Google Consent Mode v2: Basic and Advanced for European Businesses

TL;DR: Consent Mode v2 sends four Google states. Basic sends no data to Google without consent and can use general modelling. Advanced can send limited cookieless requests when consent is denied and enable advertiser-specific modelling. Neither guarantees recovered data, better bids or GDPR compliance.

If the banner says “rejected” while the container reports advertising data as allowed, fix that handoff first. More conversions in a report do not resolve incorrect consent.

This guide covers implementation and its limits for businesses in Austria and the EU. Checked on 28 September 2026. Decide which processing is permissible through your actual data flows and an appropriate legal assessment.

What Changed with Consent Mode v2?

Two additional states joined the existing storage signals:

• ad_storage covers advertising storage such as cookies.
• analytics_storage covers analytics storage.
• ad_user_data covers sending user data to Google for advertising purposes.
• ad_personalization covers personalised advertising.

The earlier version was not simply “the tag fires or it does not”. The newer signals separate additional advertising purposes. Permission for storage does not automatically allow advertising data or personalisation.

Google requires current consent signals for relevant measurement, personalisation and remarketing features on EEA traffic. For a custom banner it recommends Consent Mode; an appropriate CMP integration can handle signalling. This is a Google product requirement, not a separate law prescribing one technical arrangement for every business.

Basic and Advanced Compared

Sources: Google Consent Mode overview and Google Ads: Consent Mode. Calling Basic useless ignores the different privacy decision and its available modelling.

Cookieless is a technical description, not an anonymity guarantee. Inspect URL parameters, identifiers, destinations and further use. Missing pings alone do not prove Basic Mode: a broken integration, blocker or tag that never fired can produce the same observation.

What Can Modelling Actually Do?

Conversion modelling statistically estimates unobserved activity. It does not restore an identifiable person or prove an additional purchase. A reporting change can increase reported conversions without more payments being made.

Google Ads lists 700 ad clicks per day over seven days for each country and domain, correct implementation and sufficient model quality among its eligibility conditions. These are requirements, not a promise to recover a particular share. Google Ads: prerequisites.

GA4 behavioural modelling is a different process. Google lists, among other conditions, 1,000 daily events with analytics consent denied for at least seven days and 1,000 daily consenting users on at least seven of the previous 28 days; Advanced must be implemented appropriately. Meeting those thresholds still does not guarantee eligibility. GA4: behavioural modelling.

Separate observed conversions, modelled reporting and backend orders. Compare the same period and conversion definition, allowing for lag, cancellations and refunds. Without that comparison, a larger report total cannot be sold as additional revenue.

What Does This Mean in Austria and the EU?

The DSB explains cookies and device access: technologies that are not strictly necessary need a valid decision before use. The review extends beyond files named cookies to other storage and access on the device.

GDPR separately covers personal data processing. Consent Mode replaces neither clear information nor a legal basis, data minimisation, recipient agreements or withdrawal. A CMP and tag can communicate correctly while the underlying processing remains unresolved.

For the choice path, see the cookie banner audit. For the full chain, see our privacy guide.

Four Implementation Steps

Step 1: Map Categories to States

Map the banner’s purposes to all four states. Separate statistics from advertising and personalisation. Document full and partial withdrawal, regional rules and saved choices. Select Basic or Advanced using this architecture and the privacy assessment.

A certified CMP can simplify setup, but inspect the actual template, website version and direct tags. The product name proves nothing about category mapping, load order or server paths.

Step 2: Set Default Before Measurement Tags

For Google Tag Manager, use an appropriate CMP template on the Consent Initialization trigger. Custom consent templates use setDefaultConsentState and updateConsentState. A gtag call in an arbitrary Custom HTML tag is not an equivalent substitute.

The snippets below illustrate a direct gtag integration outside a GTM consent template. They are not a complete installation script; they assume an initialised Google tag and the CMP connection:

gtag('consent', 'default', {
  ad_storage: 'denied',
  analytics_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied'
});

Set the initial state before the affected configuration and measurement calls. wait_for_update can allow a limited delay for an asynchronous CMP. An arbitrary 500 ms is neither universally appropriate nor a permanent block; later updates must still work correctly. Google: setup guide.

Step 3: Update Only the Actual Choice

A partial choice might permit storage but deny advertising user data and personalisation. Map the specific selection instead of changing all states to granted after any click:

gtag('consent', 'update', {
  ad_storage: 'granted',
  analytics_storage: 'granted',
  ad_user_data: 'denied',
  ad_personalization: 'denied'
});

That example is not a recommended mapping for your categories. The CMP saves and renews the choice; Consent Mode does not do that automatically. Send the update before the visitor navigates away. Withdrawal must remain effective on later pages.

Step 4: Test States and Actual Requests

Test the first visit, full agreement, rejection, partial agreement, changed choices and return visits. Compare Tag Assistant, browser traffic, server forwarding and Google Ads diagnostics. A populated diagnostic field does not prove every data path.

URL passthrough and ads_data_redaction are separate features. Passthrough can forward click information through links within the same domain; inspect parameters and redirects. Redaction concerns particular advertising click identifiers when advertising storage is denied. Neither is a universal privacy preset or legal authorisation. Configure them after examining the actual processing.

Five Errors to Look For

Outdated signals. The CMP updates only the two storage states. Check advertising user data and personalisation as well.

Default arrives too late. Direct scripts or early tags run before Consent Initialization. Inspect the first visit rather than only sessions with an existing choice.

Every click allows everything. Permission for statistics becomes four granted states. Test partial choices and the exact category mapping.

Browser and server disagree. The website rejects marketing but a backend or server tag sends it anyway. Inspect the outgoing request.

Only the banner is tested. Navigation, reload or withdrawal produces another sequence. Repeat tests after template and plugin changes, and record the version.

These checks do not establish a market statistic about Austrian advertising accounts. Demonstrate the cause in the specific integration.

Consent Mode and Server-Side Tracking

In Google’s server architecture, consent is set in the web container and passed with the request to the server container. Consent-aware Google tags process those parameters. The server does not need a second, independently conflicting default. Google: server-side Consent Mode.

Custom tags for Meta, TikTok or other recipients need explicitly tested rules. Google’s states do not automatically control those integrations. Document each destination’s purpose, permitted fields, conditions and withdrawal behaviour. A server path is not a way around the choice.

Our server-side tracking guide explains the architecture and responsibilities.

Four Checks for This Week

1. Compare all four states in Tag Assistant before and after the CMP selection.
2. Test rejection, partial and full agreement using actual requests.
3. Follow the state through the server container and backend to each recipient.
4. Compare Ads reports with paid orders; separate a reporting change from a business result.

Further sources: Google: CMP setup.

Frequently Asked Questions

What Is the Main Difference Between Basic and Advanced?

Basic sends no data to Google without consent. Advanced can send limited cookieless requests when consent is denied and enable advertiser-specific modelling. Basic can use general models. The different data transfer requires a deliberate technical and legal decision.

Is Consent Mode v2 Mandatory for an Austrian Google Ads Account?

Google requires current signals for specific features on EEA traffic. The law does not prescribe a Google product name. Assess the features, signalling and legal basis; another technical approach may limit Google functionality.

How Many Conversions Will Advanced Recover?

There is no universal figure in advance. Traffic, eligibility, consent and implementation affect availability. Check diagnostics and backend results; promise neither a fixed percentage nor new sales from modelling alone.

Which CMPs Support Consent Mode v2?

Google lists integration partners and supported CMPs. Check the current template, category mapping, order and actual requests. A listed CMP does not guarantee correct website configuration. Google: CMP setup.

Does Consent Mode Make the Website GDPR Compliant?

No. It sends states to Google tags. The legal basis, information, choice, data, recipients, agreements, retention and withdrawal must also be correct. Unresolved processing needs an appropriate privacy assessment.

If the banner, GTM and Google Ads show different states, record the requests first. Describe the problem or see Tracking & CAPI. Diagnosis and implementation are agreed separately.