TL;DR
- Consent Mode v2 is a signal-passing mechanism, not a network-level blocker
- "Advanced" implementation sends "cookieless pings" to Google before consent
- New parameters like ad_user_data and ad_personalization are required for EU traffic
- If your network trace shows google-analytics.com before a click, you are using Advanced Mode
Verdict
GTM Consent Mode v2 helps Google recover missing data, but "Advanced Implementation" is a legal minefield in the EU. If your goal is zero-load compliance, you should be using "Basic Implementation" or network-level blocking.
The Signal vs. The Wall
The biggest misconception about Consent Mode v2 (CoMo v2) is that it blocks tags from loading. It doesn’t. CoMo v2 is a way for GTM to tell Google tags how to behave based on the user’s choice.
Think of it as a dimmer switch, not a physical wall. The tags still load, but they "dim" their data collection if consent is denied.
Basic vs. Advanced Implementation
This is where most of the legal risk lives.
- Basic Implementation: Tags are physically blocked until consent is granted. No data is sent to Google. Once the user clicks "Accept," the tags fire. This is the safest route for GDPR compliance.
- Advanced Implementation: Tags load immediately. If consent is
denied, they send "cookieless pings" to Google. These pings contain session data, page URLs, and user agent strings but no cookies.
DPAs in France and Germany have argued that even these "cookieless pings" constitute a violation if they are sent without prior consent, as they still involve the processing of personal data (IP addresses and user agents).
Your site is leaking data before consent.
Free headless-browser scan. Catches GA4, Meta Pixel, TikTok and more firing before the click. Results in 10 seconds.
Run a free scan →The New Parameters
CoMo v2 introduced two mandatory parameters for EU traffic:
ad_user_data: Controls whether user data can be sent to Google for advertising purposes.ad_personalization: Controls whether data can be used for remarketing and personalized ads.
If your CMP isn’t sending these signals by now, your Google Ads performance is likely tanking as Google ignores data from EU visitors without these flags.
How to Verify Your Implementation
Open DevTools and filter the network tab for /collect requests. Look for the gcd parameter in the URL. This is an encoded string representing the consent states.
If you see a collect request before you click the banner, you are using Advanced Implementation. If you see nothing until you click "Accept," you are using Basic Implementation.