GTM Consent Mode v2: The 5 Most Common Configuration Mistakes — and How to Fix Them

Since March 2024, Google requires all EEA advertisers to implement Consent Mode v2. Without correct implementation, you lose remarketing data, conversion tracking, and audience signals. But: a flawed implementation is worse than none — it creates a false sense of security while data flows without consent in the background.

Mistake 1: Default consent set to granted

The most common and dangerous mistake. Many GTM setups default consent to granted:

// WRONG — default to granted
gtag('consent', 'default', {
  'analytics_storage': 'granted',
  'ad_storage': 'granted'
});

This means: until the cookie banner loads and the user makes a choice, all tags fire. With slow CMPs, that's 2–5 seconds — enough for dozens of tracking requests.

// CORRECT — default to denied
gtag('consent', 'default', {
  'analytics_storage': 'denied',
  'ad_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied',
  'functionality_storage': 'denied',
  'personalization_storage': 'denied',
  'security_storage': 'granted'
});

Mistake 2: CMP integration not tested

The CMP should send gtag('consent', 'update', ...) on user decision. But:

• Many CMPs send the update before GTM loads — GTM misses the signal
• Update mapping is wrong: CMP category “Marketing” mapped to analytics_storage instead of ad_storage
• On “Reject All”, some CMPs send no update at all — the default remains active

Fix: GTM Preview mode → check Data Layer → after consent click, a consent_update event with correct storage types must appear.

Mistake 3: wait_for_update not set

// CORRECT — wait for CMP response
gtag('consent', 'default', {
  'analytics_storage': 'denied',
  'ad_storage': 'denied',
  'wait_for_update': 500
});

Mistake 4: GA4 send_page_view not gated behind consent

GA4 sends a pageview on load by default. Even with Consent Mode active, this pageview fires as a “cookieless ping” in denied state — with your IP address in the payload.

// Conservative: page_view only after consent
gtag('config', 'G-XXXXXXX', { 'send_page_view': false });
document.addEventListener('consent_granted', function() {
  gtag('event', 'page_view');
});

Mistake 5: No denied-state verification

You configured everything — but did you test what actually happens on “Reject”? Remove the statistic or replace with a verifiable citation. A real related study is Utz et al. (CCS 2019) on dark patterns in cookie banners, but it does not contain this figure..

Fix: After rejecting, check all network requests. Look for requests to google-analytics.com, googleads.g.doubleclick.net, facebook.com/tr — if these still fire, the Consent Mode integration is broken.

Checklist: Is Your Consent Mode v2 Correct?

An automated Forensic Audit checks all these points — including payload analysis in denied vs. granted state. Details on the methodology page.

This article was produced with AI assistance and fact-checked against verified GDPR case law (GDPRhub). For legal advice, consult a qualified data protection expert.