modeling). Smaller sites often never reach those thresholds, which makes the basic-versus-advanced decision less about
modeling and more about your counsel's reading of the law.
Google's US opt-out path
For US states, Google's tool is restricted data processing. Google says that where a state has named GPC as its
universal opt-out, it turns off ads targeting and applies restricted data processing when it receives GPC, and
it also reads IAB's Global Privacy Protocol strings for several states (Google Ads Help). We still pass the opt-out from your own site, where the visitor made the choice.
Pricing and engagement
Consent work is quoted as a flat fee once we've inventoried your tags and agreed on the regions
in scope. The number depends on how many sites and vendors are involved and whether you're keeping your CMP or
replacing it, so we don't publish a single price. CMP subscriptions are billed by the CMP vendor, not by us. Our
pricing page covers the rest: no fees tied to ad spend, and no long-term contract.
Platforms we work in
Consent has to reach every platform that receives data. These are the official products we configure.
No. We implement and test the technical side of consent. Whether your banner, notices, and consent design meet
the law where you operate is a question for qualified counsel, and we'll work alongside them.
Should we use basic or advanced consent mode?
Advanced mode sends cookieless pings while consent is denied, and Google says it enables an
advertiser-specific conversion model. Basic mode sends nothing until the visitor agrees. Some counsel are
comfortable with advanced mode and some aren't. We implement either correctly.
Do US visitors need a consent banner?
Most US state laws are opt-out rather than opt-in, so the usual requirement is a working opt-out, honoring
signals like Global Privacy Control, and clear notices, not a pre-consent banner. Some data types and states
have stricter rules. Your counsel should confirm.
Why did conversions drop after we added a banner?
Usually because tags are blocked outright, the default fires late, or updates aren't sent on later pages. Some
drop is real, since people who decline aren't measured, but a broken setup loses far more than consent alone
explains.
Does consent mode cover Microsoft Ads and Meta?
No. Microsoft's UET has its own consent mode, enforced for EEA, UK, and Swiss traffic since May 5, 2025, and
the Meta Pixel has its own consent calls. We configure each one separately.
What changes with TCF v2.4?
IAB Europe published TCF specifications v2.4 on July 23, 2026, with new standard texts and illustrations for
features. CMPs have until October 23, 2026 on the web and February 23, 2027 for mobile apps and CTV. If you
use TCF, check that your CMP vendor has a plan.
Talk to John about consent mode
Tell John which regions your visitors come from, which CMP you use (if any), and which ad platforms you run.
You'll get a written scope.
John, Kristy, or Sandeep will reply.One of the three of us will respond personally within 1 business day. No SDR queue.
Message received.
One of us will reply directly within one business day. While you wait, run a free
Buddy audit on your account.
Top 26 references
The primary sources, standards, research, and tools we rely on for this work. Every link was checked on
2026-10-11. We aren't affiliated with these publishers unless noted.
Official documentation
Consent mode overview— Google for Developers Consent types, basic versus advanced mode, and the gcs and gcd parameters.
AI disclosure: This page was drafted with AI assistance and edited by a human. It is not legal
advice. Regulatory and platform facts are cited to regulators, IAB Europe, Google, and Microsoft as checked on
2026-10-11; these rules change often, so confirm against the linked source and with counsel before acting.
See what your tags do before anyone consents.
The free Marketing Analytics Auditor checks consent mode v2, cookies, and ad pixels across 13 categories. No
sign-up.
Google Tag Manager
Google Analytics
Google Ads
Google Tag Assistant
Google CMP Partner Program
Microsoft Advertising (UET)
Meta Pixel
Global Privacy Control