Crawvix

Google Consent Mode for GA4: Connect Your Cookie Banner Correctly

Crawvix Editorial Team · Published November 4, 2026 · Last updated November 4, 2026 · 11 min read

A cookie banner with two buttons controls a switch that lets a tag send full or reduced signals, solid and dotted.

Many sites have a cookie banner and Google Analytics 4 (GA4), and assume the two are connected. Often they are not. The banner records a choice, but the Google tags on the page carry on as if nothing was decided, or they are blocked completely and the site loses all measurement for visitors who decline. Google consent mode is the mechanism that passes the visitor's choice to Google tags so they can change how they behave.

This guide is for site owners, marketers and developers who already run GA4 and a banner or consent management platform (CMP). You will learn what consent mode does and does not do, what the consent types are, the difference between basic and advanced implementation, the order in which the commands must run, and how to test the result with Tag Assistant.

This is not legal advice. Rules about cookies, tracking and consent differ by country and sometimes by region, and they change. Consent mode is a technical tool for passing a choice to Google tags. It does not decide whether you need consent, what wording is valid, or whether your setup is lawful. Ask a qualified adviser about your own situation.

Short answer: Google consent mode lets your consent banner tell Google tags whether a visitor allowed storage such as analytics cookies. You set default states to denied before any Google tag fires, then send an update when the visitor chooses. It does not collect consent itself and it does not make a site compliant.

Before you begin

You need:

  • A GA4 property and a Google tag already on your site, directly or through Tag Manager.
  • A consent banner or CMP. Google's documentation recommends a CMP for Tag Manager sites to handle updates of visitor choices. Many CMPs send consent mode signals for you.
  • Someone who can edit the page head or the Tag Manager container.
  • A decision, made with your adviser, on defaults and regions.

Allow half a day. The main risk is order: Google says that if consent code is called out of order, consent defaults will not work. Back up the container or page template first.

If you have not set up GA4, begin with GA4 setup for small business. If you use Tag Manager, read the Google Tag Manager setup guide first.

Google describes consent mode as a way for developers to adjust how tags and SDKs behave based on user consent choices. Managing consent involves three jobs, and consent mode only covers the second and third:

  1. Get the choice. Your banner, custom code or CMP asks the visitor.
  2. Tell Google. The consent state is passed to Google tags.
  3. Make tags obey. Google tags and any third-party tags behave according to that state.

Google is explicit that consent mode does not save choices. You must store them yourself, for example in a first-party cookie or local storage, and send them again on each page. It also says you are responsible for obtaining consent on your site.

Each type is either granted or denied. Google's concepts page defines seven:

Consent type What it covers
ad_storage Cookies (web) or device identifiers (apps) used for advertising
ad_user_data Sending user data to Google for online advertising
ad_personalization Using data for personalised advertising
analytics_storage Cookies or identifiers used for analytics, such as visit duration
functionality_storage Storage that supports site functions, such as language settings
personalization_storage Storage for personalisation, such as video recommendations
security_storage Storage for security, such as authentication and fraud prevention

For a site that only uses GA4, analytics_storage is the main one. If you also use Google Ads, the three advertising types matter too. When analytics_storage is denied on the web, Google tags will not read or write first-party analytics cookies.

Google's concepts page sets out two ways to implement consent mode.

Basic Advanced
Google tags Blocked until the visitor interacts with the banner Load when the visitor arrives, with defaults usually denied
Data before a choice None is sent to Google Cookieless pings are sent while consent is denied
After the visitor agrees Tags load and send consent states Full measurement is sent once consent is granted
Modelling Google says basic implementations do not get modelled data to fill gaps from declined consent Behavioural and conversion modelling can use the cookieless pings

Cookieless pings are small messages sent without cookies. Google's page says they contain functional information such as timestamp, user agent and referrer, and aggregate information such as a consent boolean, a random number generated on each page load, and whether the page carried ad-click information in the URL. Google also notes that pings may include things like IP address as part of normal browser communication, and says Google Analytics does not store or log IP addresses.

Which mode fits you is a policy question as much as a technical one. Google's own page says to check your company's guidelines when choosing, and your adviser should confirm that the pings fit the rules that apply to you.

Modelling has limits. Google says it needs your tag or SDK to reach a data collection threshold. Treat modelled numbers as estimates, not a full replacement for what declined visitors would have generated.

Step-by-step instructions

Step 1: Decide the defaults and the regions

Write down, for each consent type, the default state before a choice: usually denied for storage types where consent is required by the rules that apply to you. Google's requirements advise applying a denied default only to the relevant regions if you use region-specific laws, so that other regions keep precise measurement. The region parameter takes ISO 3166-2 codes, and a more specific region wins over a broader one. A default with no region applies to everyone else.

What success looks like: A short table of types, default states and regions, signed off by whoever owns your privacy policy.

Step 2: Choose your banner route

You have three routes, per Google's documentation:

  • A CMP template for Tag Manager from a CMP partner. This is the least code for most sites.
  • Your own banner with gtag.js consent commands.
  • A custom Tag Manager consent template.

Google's requirements say to show consent options as early as possible and let users grant or deny each storage type separately.

What success looks like: You know which tool will send the default and the update.

Step 3: Set the default before any Google tag runs

With gtag.js, place the default command before the Google tag configuration, on every page:

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}

  gtag('consent', 'default', {
    'ad_storage': 'denied',
    'ad_user_data': 'denied',
    'ad_personalization': 'denied',
    'analytics_storage': 'denied',
    'wait_for_update': 500
  });
</script>
<!-- the Google tag snippet for G-XXXXXXX goes after this block -->

The wait_for_update value, in milliseconds, tells tags how long to wait for a consent update when your banner loads asynchronously. Google's own example uses 500. To use a different default for a region, add a second command with a region list, for example 'region': ['ES'].

In Tag Manager, set defaults in the CMP tag or a consent template, and fire it on the built-in Consent Initialization - All Pages trigger. Google says that trigger always fires before all other tags, including those on the Initialization trigger. Keep the Google tag itself on its normal trigger.

What success looks like: In the page source or container, the default runs before any Google tag.

Step 4: Send an update when the visitor chooses

When a visitor clicks Accept, Reject or saves preferences, send an update with the choices:

<script>
  function consentGranted() {
    gtag('consent', 'update', {
      'analytics_storage': 'granted'
    });
  }
</script>

Call this from your banner's accept handler, and send denied values when a visitor withdraws consent. Because consent mode does not save the choice, read the saved choice on each new page and run the update straight away, after the default. If you use a CMP, it normally does this for you.

What success looks like: After you accept in the banner, analytics_storage changes to granted without a reload.

Step 5: Let Google tags load

Google recommends that Google tags load in all cases, even when consent is denied, so consent mode can send its non-identifying signals and support modelling. In Tag Manager, check Advanced Settings, Consent Settings on the tag, and remove blocking exceptions or additional consent checks that stop Google tags firing, as described in Google's page on unblocking tags. Unblock only tags that support consent mode. Third-party tags that do not understand consent mode still need their own blocking rules. If your site sends a Content Security Policy header, make sure it allows the scripts your CMP loads; see Content Security Policy Guide.

If you want basic mode, you do the opposite: hold the tags until the banner choice. Make sure that is a deliberate decision and that your reports are read with it in mind.

What success looks like: The Google tag is present in the page load whether or not you have accepted, if you chose advanced mode.

Step 6: Test defaults, updates and tag behaviour

Open Tag Assistant, enter your site URL, and connect. Then:

  1. Select the earliest Consent event in the Summary. Confirm ad_storage, ad_personalization, ad_user_data and analytics_storage are set, or check the Consent tab's On-page Default column.
  2. Accept in the banner. Select the most recent Consent event and confirm the values changed, or check the On-page Update column.
  3. In the Tags tab, click a Google tag to see whether it fired or was blocked as expected.
  4. If you set region defaults, repeat with simulated locations.

Google's troubleshooting notes: an empty Consent tab means consent mode is not implemented or your Google tag was blocked; a "tag read consent state before a default was set" error means your default runs too late; no change after the banner means no update command is being sent.

DebugView in GA4 will not show events from a visitor who has not agreed to analytics cookies when consent mode is active, so test with the banner accepted. See GA4 key events for using DebugView.

What success looks like: Tag Assistant shows denied defaults, a granted update after acceptance, and the tags you expected.

Step 7: Document it and review it

Record the defaults, regions, CMP and mode in a short note. Re-test after every change to the banner, theme, container or CMP, because a theme update can move scripts and break the order. Add the test to your website launch SEO checklist so it runs before every release.

What success looks like: A named owner and a re-test habit.

  • It does not collect consent, write a cookie policy or decide what is lawful.
  • It does not stop non-Google scripts. Chat widgets, pixels and embeds need their own rules; see Third-Party Scripts and Performance for how to list them.
  • It does not fix a banner that pushes content around. If yours causes layout shift, see Cumulative Layout Shift (CLS) Fix, and if it loads through JavaScript, see JavaScript SEO.
  • It does not make numbers complete. Denied visitors give less data, and modelled data is an estimate.

Crawvix has an advisory check that looks for analytics or advertising scripts and cookies in the server response and page markup, and then for signs of a cookie notice. It cannot see a banner created later by JavaScript, and it is guidance, not legal advice.

Final verification checklist

  • Defaults for every consent type are written down, with regions where needed.
  • The default command runs before any Google tag on every page.
  • An update command runs when the visitor accepts, rejects or changes preferences.
  • The saved choice is reapplied on later pages.
  • Tag Assistant shows the expected On-page Default and On-page Update values.
  • Google tags are not blocked by Tag Manager exceptions (if you chose advanced mode).
  • Third-party tags have their own consent rules.
  • The privacy policy describes what you actually use.
  • A named person owns re-testing.

Common mistakes to avoid

  • Banner with no consent signals. The visitor clicks, nothing reaches Google tags. Fix: send the update command or use a CMP that does.
  • Default set too late. Fix: place it before the Google tag, or use the Consent Initialization trigger.
  • Blocking Google tags entirely and calling it advanced mode. Blocked tags cannot send signals or support modelling. Fix: unblock Google tags that support consent mode, or call it basic mode.
  • Assuming consent mode is a compliance certificate. It is not. Fix: involve a qualified adviser.
  • Same default for every country. Fix: set region defaults where your advice says rules differ.
  • Testing only after accepting. Fix: test the denied state first.
  • Forgetting stored choices. Fix: reapply the saved choice on every page load.

Frequently asked questions

That depends on your audience, your tags and the rules that apply to you, which differ by country. This is not legal advice. Technically, consent mode is how a banner talks to Google tags, so if you collect consent and use Google tags, it is the supported way to connect them.

No. Consent mode needs something to supply the choice. Google says the choice can come from a banner, a custom solution or a CMP.

Will GA4 data drop if visitors decline?

Less data is collected from visitors who decline, whichever route you use. In advanced mode, Google may model some of the gap, subject to a data threshold. Do not expect exact recovery.

What does wait_for_update do?

It sets the number of milliseconds Google tags wait for your banner to send an update before they proceed with the default states. It helps when the banner loads asynchronously.

Yes. Tags have Consent Settings under Advanced Settings, and the Consent Initialization trigger fires before other tags. Most CMPs offer a Tag Manager template that sends the default and update for you.

Official references

Next step: Try the free website sample to see how your own site does on a few of these checks. This guide provides technical information, not a guarantee of rankings, traffic or index inclusion.