Google Consent Mode V2: complete ecommerce implementation guide

Google Consent Mode V2 became a requirement for EU advertising in March 2024. Stores using Google Ads or GA4 for EU traffic that did not implement it by the deadline lost the ability to use remarketing lists, Customer Match and other audience-based ad features. Two years later, many ecommerce stores still have broken or incomplete implementations.

This guide covers everything: what Consent Mode V2 is, how it works under the hood, step-by-step implementation for every major ecommerce platform, GTM configuration, CMP selection, testing procedures and the most common mistakes we see when scanning stores.

What is Consent Mode V2

Consent Mode is a framework from Google that adjusts how Google tags behave based on a visitor's consent choices. When someone declines cookies on your store, Consent Mode tells Google's tags to operate in a restricted mode rather than loading full functionality.

Version 1 launched in 2020 with two signals: ad_storage and analytics_storage. Version 2, introduced in late 2023 with a March 2024 enforcement deadline, added two new signals: ad_user_data and ad_personalization. These close a gap where user data (like hashed emails via Enhanced Conversions) could still be sent to Google even when a user declined ad cookies.

The four consent signals explained

Every Consent Mode V2 implementation must handle all four signals. Each controls a different aspect of data collection:

The V2 signals address a specific gap: under V1, a user could decline ad cookies but still have their hashed email address sent to Google via Enhanced Conversions, where it would be used for audience building. ad_user_data and ad_personalization close this loophole by requiring explicit consent before user data is used for advertising purposes.

Why Google requires Consent Mode V2

The requirement comes from two regulatory pressures:

• EU Digital Markets Act (DMA). As a designated gatekeeper, Google cannot combine personal data from its own services with data from third-party services (your store) without valid end-user consent. Consent Mode V2 is Google's mechanism to prove that consent was obtained before data was used for advertising.
• Google's EU User Consent Policy. Updated in late 2023 to require all advertisers serving EU/EEA users to implement Consent Mode V2 by March 2024. Non-compliant accounts lose access to audience-based features.

For ecommerce stores, the practical impact: you cannot use Google Ads remarketing, Customer Match, optimized targeting or audience expansion for EU traffic unless Consent Mode V2 is active and users have given valid consent.

Google enforces this by checking whether incoming tag requests include the V2 consent signals. Accounts that send EU traffic without these signals see their audience features restricted automatically. There is no manual enforcement, no warning email. The restriction just happens.

Basic vs advanced Consent Mode

Google offers two implementation levels. The choice between them has a direct impact on your measurement data quality.

For ecommerce stores with significant EU traffic, advanced mode is strongly recommended. In markets like Germany, France and the Netherlands, 60-80% of visitors decline cookies. With basic mode, you are measuring less than half your EU traffic. Advanced mode with conversion modeling gives you an actionable picture of campaign performance.

Some privacy-conservative brands in regulated industries (healthcare, financial services) prefer basic mode for the strictest possible interpretation of consent. For standard ecommerce, advanced mode is the norm.

Choosing a CMP for Consent Mode V2

Your Consent Management Platform (CMP) collects user consent and communicates it to Google's tags. Not all CMPs implement Consent Mode V2 correctly. Use a Google-certified CMP from the Google CMP Partner Program.

When choosing a CMP, verify three things: (1) it is on Google's certified CMP partner list, (2) it has a native integration or plugin for your ecommerce platform, and (3) it maps its consent categories to all four Consent Mode V2 signals correctly. Incorrect signal mapping is the single most common implementation error we find when scanning stores.

GTM setup for Consent Mode V2

Regardless of your ecommerce platform, the Google Tag Manager configuration follows the same pattern. This is the core of any Consent Mode V2 implementation.

Step 1: Enable consent overview in GTM

In GTM, go to Admin > Container Settings and enable "Enable consent overview." This surfaces consent configuration for all tags and shows which consent types each tag requires.

Step 2: Set default consent state

Create a tag that sets the default consent state before any other tags fire. This tag must use the "Consent Initialization - All Pages" trigger (not "All Pages").

For a Custom HTML tag, the code looks like this:

<script>
  // Default: deny all for EU visitors
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}

  gtag('consent', 'default', {
    'ad_storage': 'denied',
    'ad_user_data': 'denied',
    'ad_personalization': 'denied',
    'analytics_storage': 'denied',
    'wait_for_update': 500,
    'region': ['AT','BE','BG','HR','CY','CZ','DK',
               'EE','FI','FR','DE','GR','HU','IE',
               'IT','LV','LT','LU','MT','NL','PL',
               'PT','RO','SK','SI','ES','SE',
               'IS','LI','NO','CH','GB']
  });

  // Default: grant all for non-EU visitors
  gtag('consent', 'default', {
    'ad_storage': 'granted',
    'ad_user_data': 'granted',
    'ad_personalization': 'granted',
    'analytics_storage': 'granted'
  });
</script>

The region parameter applies the denied defaults only to visitors from specified countries. The second call without a region sets the global default (granted) for everyone else. The wait_for_update parameter tells Google tags to wait 500ms for a consent update from your CMP before firing.

Step 3: Configure consent update

When a user interacts with the CMP banner, the CMP pushes a consent update to the data layer. Most certified CMPs do this automatically. The update call looks like:

gtag('consent', 'update', {
  'ad_storage': 'granted',
  'ad_user_data': 'granted',
  'ad_personalization': 'granted',
  'analytics_storage': 'granted'
});

If a user accepts all cookies, all four signals flip to "granted." If they accept only analytics, only analytics_storageflips. The CMP handles this mapping based on the user's granular choices.

Step 4: Set tag consent requirements

For each Google tag in GTM, configure which consent types it requires:

• GA4 Configuration tag: requires analytics_storage
• Google Ads Conversion Tracking: requires ad_storage and ad_user_data
• Google Ads Remarketing: requires ad_storage and ad_personalization
• Enhanced Conversions: requires ad_storage, ad_user_data and ad_personalization

In GTM, open each tag > Advanced Settings > Consent Settings. Add the required consent types under "Require additional consent for tag to fire."

Step 5: Enable advanced mode (recommended)

For advanced mode, make sure your Google tags have "Send data without consent" configured. GA4 and Google Ads tags do this by default when Consent Mode is active. In advanced mode, tags fire cookieless pings even when consent is denied. These pings contain no personal data and no cookies, but Google uses them for conversion modeling.

Shopify implementation

Shopify's built-in privacy features include a basic cookie consent banner and the Customer Privacy API. However, Shopify's native consent management does not fully implement Consent Mode V2 advanced mode. Most stores with EU traffic need a third-party CMP.

Option A: Shopify app + GTM (recommended)

1. Install a certified CMP app. Cookiebot, Pandectes and CookieYes all have Shopify apps with Consent Mode V2 support. Pandectes is Shopify-native and popular for its tight integration.
2. Install GTM on Shopify. Use a Shopify GTM app (like GTM Suite or Analyzify) or add GTM code manually to your theme's theme.liquid layout file.
3. Configure default consent in GTM. Follow the GTM setup above. Use the Consent Initialization trigger for the default denied tag.
4. Connect CMP to GTM. The CMP app pushes consent updates to the GTM data layer when users interact with the banner. Verify this in GTM Preview mode.
5. Configure GA4 and Google Ads tags in GTM with the consent requirements listed above.
6. Test. Use Tag Assistant from an EU IP to verify consent defaults are "denied" and switch to "granted" after accepting the banner.

Option B: Shopify Customer Privacy API

Shopify's Customer Privacy API can communicate with Consent Mode V2 if your CMP app supports it. Some CMP apps (Pandectes, Consentmo) hook into Shopify's privacy API directly. This approach avoids GTM entirely but gives you less control over tag configuration. Suitable for stores that only run GA4 and basic Google Ads conversion tracking.

WooCommerce implementation

WooCommerce on WordPress has the most implementation flexibility due to the WordPress plugin ecosystem.

1. Install a CMP plugin. Cookiebot, CookieYes and Complianz all have WordPress plugins with native Consent Mode V2 support. Complianz is popular for WooCommerce because it auto-detects cookies and scripts.
2. Install GTM. Use the GTM4WP plugin (free) or Site Kit by Google. GTM4WP has built-in WooCommerce data layer integration for ecommerce events.
3. Configure GTM with the default consent tag on the Consent Initialization trigger, as described above.
4. Connect CMP to data layer. Most CMP plugins push consent updates to window.dataLayer automatically. Complianz and CookieYes both have native Consent Mode V2 data layer integration.
5. WooCommerce purchase events. Use GTM triggers based on the "order received" (thank-you) page rather than WooCommerce's native Google Analytics integration. This ensures the purchase event respects the visitor's consent state. GTM4WP handles this with its built-in WooCommerce triggers.
6. Test from EU IP. Use a VPN or browser extension to simulate an EU visitor and verify the full consent flow.

PrestaShop implementation

PrestaShop has a smaller module ecosystem than WordPress, but several certified CMPs have PrestaShop modules.

1. Install a CMP module. Axeptio has a dedicated PrestaShop module with strong Consent Mode V2 support and is popular in French and EU markets. Cookiebot also has a PrestaShop module. Alternatively, Iubenda and Usercentrics can be integrated via their JavaScript embed code.
2. Install GTM. Use a PrestaShop GTM module (several are available on the PrestaShop Addons marketplace) or add GTM code manually to your theme's header template.
3. Configure default consent in GTM. Same Consent Initialization trigger setup as above. Set all four signals to denied for EU regions.
4. Connect CMP to GTM. If using Axeptio, its PrestaShop module pushes consent events to the data layer automatically. For Cookiebot, configure the GTM integration in the Cookiebot dashboard.
5. Handle PrestaShop checkout. PrestaShop's one-page checkout and five-step checkout have different page structures. Configure your GTM purchase trigger to fire on the order confirmation page regardless of checkout type. Common selectors: /order-confirmation URL or the order-confirmation page controller.
6. Test. PrestaShop stores often have aggressive caching (especially with modules like Page Cache or varnish). Clear cache after GTM/CMP installation and verify that consent scripts load correctly on cached pages.

Magento / Adobe Commerce implementation

Magento 2 (Adobe Commerce) requires more technical implementation than Shopify or WooCommerce, but offers full control.

1. Install a CMP. Usercentrics and OneTrust have the strongest Magento integrations. Cookiebot works via its JavaScript embed. For Magento-specific modules, check the Adobe Commerce Marketplace for cookie consent extensions with Consent Mode V2 support.
2. Install GTM. Use a Magento GTM extension (like the free Mageplaza GTM extension or the GTM module from Amasty). These inject GTM code and push ecommerce data layer events for product views, add-to-cart and purchases.
3. Configure GTM. Same pattern: Consent Initialization trigger with default denied for EU regions.
4. Connect CMP. Most Magento CMP integrations require adding the CMP script to the default_head_blocks.xml layout file or via the GTM Custom HTML tag. Ensure the CMP script loads before GTM or at the same time.
5. Magento CSP considerations. Magento 2.4+ has Content Security Policy headers enabled by default. You may need to whitelist your CMP's domain and Google's domains in csp_whitelist.xml. Without this, the CMP script or Google tags may be blocked silently.
6. Full Page Cache. Magento's FPC (Varnish or built-in) can interfere with consent state. Ensure consent scripts are not cached by using the cacheable="false" attribute on the CMP block or loading the CMP via JavaScript (which bypasses FPC).

BigCommerce implementation

BigCommerce's Stencil theme framework supports custom script injection, making Consent Mode V2 implementation straightforward.

1. Install a CMP. Cookiebot and CookieYes both work on BigCommerce via their JavaScript embed code. Add the CMP script via BigCommerce's Script Manager (Storefront > Script Manager) with placement set to "Head" and location "All Pages."
2. Install GTM. Add GTM via Script Manager or directly in the Stencil theme's {{>components/common/header}} partial. BigCommerce also has a native Google Analytics integration, but GTM gives you more control over consent.
3. Configure GTM. Standard Consent Initialization setup with default denied for EU.
4. Ecommerce events. BigCommerce's data layer is less standardized than Shopify or WooCommerce. Use a BigCommerce GTM integration app or manually push ecommerce events from Stencil template files. The order confirmation page is at /checkout/order-confirmation.
5. Test. BigCommerce's Akamai CDN caches aggressively. After making changes, purge the CDN cache from BigCommerce admin before testing.

Impact on Google Ads conversions and audiences

Implementing Consent Mode V2 changes what you see in your Google Ads account. Here is what to expect:

• Conversion reporting. With advanced mode and conversion modeling enabled, reported conversions typically recover to 80-90% of pre-consent levels. Google models conversions for non-consenting users based on behavioral patterns from consenting users with similar characteristics. These modeled conversions appear alongside observed conversions in reports.
• Remarketing audiences. Only visitors who consent to ad_personalization can be added to remarketing lists. In EU markets where 60-80% decline cookies, remarketing audience sizes drop significantly. Expect 50-70% smaller remarketing audiences for EU traffic compared to pre-GDPR levels.
• Customer Match. You can only upload customer data (email lists) for users who consented to ad_user_data and ad_personalization. This means segmenting your email list by consent status before uploading. If your CMP stores consent records, use that data to filter your Customer Match uploads.
• Smart Bidding. Google's automated bidding strategies (Target CPA, Target ROAS, Maximize Conversions) work with modeled conversion data. When conversion modeling is active, Smart Bidding accounts for both observed and modeled conversions in its optimization. Performance may fluctuate for 2-4 weeks after enabling Consent Mode V2 as Smart Bidding recalibrates.
• Performance Max. Performance Max campaigns use audience signals that depend on consent. With smaller remarketing audiences in EU markets, Performance Max relies more on its own signal-based targeting. This typically results in broader targeting and potentially lower ROAS for EU traffic in the short term.

Impact on GA4 data

Consent Mode V2 changes GA4 reporting for stores with EU traffic:

• Cookieless pings (advanced mode). Non-consenting visitors still send event pings to GA4, but without cookies, session IDs or persistent identifiers. Each pageview from a non-consenting visitor appears as a separate single-session user.
• Behavioral modeling. GA4 uses cookieless pings as input for its behavioral modeling. In reports, you see both "observed" data (from consenting users) and "modeled" data (estimated from non-consenting behavior). Enable this in GA4 Admin > Data Settings > Data Collection > Reporting Identity > Blended.
• User counts. Active user counts will be lower since non-consenting users cannot be tracked across sessions. This is not a measurement gap. It is the accurate count of identified, consenting users.
• Conversion rates. Conversion rate calculations change when the denominator (sessions/users) is limited to consenting visitors. Do not compare pre-consent and post-consent conversion rates directly.
• Ecommerce reports. Purchase revenue from consenting users is observed directly. Revenue from non-consenting users is estimated via modeling. Total revenue figures in GA4 should be treated as estimates, not exact numbers, for EU traffic segments.

Configure GA4's Reporting Identity to "Blended" to see both observed and modeled data. If you leave it on "Observed," you only see consenting users and your EU traffic appears artificially low.

Testing and debugging

Correct implementation is difficult to verify without systematic testing. Use these tools and procedures:

Google Tag Assistant

Available as a Chrome extension and at tagassistant.google.com. Shows the consent state for each Google tag and whether V2 signals are present. Look for the "Consent" section in each tag's detail view. All four signals should appear with their current state.

GTM Preview mode

Use GTM's built-in preview to verify the firing order: (1) Consent Initialization tag fires first with default denied, (2) CMP banner appears, (3) on user interaction, consent update fires, (4) Google tags fire or update based on new consent state.

Browser Network tab

Filter the Network tab for requests to google-analytics.com or googleads.g.doubleclick.net. Look for the gcs= parameter in request URLs:

• gcs=G111 means all consent types granted
• gcs=G100 means all denied
• gcs=G110 means analytics granted, ads denied
• gcs=G1-- means consent state not yet determined (waiting for CMP)

GA4 DebugView

In GA4 Admin > DebugView, watch events in real time. Verify that events from a non-consenting session show limited parameters and no user-level identifiers.

Test checklist

1. Visit your store from an EU IP (use VPN). Verify the consent banner appears.
2. Before interacting with the banner, check Tag Assistant: all four signals should show "denied."
3. Accept all cookies. Check Tag Assistant: all four signals should flip to "granted."
4. Clear cookies and visit again. Decline all cookies. Check that Google Ads tags fire in restricted (cookieless) mode and GA4 sends pings without cookies.
5. Visit from a non-EU IP. Verify the banner does not appear (or appears but defaults to granted). Check that all signals show "granted."
6. Complete a test purchase. Verify the conversion event fires with correct consent state in Tag Assistant.

Common Consent Mode V2 implementation mistakes

These are the most common issues we find when scanning ecommerce stores for consent compliance:

1. Default consent tag fires too late

The default consent tag must fire on the "Consent Initialization" trigger, not "All Pages." If it fires on All Pages, Google tags may fire before the default consent state is set, briefly collecting data without consent. This is both a compliance violation and a measurement error.

2. Incorrect signal mapping

CMPs use their own consent categories ("Marketing," "Statistics," "Preferences"). These must map correctly to Google's four consent signals. A common mistake: the CMP's "Marketing" category only maps to ad_storage but not to ad_user_data and ad_personalization. This means the V2 signals never get granted even when the user accepts marketing cookies.

3. Using basic mode unintentionally

Some CMP configurations block all scripts until consent is given, which is basic mode. If you intend to use advanced mode, verify that Google tags load (in restricted mode) even before consent. Check the Network tab: you should see cookieless pings to Google even before interacting with the banner.

4. Not testing with EU geolocation

If your default consent uses the regionparameter, testing from a non-EU IP will show everything as "granted" and you will miss EU-specific issues. Always test from an EU IP address using a VPN.

5. Non-Google tags ignoring consent

Consent Mode V2 is Google-specific. Meta Pixel, TikTok Pixel, Pinterest Tag and other advertising scripts need their own consent management. If you implement Consent Mode V2 but let non-Google pixels fire without consent, you still have a GDPR compliance problem.

6. CMP not on Google's certified list

Using an uncertified CMP means Google may not recognize the consent signals as valid. Check the Google CMP Partner Program page for the current list. If your CMP is not listed, contact your CMP vendor and ask about certification status.

7. Consent state not persisted

When a visitor returns to your store, their previous consent choice should be remembered. If the CMP does not persist consent state (typically via a first-party cookie), returning visitors see the banner again on every visit. This creates a poor user experience and can cause consent fatigue, leading to higher decline rates.

Compliance benefits beyond Google

Implementing Consent Mode V2 correctly provides benefits beyond Google measurement:

• GDPR compliance foundation. A correctly configured CMP with Consent Mode V2 satisfies GDPR requirements for prior consent before advertising tracking. The same infrastructure extends to Meta, TikTok, Pinterest and other platforms.
• Consent records as evidence. Your CMP stores consent records (who consented, when, to what). This evidence is critical in regulatory inquiries and data protection investigations.
• ePrivacy compliance. The consent mechanism addresses ePrivacy Directive requirements for cookie consent, which apply in all EU/EEA member states.
• US state privacy laws. US state privacy laws increasingly require opt-out mechanisms. The CMP infrastructure you build for Consent Mode V2 can be extended to handle US opt-out requirements.
• Reduced complaint risk. Proper consent management reduces the risk of being named in a GDPR complaint based on advertising tracking without consent. This has been a common complaint trigger, especially in Austria, France and Germany.

Frequently asked questions

What is Google Consent Mode V2?

Google Consent Mode V2 is a framework that adjusts how Google tags (GA4, Google Ads, Floodlight) behave based on user consent choices. It uses four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization. The last two were added in V2 to control whether user data is sent to Google for advertising purposes.

Is Consent Mode V2 required for ecommerce stores?

Yes, for any store using Google Ads or GA4 with EU/EEA traffic. Since March 2024, Google requires Consent Mode V2 to use audience-based ad features like remarketing and Customer Match for EU visitors. Without it, Google restricts these features entirely.

What is the difference between basic and advanced Consent Mode?

Basic mode blocks all Google tags until consent is given, creating large measurement gaps. Advanced mode loads tags for all visitors but operates in cookieless ping mode for non-consenting users, sending minimal data that Google uses for conversion modeling. Advanced mode typically recovers 80-90% of measurement data.

Which CMPs support Google Consent Mode V2?

Google-certified CMPs include OneTrust, Cookiebot (Usercentrics), Usercentrics, CookieYes, Axeptio, Didomi, Complianz, CookieFirst, Iubenda and Consentmanager. Check Google's CMP Partner Program for the latest list.

How do I implement Consent Mode V2 on Shopify?

Install a certified CMP app (Cookiebot, Pandectes or CookieYes). Install GTM via a Shopify app or theme code. Connect the CMP to GTM so consent signals flow through the data layer. Set default consent to "denied" for EU visitors. Test with Google Tag Assistant from an EU IP address.

How do I implement Consent Mode V2 on PrestaShop?

Install a CMP module with Consent Mode V2 support. Axeptio has a dedicated PrestaShop module and is popular in EU markets. Add GTM via a PrestaShop module or theme code. Configure the CMP to push consent signals to the data layer. Set default consent to "denied" for EU visitors and test from an EU IP.

How do I implement Consent Mode V2 on WooCommerce?

Install a WordPress CMP plugin (Cookiebot, CookieYes or Complianz). Install GTM using GTM4WP. Configure the CMP to pass consent signals via the data layer. Use GTM triggers on the thank-you page for purchase events. Test the full consent flow from an EU IP address.

What are the most common Consent Mode V2 implementation mistakes?

The most common mistakes are: not setting default consent state before tags load, incorrect mapping between CMP categories and Google consent types, using basic mode when advanced mode is intended, not testing with EU geolocation, and letting non-Google tags fire without consent.

Does Consent Mode V2 affect Google Ads performance?

Yes. Remarketing audience sizes typically drop 50-70% in EU markets since only consenting users can be added to lists. With advanced mode and conversion modeling, reported conversions recover to 80-90% of pre-consent levels. Smart Bidding recalibrates over 2-4 weeks after implementation.

How do I verify Consent Mode V2 is working?

Use Google Tag Assistant to check consent states per tag. In the browser Network tab, filter for Google requests and look for the gcs= parameter: G111 means all granted, G100 means all denied. Use GA4 DebugView to confirm events respect consent state. Always test from an EU IP address.