Consent Mode v2 is Google’s way of letting tags adjust their behavior based on what a visitor agreed to. On a WordPress site, getting it right usually takes three things working together: a consent platform, Google Tag Manager, and tags configured to respect the signals. When any one of those is off, you either lose data you were allowed to collect or collect data you weren’t.
Most sites we review have a banner that looks fine. The problems are underneath: tags firing before the banner loads, pixels it never controls, and plugins quietly adding their own Google tags.
The four signals
Consent Mode v2 passes four settings to Google tags:
ad_storage: whether advertising cookies can be set.analytics_storage: whether analytics cookies can be set.ad_user_data: whether user data can be sent to Google for advertising.ad_personalization: whether data can be used for remarketing and personalized ads.
Your consent banner sets them. Your tags read them. The two newer ones, user data and personalization, are the ones most older setups are missing. Google made them a requirement for advertisers who want to keep using audience and remarketing features for visitors in the European Economic Area, which is why so many sites got a notice about this from their Google Ads account.
Each signal has two states, granted or denied. There is a default state, set when the page first loads, and an update, sent when the visitor makes a choice. Both have to happen, in that order.
What needs to change on a typical site
Set defaults before anything else loads
The default consent state has to be set before GTM fires any tag. If your banner script loads after GTM, the first page view goes out without consent signals.
In GTM, this is what the Consent Initialization – All Pages trigger is for. It fires before every other trigger, including the normal page view. Your consent platform’s GTM template should run on it. If you set defaults in code instead, the gtag('consent', 'default', {...}) call has to sit above the GTM snippet in the page head.
You can also set defaults by region. A common setup is denied by default for visitors in the EEA and UK, and granted by default elsewhere, with the banner still letting anyone opt out. Whether that’s acceptable for your business is a legal question, and so is the list of regions.
Connect the banner to GTM
OneTrust, CookieYes, Cookiebot and most other platforms have a Consent Mode integration. Turn it on, and make sure it updates all four signals, not just the original two. In some platforms this is a setting in the dashboard; in others, it’s a GTM template from the Community Template Gallery that you configure with your banner ID.
Check how the platform maps its categories to the signals. Usually “Analytics” or “Performance” maps to analytics_storage, and “Marketing” or “Targeting” maps to the three ad signals. If the mapping is wrong, everything downstream is wrong too.
Review every non-Google tag
Meta, LinkedIn, TikTok and other pixels don’t read Google’s consent signals. They need their own triggers that wait for the right consent category.
In GTM, open each of these tags and look at Advanced Settings > Consent Settings. Choose “Require additional consent for tag to fire” and add the relevant signal, usually ad_storage. Better still, fire them on a trigger tied to the banner’s own consent event, so they also fire on the page where the visitor clicks accept rather than waiting for the next page.
Remove hard-coded tags
Pixels pasted into the theme or a header plugin bypass GTM and your consent rules entirely. On WordPress, look in these places:
- The theme’s
header.phporfunctions.php, including any child theme. - Header and footer script plugins, such as WPCode or similar.
- Site Kit by Google, which can place its own Google tag alongside your GTM setup.
- WooCommerce marketing extensions, which often add their own Google or Meta tags.
- Page builder settings that have a “custom code” field.
View the page source and search for gtag(, fbq(, GTM- and G-. Every hit should be one you can explain.
Watch your caching and optimization plugins
Performance plugins that delay or combine JavaScript can change the order scripts run in. A “delay JavaScript until interaction” setting is useful for speed, but if it catches your consent banner or the consent defaults, tags can fire before consent is set. Exclude the banner script and GTM from delay and combine features, then retest.
How to check it yourself
Open your site in a private window, don’t touch the banner, and open your browser’s developer tools. On the Network tab, filter for collect and facebook. Before you accept anything, Google requests should show consent parameters set to denied, and the Meta pixel shouldn’t fire at all. Accept cookies and reload. Now you should see full requests.
A few specifics make this faster:
- In GA4 requests, look for the
gcsparameter. It encodes the storage consent state, and a value likeG100means both analytics and ad storage were denied. - In GTM Preview mode (Tag Assistant), click the first event in the left panel and open the Consent tab. It shows the on-page default, any update, and the current state for each signal.
- Check the Application tab for cookies. Before consent, you shouldn’t see
_ga,_fbpor similar marketing cookies being set. - Test the decline path as well as the accept path. Click reject and confirm nothing changes.
If tags fire before you’ve clicked anything, your setup isn’t doing what the banner promises.
Advanced vs. basic mode
In basic mode, Google tags don’t load at all until consent is given. In advanced mode, they load and send cookieless pings that Google uses for modeling. Advanced mode recovers more data, but it’s a decision for your legal team, not your developer.
The practical differences:
- Basic is simpler to explain and audit. Nothing Google-related happens before consent. You will see a sharp drop in reported traffic for regions where consent is denied by default.
- Advanced sends limited, cookieless requests even when consent is denied. GA4 can use them for behavioral and conversion modeling, though modeling only kicks in once a property meets Google’s volume thresholds. Smaller sites may never see modeled data at all.
We’ll set up either one. We just make sure you chose it on purpose.
Common failure points
A common failure: a Google Ads account flags missing consent signals, even though the site has a well-known consent platform installed and everyone assumed it was handling everything. Testing shows GA4 firing twice on every page: once through GTM, correctly waiting for consent, and once through a Google plugin that was connected years ago and never removed. Just as often, a Meta pixel is hard-coded in the theme and fires on every page load regardless of the banner.
The fix is mostly removal. Disconnect the plugin’s tag, move the Meta pixel into GTM with a consent trigger, update the banner integration to send all four signals, and retest both the accept and decline paths. The technical work is usually quick. The harder part is explaining to the marketing team why reported sessions drop afterward. The old number was inflated by the duplicate tag.
What it usually takes
For a site with a clean GTM container and a consent platform already in place, getting Consent Mode v2 right is often a few hours of configuration and testing. Sites with years of accumulated tags, multiple plugins adding scripts, or no consent platform yet take longer, sometimes a few days once you include decisions about regions and modes.
Budget for retesting after any plugin update, theme change or new marketing tag. Consent setups break quietly.
When to bring us in
If you’ve run the network check above and something fires before consent, or you aren’t sure which plugins are adding tags, that’s a good time to talk. We audit the full path from banner to tag, fix what’s leaking, and document the setup so your team can maintain it. See our ADA and cookie compliance work, or just get in touch.