Consent Mode v2

What Consent Mode v2 does

Consent Mode is a Google framework that passes a visitor's consent choices to Google tags. Version 2 uses four signals: storage for analytics, storage for ads, permission to use data for advertising, and permission for ad personalization. When your cookie banner records a choice, it updates those signals, and GA4, Google Ads and Floodlight tags adjust their behavior automatically.

Without Consent Mode, you're stuck between two bad options. Either tags fire regardless of what the visitor chose, which makes the banner meaningless, or tags are blocked entirely until consent, which leaves large holes in your data. Consent Mode is the middle path Google designed for this.

The US picture, hedged honestly

The US doesn't have a single federal privacy law like Europe's GDPR. Instead there is a patchwork:

• California's CCPA, as amended by the CPRA, gives residents rights including opting out of the sale or sharing of personal information, which can include some advertising cookies;
• a growing number of states, among them Virginia, Colorado, Connecticut, Texas and Oregon, have their own consumer privacy laws with their own thresholds and details;
• sector rules such as HIPAA add requirements for healthcare.

Many small businesses fall under none of the state laws because they're below the revenue or data thresholds. Others, especially online stores and businesses with large audiences, may qualify. That determination is a legal one, and I don't make it for you. What I do is make sure that whatever you decide, the website behaves accordingly. US state privacy laws and your website gives an overview, and cookie banners in the US covers when a banner makes sense.

Regional settings

A practical approach for many US businesses is regional defaults. Visitors from the EEA and the UK see an opt-in banner and tags wait for consent. US visitors get a notice and an easy opt-out, with tags running by default unless they choose otherwise or their browser sends a Global Privacy Control signal. Consent tools and Consent Mode both support region-specific settings. Your attorney decides the policy; I implement it.

Healthcare and sensitive data

Consent doesn't solve everything. For medical, dental, therapy and similar practices, the bigger issue is what data tags can see in the first place. A pixel on an appointment request page may pass information that counts as protected health information, regardless of the banner. Federal regulators have warned healthcare providers about tracking technologies, and several hospital systems have faced claims over it. For those clients I strip tracking from patient-facing pages or limit it to non-identifying events, and recommend a review by your compliance advisor. HIPAA and website tracking explains the issue in plain terms.

Choosing a consent tool

There are free banners, platform-built banners and paid consent management platforms. For most small businesses a reputable tool that supports Consent Mode v2, regional rules and Global Privacy Control is enough. The deciding factors are whether it integrates with Tag Manager cleanly and whether you can edit categories yourself. I'll recommend one that fits your traffic and budget rather than the most expensive option.

Testing is the part people skip

The most common problem I find is a consent setup that was never tested. The banner appears, but rejecting does nothing, or accepting doesn't update the tags, or a hard-coded script outside Tag Manager ignores the whole system. I test each choice, check which requests leave the browser, and document the results. That is also when old scripts nobody remembered tend to surface.

Where consent fits in the bigger setup

Consent Mode is included in my standard GA4 and Google Tag Manager setup. If you also run server-side tracking, consent signals pass through the server container too, so the same rules apply to server events. The goal is one consistent behavior across every tag, matching what your privacy policy promises.