Consent Mode v2 with server-side GTM

Consent Mode v2 uses four signals. Each is either granted or denied.

• ad_storage: cookies and storage for advertising.
• analytics_storage: cookies and storage for analytics, such as the GA4 client ID.
• ad_user_data: whether user data may be sent to Google for advertising.
• ad_personalization: whether data may be used for personalised advertising, such as remarketing.

The last two were added in v2. Google requires them for advertising features for visitors in the European Economic Area (EEA).

There are two ways to run Consent Mode:

• Basic: Google tags do not load at all until the visitor makes a choice. Nothing is sent before consent.
• Advanced: Google tags load right away with the default (usually denied). While consent is denied they send cookieless pings without identifiers, which Google uses for modelling. After consent they work normally.

The default state must be set before any tag runs. If you set it in code, place it above the GTM snippet.

window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('consent', 'default', {
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  analytics_storage: 'denied',
  wait_for_update: 500
});

wait_for_update gives the banner that many milliseconds to report a stored choice before tags fire. When the visitor accepts, the banner sends an update:

gtag('consent', 'update', {
  ad_storage: 'granted',
  ad_user_data: 'granted',
  ad_personalization: 'granted',
  analytics_storage: 'granted'
});

In practice you rarely write this code yourself. Most consent platforms (CMPs) have a template in the Community Template Gallery that sets the default and the update for you.

1. 1 In the web container go to Tags, click New and choose Tag Configuration. Click Discover more tag types in the Community Template Gallery and search for your CMP.
2. 2 Configure the default state in the template, usually denied for all four signals.
3. 3 Set the trigger to Consent Initialization - All Pages, so it runs before every other tag.
4. 4 Publish and test the banner in Preview.

Google tags in the web container add the consent state to every hit they send. The gcs parameter carries ad_storage and analytics_storage, and gcd carries all four signals, including how they were set. Because the hit goes to sgtm.example.com, the state arrives at your server container with it.

The GA4 client reads those parameters and passes them on in the event data. Google tags in the server container (the GA4 tag, Google Ads conversion tracking) respect them automatically: when consent is denied in advanced mode, they forward a cookieless ping and do not set or read identifiers.

Tags from other vendors in the server container, such as the Meta Conversions API, TikTok or LinkedIn, do not read Google's consent parameters. They fire whenever their trigger matches, even when the visitor said no. You have to add the consent check to the trigger yourself.

1. 1 In the server container go to Variables and create a new Event Data variable with the key path x-ga-gcs. It holds the gcs value, for example G111.
2. 2 Read it as G1, then one digit for ad_storage and one for analytics_storage, where 1 is granted and 0 is denied. G111 means both granted, G100 means both denied.
3. 3 Open the trigger of the vendor tag and add a condition, for example the variable matches RegEx ^G11 for tags that need ad_storage.
4. 4 Test once with consent denied and once with it granted. The tag should only fire in the second case.

If you need ad_user_data or ad_personalization, a simpler route is to send the consent state yourself: add an event parameter such as marketing_consent with the value granted or denied to the GA4 event tag in the web container, read it with an Event Data variable in the server container and use it in the trigger.

1. 1 Open the web container in Preview in a fresh private window, so no earlier choice is stored.
2. 2 In Tag Assistant select the earliest Consent event in the Summary and open the Consent tab. On-page Default should show denied for the four signals (or your regional defaults).
3. 3 Accept the banner, select the most recent Consent event and check that On-page Update shows granted.
4. 4 In the server Preview, open a request before and after consent and compare x-ga-gcs in Event Data.

• The default is set before any tag fires.
• All four v2 signals are set in the default and in the update.
• The server container receives the new consent state after the visitor accepts.
• Non-Google server tags only fire with consent.