Consent Mode v2 Defaults: The Four Signals and What Breaks When They Fire Late
Consent mode v2 has been mandatory for EEA and UK traffic since March 6, 2024, and the rule it imposes is about order, not about having the right tool. The four signals, ad_storage, analytics_storage, ad_user_data, and ad_personalization, have to be set before any tag that depends on them fires. On most sites they are set after, or not at all, and the tags run on their own defaults, which is to say they run. The consent platform is installed. The consent mode is not working. The gap between those two sentences is the whole problem.
The mechanism is simple and unforgiving. Google consent mode works on defaults: the site sets a default state, usually denied, before any tag fires, and the consent platform updates that state when the visitor chooses. If the platform tag fires after the analytics tag, the analytics tag has already run with no default in place. If the platform loads late on a slow connection, the same thing happens for every visitor on a slow connection, which is to say a large share of mobile traffic. The CookieYes troubleshooting guide puts it plainly: the consent platform tag has to fire first, through the consent initialization trigger, and any tag that fires before the default state is set is a defect, not a timing quirk.
The four signals, and what each one gates
ad_storage gates cookies for advertising. analytics_storage gates cookies for analytics. ad_user_data gates whether user data is sent to Google for advertising purposes. ad_personalization gates whether ads are personalized. A site that sets only the first two and forgets the second pair has consent mode half built: the cookies are gated and the user data still flows. The Biscotti consent mode guide adds the consequence that matters for measurement: without the signals set correctly, Google Ads in the EEA and UK loses the conversion data it needs, and the site is paying for ads it cannot measure.
Basic versus advanced mode is the fork. In basic mode, tags are blocked entirely until consent is given, and no data is sent. In advanced mode, tags fire with the consent state attached, and Google models the missing data. Advanced mode is the one most sites want, because it preserves measurement, but it is also the one that fails silently when the defaults are late: the tags fire, the signals arrive after, and the modeling never gets the denied state it needs.
The test that takes ten minutes
Open the site in a fresh browser with the network tab open and reject everything. Then look at the order: the consent default has to be the first thing set, before any Google tag. If a gtag request goes out before the default, the order is wrong. Then check the four signals by name in the consent update. If ad_user_data and ad_personalization are missing, the setup is half done.
Fix the order in the tag manager, not in the banner. The consent platform tag belongs on the consent initialization trigger, and every other Google tag belongs after it. That is a ten-minute change in most setups, and it is the difference between consent mode that works and a consent platform that decorates a site while the tags run free.
Keep reading: The Reject Button That Does Not Survive Navigation, The Consent Cookie That Expires in 30 Days: What Short Expiry Does to Your Records, and Push Notifications Are Not Cookies: The Permission Prompt That Still Needs a Consent Decision cover the nearby cases in this series.
Frequently asked questions
What are the four consent mode v2 signals?
ad_storage, analytics_storage, ad_user_data, and ad_personalization. They gate advertising cookies, analytics cookies, user data sent to Google for ads, and personalized ads.
When did consent mode v2 become mandatory?
March 6, 2024, for EEA and UK traffic. Sites running Google Ads in those regions need the signals set before any tag fires.
What is the difference between basic and advanced consent mode?
In basic mode, tags are blocked entirely until consent is given. In advanced mode, tags fire with the consent state attached and Google models the missing data. Advanced mode fails silently when defaults fire late.
How do I check if my consent mode setup is working?
Reject everything in a fresh browser with the network tab open. The consent default must be set before any Google tag fires, and all four signals must appear in the consent update.