Cookie Consent and Consent Mode v2: Tracking That Keeps Working After ‘Reject’

Two things are true at once, and most small business sites handle only one of them. Visitors in Europe and the UK must be asked before you drop analytics or advertising cookies, and rejecting has to be as easy as accepting. Meanwhile, a banner that simply blocks everything on “reject” leaves you optimising ad spend on a fraction of reality — often a third or more of sessions simply vanish from the numbers. Consent Mode v2 exists in the gap between those two facts, and this is how to set it up without pretending either one away.

It builds directly on the conversion tracking setup and the Tag Manager install. If those are not in place, do them first — consent mode governs tags you have not built yet is a sentence nobody needs.

Who actually needs this

This is guidance from someone who installs these, not legal advice. If your business is regulated or your traffic is largely European, have the wording checked.

The four signals

Consent Mode v2 works by passing four parameters to Google’s tags, each “granted” or “denied”:

• analytics_storage — analytics cookies (GA4 measurement).
• ad_storage — advertising cookies.
• ad_user_data — whether user data may be sent to Google for advertising purposes.
• ad_personalization — whether it may be used for personalised advertising and remarketing.

Basic vs advanced mode

Most commercial sites use advanced mode; privacy-sensitive sectors often choose basic. The important part is that it is a deliberate decision you can explain, not whatever the plugin shipped with. Note that conversion modelling needs a certain volume of traffic before Google will produce it, so very small sites may see little benefit from advanced mode either way.

Setting it up on WordPress

1. Choose a certified CMP.

   A Google-certified consent platform or a banner plugin that states Consent Mode v2 support and appears on Google’s certified list. Free tiers exist and are fine for small sites. Avoid the abandoned “cookie notice” plugins that only hide a bar.

2. Set the defaults before any tag fires.

   The consent defaults must load before Tag Manager or gtag — denied for the four signals for EEA/UK visitors (region-scoped defaults are supported), granted for essential. Most CMP plugins handle this automatically; if you are doing it by hand, the default call goes in the head above the GTM snippet.

3. Wire the banner to update consent.

   Accept or reject fires a consent update with the four signals, and your tags respond. In Tag Manager, use the built-in consent settings on each tag (“require additional consent” for the relevant types) rather than blocking tags with triggers — that is what keeps modelling working.

4. Category the cookies honestly.

   Essential (session, security, cart), analytics, advertising, preferences. A store’s cart cookie is essential; your heat-map tool is not. Scan the site — most have cookies the owner has forgotten.

5. Make reject as easy as accept.

   Two equally prominent buttons on the first layer, plus a link to settings. No pre-ticked boxes, no dark patterns, no “accept to continue”. A persistent way to change the choice later (a small link or floating icon) is required in practice.

6. Connect the other platforms.

   Meta’s Pixel and Conversions API, and any other advertising tag, need their own consent handling — the Pixel and CAPI setup should respect the same signals, and server-side events must carry the consent state too.

7. Update the privacy and cookie policy.

   What you collect, why, the categories, how to withdraw consent, and who the processors are. Link it from the banner.

Testing it properly

1. Open the site in a private window from an EEA/UK context; the banner appears and no analytics or ad cookies exist before a choice.
2. In Tag Manager’s preview, check the consent state on page load: four signals, denied by default.
3. Click Reject. Confirm no cookies are set, and — in advanced mode — that cookieless pings still leave for Google.
4. Click Accept in a fresh session. Confirm the consent update fires, cookies appear, and GA4 real-time registers the visit.
5. Check the consent state in GA4’s admin diagnostics and in Google Ads’ tag diagnostics after a few days.
6. Change your mind via the settings link and confirm consent is revoked and cookies cleared.
7. Re-test after any theme, plugin or CMP update — this breaks silently, so add it to the monthly maintenance checks.

What the numbers will do

Expect a visible step in your analytics when a compliant banner goes live: fewer recorded sessions, higher apparent conversion rates on the sessions that remain, and — with advanced mode and enough volume — modelled conversions appearing in Google Ads. Note the date in your reporting so nobody spends a month hunting for a “traffic drop” that is a consent change. Compare year on year with the annotation in mind, and judge campaigns on booked jobs from the CRM, which consent does not affect, rather than on browser-side counts alone.

Mistakes

• A banner that blocks tags with triggers instead of using consent mode — data lost with nothing modelled in return.
• Only two of the four signals (the v1 leftover).
• Defaults loading after GTM, so the first pings go out without consent state.
• Accept prominent, reject hidden two clicks deep.
• Cookies firing before any choice is made.
• A cookie policy listing tools removed two years ago.
• Never retesting after updates.

Further reading: Google: consent mode behaviour · Consent mode developer guide · Google EU user consent policy.

FAQ

Want the banner, the four signals, the tag consent settings and the tests done properly — so you stay compliant without going blind? See the tracking and analytics services; it is a half-day job and it protects both your data and your ad account.