Consent Mode v2 in GTM with server-side tracking

Short answer: Consent Mode v2 passes the visitor’s choice on to Google tags. You set it up in the web container: a default state before the visitor chooses, and an update as soon as they do. Server-side tracking doesn’t change that. The Google tag passes the choice on to the server container. Consent is still required, and this article is not legal advice.

By the TrackLead team. Technically reviewed by Pieter. Updated: October 2026.

What Consent Mode v2 does, and doesn’t do

Consent Mode tells Google tags what the visitor chose. It is not a cookie banner itself. For that you need a consent platform (CMP): the CMP asks for consent, Consent Mode passes on the answer.

Version 2 arrived in November 2023 and added two signals: ad_user_data and ad_personalization. Since March 2024 you need to send consent signals to Google for visitors in the EEA to keep measurement, personalisation and remarketing in Google Ads. If you were still on v1, Google copied ad_storage once to ad_user_data. ad_personalization was not copied, so for audiences you need to upgrade yourself. Since 15 June 2026, Consent Mode is also the only control for whether GA4 data reaches a linked Google Ads account; Google Signals no longer decides that.

The seven consent types

• ad_storage: storage, such as cookies, for advertising.

• analytics_storage: storage for analytics, such as visit duration.

• ad_user_data: whether user data may be sent to Google for advertising. New in v2.

• ad_personalization: whether personalised ads and remarketing are allowed. New in v2.

• functionality_storage: storage for site features, such as language settings.

• personalization_storage: storage for personalisation, such as recommendations.

• security_storage: storage for security, such as authentication.

For Google Ads and GA4 the first four matter most.

Basic or advanced

Basic: Google tags only load once the visitor gives consent. Without consent nothing goes to Google.

Advanced: the tags load straight away with a denied default and send cookieless pings without consent. Google uses those to model conversions. Only advanced mode gets a model based on your own data.

Modelling needs enough traffic. For Google Ads, Google states 700 ad clicks over 7 days, per country and domain grouping. For behavioural modelling in GA4 you need at least 1,000 events per day with analytics_storage denied for at least 7 days, and at least 1,000 daily users with consent on at least 7 of the previous 28 days. Small clients often don’t reach that. In that case, don’t promise modelled conversions.

Whether advanced suits a client is also a legal call. Discuss it with the client’s lawyer or privacy officer.

Which consent platform

Preferably use a consent platform from Google’s partner programme, such as Cookiebot or Consent Studio. Both have a GTM template that supports Consent Mode v2. A certified CMP is only required for publishers showing personalised ads through AdSense, Ad Manager or AdMob. For advertisers it is a recommendation.

How to set it up, step by step

1. Install the consent platform’s GTM template, such as Cookiebot CMP or the official Consent Studio template, and fire it on the Consent Initialization - All Pages trigger.

2. Set the default state. For visitors from the EEA, set ad_storage, analytics_storage, ad_user_data and ad_personalization to denied until the visitor chooses. The Cookiebot template lets you set this per region.

3. Have the banner send an update when the visitor chooses. The template does this itself. With wait_for_update, for example 500 milliseconds, tags briefly wait for that update.

4. Decide whether to enable ads_data_redaction, which removes ad click identifiers when ad_storage is denied, and whether to use url_passthrough, which passes click information through the URL instead of cookies.

5. Google tags have built-in consent checks. For third-party tags, such as Meta or LinkedIn, set the required consent under the tag’s Consent Settings.

6. Only publish once the checks below are correct.

How consent reaches the server container

You don’t set up Consent Mode again in the server container. The Google tag sends the state as parameters with every request. In practice these are gcs (carrying ad_storage and analytics_storage) and gcd; Google doesn’t officially document those names. The GA4 client in the server container reads it, and Google’s tags in the server container respect it.

• Google Ads conversions and Floodlight in the server container need the Conversion Linker tag.

• Google Ads Remarketing in the server container does not support url_passthrough.

• Third-party tags, such as the Meta Conversions API, don’t read consent on their own. Google doesn’t document this. In practice you pass the consent state in the event data and add a condition to those tags. Test it per tag.

Just setting up server-side? Read what to sort out before you start with server-side tracking first.

How to check it works

• Tag Assistant: the Consent tab shows On-page Default and On-page Update columns per event. If it’s empty, Consent Mode isn’t working.

• Google Ads: go to Goals › Conversions › Summary, click a conversion action and open the Diagnostics tab. It shows whether Consent Mode is implemented and whether modelling is active. This can take 48 hours to two weeks.

• Server container: deny cookies, open Preview and check that third-party tags don’t fire.

With TrackLead, consent is part of the same flow as the implementation: you choose your client’s consent platform, and the consent state goes with every event. Take a look at tracklead.eu.

Frequently asked questions

Is Consent Mode v2 mandatory?

Since March 2024 Google asks for consent signals for visitors in the EEA. Without them you lose Google Ads features for measurement, remarketing and personalisation. Whether you must ask for consent follows from the law, not from Consent Mode.

Do I still need a cookie banner with server-side tracking?

Yes. Server-side changes the route the data takes, not whether you need consent.

Do I also set up Consent Mode in the server container?

No. You set it up in the web container. The Google tag passes the state to the server container, and the Google tags there respect it.

Why don’t I see modelled conversions?

Modelled conversions only appear with enough traffic: for Google Ads, 700 ad clicks over 7 days per country and domain grouping. In basic mode Google uses a general model, in advanced mode a model based on your own data. Behavioural modelling in GA4 only works in advanced mode.

Is a Google-certified CMP required?

Not for advertisers, although Google recommends one. It is required for publishers showing personalised ads through AdSense, Ad Manager or AdMob.