GA4 Consent Mode & GTM: A Compliance Checklist for Marketers
Last updated Invalid Date · 3 min read
Google Consent Mode is a framework that adjusts how Google tags behave based on a user's consent choices. Since March 2024, Consent Mode v2 is required to use Google's advertising and remarketing features for users in the European Economic Area. Configuring it correctly in Google Tag Manager means setting consent defaults before tags fire, connecting a consent management platform (CMP), and gating each tag with the right consent checks. This checklist walks through what to configure and how to verify it.
This page explains configuration and compliance considerations for marketers. It is not legal advice — confirm your obligations with a qualified professional for your jurisdiction.
What is Google Consent Mode?
Consent Mode lets Google tags read a user's consent state — such as whether they've allowed analytics or advertising cookies — and adapt accordingly. When consent is denied, tags can send anonymised, cookieless signals rather than nothing at all, so you retain modelled insight while respecting the user's choice.
Consent Mode v2 added two parameters, ad_user_data and ad_personalization, and is required for Google advertising features (including remarketing audiences) to work with EEA traffic.
The GTM Consent Mode checklist
1. Set consent defaults before anything fires
A default consent state must be set before any tag evaluates consent. In GTM this runs on the Consent Initialization trigger, which fires ahead of All Pages. Default sensitive categories to "denied" for regulated regions until the user chooses.
2. Connect a consent management platform (CMP)
Use a certified CMP to collect and store the user's choices and to update the consent state when they interact with the banner. Google requires a CMP that integrates with the Consent Mode API for EEA advertising features.
3. Enable consent checks on every tag
In GTM's container settings, enable consent overview, then confirm each tag has the correct additional consent requirements. A tag that handles user data with no consent configuration is the single most common compliance gap.
4. Map the right consent types
Analytics tags should require analytics consent; advertising and remarketing tags should require ad_storage, ad_user_data, and ad_personalization. Mismapping these is easy to miss and defeats the purpose.
5. Verify update behaviour
Confirm that when a user accepts or rejects in the banner, the consent state updates and tags respond on the same page — not only on the next pageview.
6. Test in Preview and a real session
Use GTM Preview and the browser's network tab to confirm tags hold before consent and fire after. Check both an "accept" and a "reject" journey.
Consent states at a glance
| Signal | Granted | Denied |
|---|---|---|
analytics_storage | Full GA4 measurement | Cookieless, modelled pings |
ad_storage | Advertising cookies set | No advertising cookies |
ad_user_data | User data sent to Google Ads | Withheld |
ad_personalization | Remarketing enabled | Disabled |
Key takeaways
- Consent defaults must be set on Consent Initialization, before tags fire.
- Consent Mode v2 is required for EEA advertising and remarketing features.
- Every tag handling user data needs explicit consent requirements — the most common gap.
- Always test both "accept" and "reject" journeys before trusting the setup.