Google Consent Mode Audit & Implementation
Check whether your Google Consent Mode setup, CMP and Google tags work together as intended. We audit real before-choice, reject and accept behaviour, implement the agreed v2 changes and verify the result.
Consent Mode v2 · Google Tag Manager · Google tag · GA4 · Google Ads · CMPs
Consent signal timeline
Verify the state before choice, after reject and after accept
- 1
Before choice
Consent defaults should exist before relevant Google tags initialise.
- 2
Reject
The CMP and Consent Mode update should reflect the rejected categories.
- 3
Accept
The granted state should reach the intended Google products once.
- 4
Downstream requests
Google requests are compared with the effective consent state and timing.
Evidence first
A real observation, with its limits intact
Google Consent Mode observed
Protocol state ambiguous
Nine GCS/GCD observations
OneTrust visible · no choice
Finding: Google consent signals were present but the effective state remained ambiguous
At about 1.17 seconds, GCS observations indicated granted advertising and analytics storage while GCD observations contained a mixed state with denied fields. CookieRisk recorded the before-interaction protocol state and Consent Mode type as unknown. This is evidence of ambiguity that needs configuration review, not an absolute compliance conclusion. Reject and accept updates were not tested by this Quick Scan.
Verify behaviour, not just installation
Know what consent state reaches each Google tag
Consent Mode can be present while defaults arrive too late, updates never reach the page or different Google requests carry conflicting signals. A CMP switch can also change the timing without an obvious error in the interface.
A Google Consent Mode audit follows defaults and updates through practical browser flows. We compare protocol observations with the visible CMP state, Google tag requests and the agreed Basic or Advanced implementation design.
Consent Mode communicates consent choices to supported Google tags. It is not a consent banner, does not control every marketing vendor and does not by itself prove legal compliance or reliable conversion measurement.
Audit before choosing a fix
The right change depends on the CMP, tag architecture, regions and organisational policy. CookieRisk reports the observed state first, then scopes configuration changes without silently changing Basic or Advanced Mode.
Common reasons to request an audit
When Consent Mode v2 deserves configuration review
- Consent defaults are missing or appear after Google tags initialise
- ad_user_data or ad_personalization is absent from the v2 setup
- Reject and accept do not produce the expected state updates
- GCS, GCD or related request signals appear inconsistent
- Google tags fire differently across templates, markets or subdomains
- The CMP template and GTM consent settings disagree
- Nobody can explain whether Basic or Advanced Mode is intended
- A redesign or CMP migration changed analytics or advertising totals
What the Consent Mode audit checks
Defaults, updates, timing and downstream Google behaviour
Default consent timing
We check whether defaults are set before commands that send measurement data. Asynchronous CMP loading, wait settings and page transitions are reviewed where they affect the observable order.
Reject and accept updates
We observe whether consent changes are sent on the page where the user acts and whether the effective state changes. Not attempted, interaction failed and update not observed remain distinct outcomes.
Consent Mode v2 parameters
The review covers ad_storage, analytics_storage, ad_user_data and ad_personalization, plus relevant functionality settings. Values are assessed against the intended policy, not assumed from a generic template.
Basic or Advanced Mode
We identify the observable implementation type where the evidence supports it. The recommended model is agreed with the organisation; CookieRisk does not silently convert one mode into the other.
Google tag behaviour
GA4, Google Ads and other relevant Google requests are reviewed together with their consent signals. A request in denied mode is not automatically reported as a full tracking event or cookie write.
CMP and regional scope
We check the CMP integration, region-specific defaults and cross-domain journeys included in scope. Missing coverage in one market remains visible rather than being inferred from another.
One controlled route from policy to browser behaviour
Audit, implement and validate Google Consent Mode v2
- 01
Diagnose
The Google Consent Mode audit establishes the actual defaults, updates, timing and downstream Google behaviour across the agreed flows.
- 02
Fix
The Google Consent Mode implementation can update the CMP, GTM or Google tag while preserving the organisation’s chosen consent model.
- 03
Validate
We re-run the before-choice, reject and accept journeys and document the effective Consent Mode v2 implementation without hiding failed checks.
What you receive
A consent-signal map and implementation-ready fix plan
Every conclusion remains tied to an observed signal, request, consent state or reviewed configuration. Scope, access, fee and delivery date are confirmed before work starts.
Map of intended consent categories to Consent Mode v2 parameters
Timeline of defaults, user actions and observed updates
Relevant GCS, GCD and Google request observations
Basic, Advanced or unknown implementation status with reason
Confirmed mismatches separated from possible issues and missing evidence
Prioritised CMP, GTM and Google tag recommendations
Record of flows that failed, were unavailable or were not in scope
Optional implementation and verification re-test after changes
Want reliable tracking instead of another unexplained report?
Share the website and what looks wrong. We will suggest the most useful first step.
Consent issue beyond Google?
Review Consent Mode within the full tracking setup
Meta, LinkedIn, Pinterest and custom tags do not become consent-aware simply because Google Consent Mode is present. The broader tracking audit reviews the CMP and all observed vendors together.
Related: Google Tag Manager consultant · Google Ads tracking
Frequently asked questions
Google Consent Mode audit questions
What is a Google Consent Mode audit?
It is a technical review of consent defaults, updates and supported Google tag behaviour. The audit compares observable protocol signals with CMP state, browser requests and the intended Basic or Advanced implementation.
How do you check whether Consent Mode v2 works?
We inspect before-choice, reject and accept flows, the timing of defaults and updates, relevant Google request parameters and the available CMP, GTM or code configuration. A failed interaction is reported as failed, not as a clean result.
What is the difference between Basic and Advanced Consent Mode?
In Basic Mode, Google tags are blocked until the relevant consent interaction. In Advanced Mode, Google tags can load with denied defaults and adjust the data they send. The appropriate design depends on organisational policy and implementation requirements.
Does Consent Mode make a website compliant?
No. Consent Mode communicates consent status to supported Google tags. It does not replace a CMP, determine the correct legal basis or control every vendor. CookieRisk provides technical evidence and risk guidance, not legal certification.
Can you audit or fix our Google Consent Mode setup?
Yes, after confirming the intended category mapping and implementation owner. Changes can include CMP templates, GTM consent APIs, Google tag code, timing and update handling. Publishing remains subject to approval.
Do you test Google Ads and GA4 with Consent Mode?
Yes, when they are included in scope. We review the relevant requests and platform setup without treating a denied-mode request as equivalent to a fully consented event or assuming modelled reporting can be verified from the browser alone.
What access is needed for the audit?
We can start with the public website and a CookieRisk scan. A deeper audit may need read access to the CMP, GTM, GA4 and Google Ads. Implementation requires the relevant edit and publishing permissions.
What happens after I request a Consent Mode review?
We first review the website, CMP, regions and Google products in use. We then propose the most useful audit or implementation scope and the access needed before any Consent Mode changes are made.
Improve your Google Consent Mode implementation
Share the website, CMP and Google products in use, plus any measurement changes or warnings you have seen. A CookieRisk scan link is useful but optional.
Audit an existing setup or request implementation.
Ambiguous and unavailable consent evidence stays explicit.
CookieRisk provides technical tracking and consent risk guidance based on observed evidence. It is not legal advice or compliance certification.