Google Consent Mode v2: the four consent parameters

What Consent Mode is

Consent Mode is Google’s mechanism for telling its tags what a visitor has consented to. You set defaults before the tags load, then update them when the visitor answers the banner. In advanced mode the tags load and adjust their behaviour, sending cookieless pings that let modelling fill the gap; in basic mode they do not load at all until consent is granted.

Version 2 added two parameters to the original two. ad_storage and analytics_storage cover cookies; ad_user_data and ad_personalization cover sending user data to Google for advertising and using it for personalisation. Google has required v2 for EEA traffic to its advertising products since March 2024.

What squirrel checks

The rule runs on every crawled page and matches the raw HTML against patterns. It first checks whether the page carries Google tags at all, by looking for googletagmanager.com, gtag, google-analytics, googlesyndication or googleadservices. It emits a single check named consent-mode:

• Skipped when no Google tags were found. Message: No Google tags detected (consent mode not applicable).
• Pass when a consent signal and a v2 signal are both present. Message: Google Consent Mode v2 detected.
• Info when a consent signal is present without a v2 signal. Message: Consent Mode detected (may need v2 upgrade), with Add ad_user_data and ad_personalization for v2 as the value.
• Info when no consent signal is present. Message: Google Consent Mode not detected, with Required for EU Google Ads compliance as the value.

A consent signal is any of a gtag('consent' call, a consent: 'default' pair, or the literal strings ad_storage, analytics_storage, ad_user_data or ad_personalization. A v2 signal is ad_user_data or ad_personalization. The consent patterns are case-insensitive regular expressions that tolerate whitespace inside the call. The Google-tag and v2 tests are case-sensitive substring matches, so an uppercase AD_USER_DATA satisfies the consent test and not the v2 one. Either way it reads the page HTML, so consent mode configured inside a tag manager container rather than inline is not detected. Severity info, weight 4.

How to fix it

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('consent', 'default', {
    ad_storage: 'denied', analytics_storage: 'denied',
    ad_user_data: 'denied', ad_personalization: 'denied'
  });
</script>

Set the defaults before any Google tag loads, then call gtag('consent', 'update', …) with the visitor’s answer. Deny by default for an EEA audience.

Most consent platforms do this for you, and a tag manager can run the platform on its consent initialization trigger so it fires before the other tags. Getting that ordering right is the part that is still yours.

Enable / disable

Disable this rule

[rules]
disable = ["analytics/consent-mode"]

Disable all Analytics rules

[rules]
disable = ["analytics/*"]

Enable only this rule

[rules]
enable = ["analytics/consent-mode"]

enable replaces the default ["*"], so this is the only rule selected. Leave disable out: a rule that matches any disable pattern is skipped even when enable names it. Only an enabled setting under a rule’s own [rule_options] table overrides both lists.

Related rules

• legal/cookie-consent: the banner that produces the consent signal.
• analytics/gtm-present: which Google tags are on the page.
• security/third-party-cookies: third-party resources that may set cookies.
• legal/privacy-policy: the policy the same processing has to be described in.

Analytics findings ship in every audit next to the SEO, performance and agent experience rules. See Fix SEO issues with AI for how an agent works through a report.

References

• Consent Mode, Google tag platform
• Consent Mode concepts, Google tag platform
• Google Tag Manager developer guide

Check your site

Run squirrel audit https://example.com and open the Analytics section of the report. Each page is reported with whether a consent signal and a v2 signal were found. Signed-out local audits need no account and cost nothing. Signed-in audits spend credits.