Consent Mode v2: the setup guide for EEA advertisers

What changed between v1 and v2?

Version 1 carried two signals: analytics_storage and ad_storage, governing whether cookies may be set. Version 2 added two more, and they are the ones Google enforces:

• ad_user_data: may the user's data be sent to Google for advertising purposes at all
• ad_personalization: may that data be used for personalized advertising, meaning remarketing

The distinction matters because cookies were never the whole story. A server-side setup can move data without cookies; the v2 signals govern the data flow itself. Google's EEA policy pages bind audience building, remarketing, and conversion measurement to these signals explicitly.

Which deadlines have already passed?

An account that ignored all of this is measuring only consenting users who pass tags, then feeding that partial count into Smart Bidding. The bidding is technically working; it is optimizing the wrong number.

How do you set it up, step by step?

1. Pick a Google-certified CMP. Certification is required for the v2 signals to be accepted. Configure the banner for granular choices, since GDPR consent must be specific and informed, and equal-prominence accept/decline keeps regulators calm.
2. Set defaults before any tag fires. The consent default command runs first on every page, denying all four signals for EEA regions. Load order is where most broken installs break: a Google tag firing before the default command ignores consent entirely.
3. Wire the update call to the banner. On user choice, the CMP pushes the consent update with the four states. Verify in Tag Assistant that ad_user_data and ad_personalization flip when you accept and decline.
4. Keep Google tags running in consentless mode. The common failure is a banner that blocks Google tags entirely on decline. That throws away the cookieless pings modeling feeds on, so you lose the recovery you implemented v2 to get.
5. Re-verify after every release. Consent wiring breaks silently when developers change tag order or swap the CMP snippet. Our management guardrails re-check it after each site release for exactly this reason.

How much measurement does modeling give back?

It depends on your consent rate, and the field data is humbler than vendors admit: the all-industry acceptance average hovers around 31%, with B2B SaaS audiences at the friendlier 60 to 70% end and compliant equal-prominence banners losing roughly 60% of visitors to decline. Suppose two thirds of your visitors consent: without v2 you measure two thirds of your conversions and bid on that; with v2, modeling estimates the remaining third from the cookieless pings. On a B2B account paying near the $93.69 business-services median per lead, a quarter of conversions vanishing from the data moves every optimization decision made on top of it.

One HR-tech account we repaired undercounted demo requests by roughly a quarter before the fix; the CPA story is told in this teardown. The repair changed no keywords and no bids, and still shifted the account's economics, because the targets finally pointed at real numbers.

The five failure modes we keep finding in audits

• The blocking banner: Google tags stopped entirely on decline, which discards the cookieless pings and with them the entire modeled recovery. The most common failure and the most expensive.
• Load-order drift: a developer moves the tag snippet above the consent default during a redesign, and every visitor briefly fires tags as if consented. Invisible in the interface, obvious in Tag Assistant.
• v1 masquerading as v2: the CMP sends analytics_storage and ad_storage but never the two v2 signals, usually because the integration predates March 2024 and nobody re-ran the setup wizard.
• Surface gaps: the main site complies while a landing-page builder, subdomain, or embedded booking flow fires unconsented tags of its own.
• Silent CMP updates: a consent vendor ships a new template, defaults change, and the signals quietly stop flipping. Quarterly re-verification exists because this happens more than vendors admit.

Every one of these passes a casual glance at the cookie banner, which is why the three verification checks run on tags rather than on appearances, and why they belong in the release checklist rather than in a one-off setup project.

When should you add server-side tagging?

Server-side tagging routes measurement through your own tagging server, adding durability against browser tracking prevention and first-party control over what leaves the site. It complements Consent Mode; it never replaces it, since consent signals must still flow. Our rule of thumb: worthwhile above roughly €10,000 a month in spend, where a few percentage points of recovered measurement outearn the infrastructure. Below that, spend the effort on the basics in this guide and the self-audit walkthrough.