← Back to Writing
2 min read

Consent Mode V2: What Actually Changed

Google's consent mode update requires action by March 2024. Here's what's real, what's hype, and what you actually need to do.

  • consent
  • gdpr
  • google-ads
  • privacy

Google announced Consent Mode v2 requirements. The marketing internet panicked. Vendors sent urgent emails. Agencies scheduled “emergency” calls.

Let me separate signal from noise.

What Actually Changed

Two new signals are now required for EEA/UK traffic if you want to use Google’s advertising features:

  • ad_user_data: Permission to send user data to Google for ads
  • ad_personalization: Permission to use data for personalized ads

These join the existing signals:

  • analytics_storage: GA4 cookies
  • ad_storage: Google Ads cookies

If you don’t pass these new signals, Google won’t process your EEA/UK conversion data for remarketing or audience building.

What Didn’t Change

  • Google still offers behavioral modeling for conversions when consent is denied
  • You still need a proper CMP (Consent Management Platform)
  • The technical implementation is the same (gtag consent commands)
  • Server-side tracking still works the same way

What You Actually Need to Do

  1. Update your CMP configuration to map to the new signals
  2. Test that the signals fire correctly (denied vs granted)
  3. Verify in Google Ads that you’re compliant before the deadline
  1. Implement a CMP that integrates with Google’s consent framework
  2. Configure it to send all four consent signals
  3. Consider advanced consent mode for behavioral modeling
  4. Test thoroughly before deploying

If you’re using server-side GTM:

  1. Ensure consent signals pass through to your server container
  2. Server-side tags should respect consent state
  3. Platform APIs (CAPI, etc.) should only receive data with appropriate consent

The Vendor Noise

Half the emails you’re getting are vendors trying to sell you things you don’t need. Be skeptical of:

  • “AI-powered consent recovery” (usually just aggressive dark patterns)
  • “Zero-impact compliance” (nothing is zero-impact)
  • “Guaranteed conversion modeling” (Google controls the modeling, not vendors)

The Real Timeline

Google’s deadline is the deadline. After that, non-compliant setups lose access to advertising features for EEA/UK audiences.

If that’s a meaningful portion of your traffic, prioritize this. If you’re US-only with minimal EU visitors, it’s less urgent but still worth doing properly.

Either way, treat this as an excuse to audit your entire consent setup. Most implementations I see have issues beyond the v2 signals.