Consent Mode v2 is installed and the data still collapsed

The symptom: data lost after the banner

GA4 users and sessions dropped on the day the banner went live and never came back. Google Ads conversions fell by a similar share in the same week. Remarketing audiences stopped growing, or shrank below serving size. Enhanced conversions stopped matching. Modeled conversions never appear in reports, and the modeling notice never shows up.

The opposite symptom is just as common: the banner went live and absolutely nothing changed in the data. That usually means the tags never came under consent control in the first place.

Why Consent Mode v2 breaks

Consent Mode is a signal layer, not a blocker. Google tags read a consent state and change their own behavior according to it. Four signals matter. ad_storage and analytics_storage govern whether the tag may use storage for advertising and analytics. Consent Mode v2 added ad_user_data, which governs whether user data may be sent to Google for advertising purposes, and ad_personalization, which governs personalized advertising and remarketing.

There are two implementation shapes. In basic mode, Google tags are prevented from loading at all until a visitor consents, so nothing at all is received from a visitor who declines. In advanced mode, the tags load, start in a denied state, and send cookieless pings that carry the consent state and no identifiers. Those pings are the raw material for modeling. Choosing basic mode means choosing to have no modeling input.

Here is where implementations break.

The default arrives after the first tag. The default consent call has to execute before the Google tag runs. Consent management platforms load asynchronously, and if the Google tag wins the race, the first pageview goes out with no consent state at all. A Google tag running with no consent state behaves as it did before Consent Mode existed. In Google Tag Manager, the default belongs on the Consent Initialization trigger, which runs ahead of Initialization and All Pages. A CMP template placed on All Pages is already too late.

Only two of the four signals are set. Templates and hand written snippets that predate v2 set ad_storage and analytics_storage and stop. ad_user_data and ad_personalization then sit at whatever default applies. If that default is denied and no update ever touches them, you have a permanent denial that no visitor chose. Enhanced conversions stop feeding and audience building stops, and nothing in the banner interface reveals it.

The update never fires for returning visitors. The consent update must be sent on every page load, carrying the stored choice, not only on the click that first set it. If the update runs only on the accept button, every subsequent page and every returning visit runs at the denied default.

Category mapping is wrong. CMPs group cookies into categories and map categories onto the consent signals. Marketing mapped onto analytics_storage, an analytics category that never touches ad_user_data, or a region rule that applies denied defaults in territories you did not intend, all produce a state that does not match what the visitor was asked.

Tags fire outside consent control. Tag Manager’s consent checks only govern tags that declare a consent requirement. A Custom HTML tag set to require no additional consent fires regardless of state. A pixel hardcoded into the theme or the app is not in the container at all. Server-side forwarding that never reads the consent state passes events on regardless. In each case the banner is honest and the tags are not.

The CMP blocks the Google tag itself. Some platforms neutralize script tags until consent is given. Do that to the Google tag and you have basic mode with an advanced mode configuration on paper: no cookieless pings, therefore no modeling.

Modeling conditions are not met. Modeling is not a switch that consent mode turns on. It requires consent signals present across the site, a sustained daily volume of denied traffic to model from, and a sustained volume of consented traffic to train on, measured over a multi-week window. Google publishes numeric thresholds for GA4 behavioral modeling and they are not small. The conditions for Google Ads conversion modeling are documented, but the volumes required are not published, so the only way to know whether your account qualifies is whether modeled conversions actually appear. Plenty of sites implement Consent Mode correctly and never see a modeled conversion because their traffic does not reach the required volume. That is expected behavior, not a fault.

This is measurement guidance, not legal advice. Which signals you default to denied, in which regions, and what your banner must ask, are questions for your own counsel. Everything here is about whether the implementation does what you told it to do.

How to confirm the consent state

Use the container’s preview mode and read the consent state on the very first event of a fresh session, before any banner interaction. The consent view shows the on-page state at each event and which tags were blocked and why.

Watch the network requests to Google’s collection endpoints and read the gcs parameter. G100 means ad_storage and analytics_storage are both denied. G111 means both granted. If you deny everything and see no request at all, you are in basic mode and there is no modeling input. If you deny everything and still see G111, something is granting a signal the visitor refused.

The two v2 signals are not encoded in gcs, so do not infer them from it. Read the consent default and consent update calls themselves and confirm that all four keys are present in both.

Check ordering directly. In the network timeline, find the first request to a Google endpoint and confirm the default consent call executed before it.

Run three clean tests in a fresh browser profile. Decline everything, browse a few pages, and convert. Accept everything and repeat. Then accept, close the browser, return, and confirm the second visit reports granted without any banner interaction.

Inventory the tags. List every tag in the container with its consent settings, then search the site source for hardcoded pixels the container does not control.

How to fix Consent Mode v2

Set defaults in exactly one place, and make sure that place runs first. Consent Initialization in Tag Manager, or an inline default call in the head above the Google tag.

Include all four signals in both the default and the update, every time, on every region rule.

Send the update on every page load with the stored choice, not only on the accept click.

Re-map CMP categories to signals and test each region rule separately rather than assuming the default region is representative.

Give every tag a consent requirement, including Custom HTML tags that set cookies. Bring hardcoded pixels into the container or gate them in the theme.

Choose basic or advanced deliberately, and make the code match the choice. If you want modeling, the Google tag has to load and send cookieless pings for visitors who decline.

Consider url_passthrough so click identifiers survive internal navigation when ad storage is denied, and decide on ads_data_redaction according to your policy.

Re-verify after every CMP version update. Templates change, and a template change can silently drop a signal.

What a broken consent setup costs you

There are two costs, pointing in opposite directions. Overcollection means tags firing that consent said no to, which is an exposure question for your counsel and a real one. Undercollection is the visible cost, and it is the one that shows up in the ad account.

As a worked example, take a lead generation site that produces 500 form fills a month on $10,000 of paid spend. Real cost per lead is $20. If 35 percent of visitors decline and modeling is unavailable because the implementation never sends cookieless pings, the platform sees 325 leads and reports $30.77. Reported cost per lead is more than half again the real figure. Smart Bidding then optimizes against the 325 it can see, so the error stops being a reporting problem and starts being a spending problem.

A banner that renders correctly is not evidence of a consent implementation that works. The interface and the signal layer are separate systems, and they fail independently. The Missing Conversions Audit tests the consent state on the first hit of a session, tag by tag and region by region, logs every gap it finds, fixes the top 10 in a separate GTM workspace, and shows the before and after. $900 flat, 5 business days.