Consent Mode v2 explained for small businesses: what changes in your data

Consent Mode lets a website or app pass its users' consent choices to Google, and Google's tags adjust their behaviour accordingly. When consent is denied, the tags do not store cookies and, depending on the mode, may send cookieless signals instead.

It is neither a banner nor compliance on its own. Google's help pages say it works alongside whatever banner or consent management platform (CMP, see the term) you already use. If the banner is badly designed, Consent Mode simply relays a badly collected decision.

Google's developer documentation states that Consent Mode was updated in November 2023 with two new parameters on top of the original two. Each signal controls a different area:

• ad_storage: advertising cookies. When denied, no new advertising cookies are stored.
• analytics_storage: analytics measurement. When denied, no analytics cookies are stored, although cookieless event and session measurement can continue.
• ad_user_data (new): whether advertising-related user data may be sent to Google.
• ad_personalization (new): whether personalised advertising, such as remarketing, is allowed.

Google Analytics help describes two ways to implement it. In basic mode, Google's tags stay blocked until the visitor grants consent: someone who declines generates no data at all, and Analytics has no modelled data to fill the gap.

In advanced mode, the tags load before the dialog appears and, if consent is declined, send cookieless signals. Analytics then applies behavioural and conversion modelling to estimate part of what it cannot observe. That is an estimate, not an exact measurement, and a report should not present it as one.

Which mode to choose is a privacy decision before it is a marketing one. Some businesses prefer basic mode out of caution; others adopt advanced mode after reviewing with their legal adviser which data is sent and how the cookie policy explains it.

According to Google's guide, the default consent state must be declared on every page before any configuration command or event, and updated as soon as the user interacts with the banner, including when they later withdraw consent. Consent Mode does not store choices: your site has to keep them and reapply them on later pages.

Three details come up in almost every audit. The first is the `wait_for_update` value, which sets how many milliseconds a tag waits for an asynchronously loaded banner to send its decision (Google's example uses 500). The second is region-specific defaults, which let you apply different consent states per country or subdivision. The third, if you use Google Tag Manager, is to use the consent template's own commands rather than manual calls that may be processed late.

In Spain, article 22.2 of Ley 34/2002 (the LSSI) allows storing or retrieving data on a user's device, such as cookies, only if the user has consented after receiving clear and complete information, with exceptions for what is strictly necessary or for transmitting a communication. Google's user consent policy adds that anyone using its products must obtain that consent in the European Economic Area, the UK and Switzerland, keep records and explain how to withdraw it. Google warns that non-compliance can lead it to limit or suspend use of the product.

Our recommendation for a small business is to check four things: that the banner lets people refuse as easily as accept, that the CMP sends all four signals, that GA4 and Google Ads tags respect the consent state, and that reports say which part of the data is estimated. This sits within analytics and tracking, and its effect on your Google Ads spend is read through honest marketing measurement of what is observed versus modelled.

If your site already uses conversational agents or forms, the same data and consent logic applies, as we explain in AI agents for lead generation. You can bring us your case through the contact page. This guide does not replace legal advice.