Free tool Google Consent Mode v2 code generator
Choose gtag.js or Google Tag Manager, basic or advanced mode, and where consent is required. You get the default snippet in the right order, the update call for your banner, and a plain explanation of every parameter, all checked against Google’s own documentation.
- 7 consent types
- Region defaults
- Runs locally
Pick a set-up, copy two snippets
The defaults suit a site that measures visitors from Europe with GA4: denied in the EEA, UK and Switzerland, granted elsewhere, advanced mode. Change anything; the code updates as you type.
gtag.js = the Google tag pasted in your page. Tag Manager = a GTM container.
gtag.js: G- (GA4), AW- (Google Ads) or GT-. Tag Manager: GTM-.
Advanced loads Google tags at once with denied defaults; basic waits until the visitor accepts. See the table below the tool.
Region codes are ISO 3166-2. Outside the listed regions every type defaults to granted.
Comma separated, for example ES, FR, US-CA. Country (DE) or subdivision (US-CA).
How long tags wait for your banner before sending. Google’s Tag Manager guide suggests at least 500.
The localStorage key or cookie name your banner writes. Our cookie banner generator uses cookie_consent.
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
// Consent Mode v2 defaults: must run before any config or event command
gtag('consent', 'default', {
'ad_storage': 'denied',
'ad_user_data': 'denied',
'ad_personalization': 'denied',
'analytics_storage': 'denied',
'functionality_storage': 'denied',
'personalization_storage': 'denied',
'security_storage': 'granted',
'wait_for_update': 500,
'region': ['AT', 'BE', 'BG', 'HR', 'CY', 'CZ', 'DK', 'EE', 'FI', 'FR', 'DE', 'GR', 'HU', 'IE', 'IT', 'LV', 'LT', 'LU', 'MT', 'NL', 'PL', 'PT', 'RO', 'SK', 'SI', 'ES', 'SE', 'IS', 'LI', 'NO', 'GB', 'CH']
});
gtag('consent', 'default', {
'ad_storage': 'granted',
'ad_user_data': 'granted',
'ad_personalization': 'granted',
'analytics_storage': 'granted',
'functionality_storage': 'granted',
'personalization_storage': 'granted',
'security_storage': 'granted'
});
gtag('set', 'ads_data_redaction', true);
// Returning visitors: re-apply the choice saved by the cookie banner
(function () {
var raw = null, r = null;
try { raw = localStorage.getItem('cookie_consent'); } catch (e) {}
if (!raw) try { var m = document.cookie.match(/(?:^|; )cookie_consent=([^;]*)/); if (m) raw = decodeURIComponent(m[1]); } catch (e) {}
try { r = JSON.parse(raw); } catch (e) {}
if (!r || !r.c || !(r.e > Date.now())) return;
var c = r.c;
gtag('consent', 'update', {
'ad_storage': c.marketing ? 'granted' : 'denied',
'ad_user_data': c.marketing ? 'granted' : 'denied',
'ad_personalization': c.marketing ? 'granted' : 'denied',
'analytics_storage': c.analytics ? 'granted' : 'denied',
'functionality_storage': c.preferences ? 'granted' : 'denied',
'personalization_storage': c.preferences ? 'granted' : 'denied'
});
})();
</script>
<!-- Google tag (gtag.js) -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"></script>
<script>
gtag('js', new Date());
gtag('config', 'G-XXXXXXXXXX');
</script>Runs before the Google tag or container. Order matters: Google says consent defaults do not work if they are called after config or event commands.
The standard Tag Manager noscript fallback, unchanged.
What each parameter is set to
| Parameter | Default | Outside listed regions | Banner category | What it controls |
|---|---|---|---|---|
ad_storage | denied | granted | Marketing | Advertising storage such as cookies |
ad_user_data | denied | granted | Marketing | Sending user data to Google for advertising |
ad_personalization | denied | granted | Marketing | Personalised advertising (remarketing) |
analytics_storage | denied | granted | Analytics | Analytics storage, for example visit duration |
functionality_storage | denied | granted | Preferences | Storage that supports site functions, such as language |
personalization_storage | denied | granted | Preferences | Personalisation storage, such as recommendations |
security_storage | granted | granted | Necessary (not asked) | Security storage: authentication, fraud prevention |
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
// Call applyConsent() when the visitor makes or changes a choice
window.applyConsent = function (c) {
gtag('consent', 'update', {
'ad_storage': c.marketing ? 'granted' : 'denied',
'ad_user_data': c.marketing ? 'granted' : 'denied',
'ad_personalization': c.marketing ? 'granted' : 'denied',
'analytics_storage': c.analytics ? 'granted' : 'denied',
'functionality_storage': c.preferences ? 'granted' : 'denied',
'personalization_storage': c.preferences ? 'granted' : 'denied'
});
};
// Example:
// applyConsent({ analytics: true, marketing: false, preferences: false });
</script>Call applyConsent({ analytics, marketing, preferences }) when the visitor clicks, and save the choice. The cookie banner generator does both for you.
Notes on this set-up
- DoneOrder is right: dataLayer and gtag are defined, defaults are set, then gtag.js loads and config runs.
- NoteDenied defaults apply to 32 region codes; a second default grants everything elsewhere. Google applies the most specific matching region.
- NoteAdvanced mode: Google tags load at once. While consent is denied they send cookieless pings (timestamp, user agent, referrer, consent state) that Google uses for an advertiser-specific conversion model.
- Noteads_data_redaction only matters while ad_storage is denied; once granted it has no effect.
- NoteReturning visitors: the saved choice under “cookie_consent” is re-applied with an update before any tag runs.
- NoteTest with Google Tag Assistant: the Consent tab shows the default and the update for each type.
Share these inputs: the values go after the # in the link, so they never reach a server.
https://tapcub.com/tools/consent-mode-generator
Version v1.0Updated Update history
What each snippet does
Consent Mode does not show a banner. It tells Google tags what the visitor chose, so your banner and the tags work together.
The default snippet
Defines dataLayer and gtag(), then calls gtag('consent', 'default', …) for all seven types. With a region list there are two defaults: denied for the listed regions, granted for everyone else.
The update call
gtag('consent', 'update', …) maps your banner’s three categories to six consent types. Marketing controls ad_storage, ad_user_data and ad_personalization together; analytics controls analytics_storage.
The parameter table
Shows the default for each type, the value outside your regions, the banner category that changes it, and Google’s definition in one line.
The notes
Flag a wrong tag ID, an invalid region code, a short wait, and what basic or advanced mode means for the data Google receives.
Granted or denied is about storage and data use, not whether a tag exists. In advanced mode, Google tags still send cookieless pings while denied; if you want nothing sent before consent, choose basic mode.
Four steps
Fifteen minutes, including the check in Tag Assistant.
-
1
Choose set-up and mode
Pick gtag.js or Tag Manager and enter your tag ID. Pick advanced if you want Google’s conversion modelling for visitors who decline; basic if nothing should reach Google before consent.
-
2
Set where consent is required
The EEA, UK and Switzerland preset covers the usual case. Use a custom list for specific countries or states (ISO 3166-2, such as
US-CA). -
3
Paste the snippets
The default snippet goes at the very top of
<head>on every page, before the Google tag or container. Hook the update call to your banner’s buttons, or use our cookie banner, which already calls it. -
4
Verify
Open Tag Assistant, load the page and check the Consent tab: defaults on page load, then an update after you click. Repeat in a private window for a returning-visitor test.
Two ways to implement Consent Mode
Google describes both modes; which one fits depends on your legal advice and how much modelling you want. Summary of Google’s help article on consent mode (checked 10 November 2026):
- Basic: Google tags are blocked until the visitor interacts with the banner. If they decline, nothing is sent to Google, not even the consent state. Conversion modelling uses a general model
- Advanced: Google tags load immediately with denied defaults. While denied, they send cookieless pings with functional information (timestamp, user agent, referrer) and coarse flags. Modelling is advertiser-specific
- For visitors in the EEA, Google asks advertisers who use its tags for measurement, ad personalisation or remarketing to collect consent and pass it through consent mode, including ad_user_data and ad_personalization
- Order: the default command must run before any config or event command. Updates should be sent as soon as the visitor chooses and on every later page
| Basic | Advanced | |
|---|---|---|
| Tag loading | Blocked until the visitor interacts | Loads with defaults set to denied |
| Before consent | No data sent, not even the default state | Consent state and cookieless pings |
| After consent granted | Tags load and run normally | Cookies set, full measurement sent |
| If consent denied | Nothing sent | Cookieless pings only |
| Conversion modelling | General model | Advertiser-specific model |
| In this generator | gtag.js loaded by loadGoogleTag() after Accept | gtag.js in the page, wait_for_update set |
One visitor, three page views
A visitor from Germany on a GA4 site with the default settings: advanced mode, EEA/UK/CH region list, restore on.
| Moment | What runs | analytics_storage | ad_storage |
|---|---|---|---|
| First page view | Region default for DE | denied | denied |
| Clicks “Analytics only” in the banner | applyConsent({ analytics: true }) → update | granted | denied |
| Next page view | Defaults, then restore reads cookie_consent and updates | granted | denied |
| A visitor from Canada | The unscoped default (not in the list) | granted | granted |
Whether granting by default outside Europe is right for you is a legal question, not a technical one. Laws such as California’s CCPA work on opt-out for selling or sharing data; choose “Every visitor” if you want the stricter default everywhere.
Where Consent Mode set-ups break
Almost every problem is about order or about a missing update.
Defaults after the Google tag
If gtag('consent', 'default') runs after config, Google says the defaults do not work. Put the snippet first in <head>.
Update only on the click page
Without a stored choice re-applied on later pages, returning visitors are treated as denied again. Keep “Re-apply a saved choice” on.
Only the v1 parameters
Setting ad_storage and analytics_storage but not ad_user_data and ad_personalization leaves the v2 signals unset. The generator always writes all seven.
Wrong region codes
UK is not an ISO code (use GB), and EU is not a region code at all. The tool flags codes it does not recognise.
Measure without depending on consent state
Google’s tags change behaviour with consent. TapCub’s analytics does not store anything on the device by default, so its counts do not drop when visitors decline cookies.
No analytics cookies
A keyed server-side hash tells visits apart; nothing is written to the browser.
Learn moreConsent by region
Set consent requirements per region and honour Global Privacy Control in the compliance centre.
Learn moreTraffic sources
See where visitors come from, including ad click IDs read from the landing URL.
Learn moreConsent Mode questions
Still have a question?
Chat with the team behind TapCub — we usually reply within a few hours on business days.
What is new in Consent Mode v2?
Two consent types: ad_user_data (sending user data to Google for advertising) and ad_personalization (personalised advertising). Together with ad_storage, analytics_storage and the three other storage types, that makes seven. Google’s EEA guidance asks advertisers to pass end-user consent for EEA visitors through consent mode.
Is Consent Mode a cookie banner?
No. Google says consent mode does not provide a banner; it receives the choice from your banner and adjusts how Google tags behave. You still need a banner or consent platform. Our cookie banner generator produces one that already calls the update.
Basic or advanced consent mode: which should I use?
Basic sends nothing to Google until the visitor accepts. Advanced loads tags at once and sends cookieless pings while consent is denied, which lets Google model conversions for your account specifically. Google leaves the choice to you; the deciding factor is usually your legal advice on whether those pings are acceptable.
Where does the consent default code go?
At the very top of <head>, before the Google tag or the Tag Manager container. Google’s guide is explicit that consent defaults do not work if they are called out of order, after config or event commands.
What does wait_for_update do?
It tells tags how many milliseconds to wait for an update before sending data. It gives your banner time to report a saved choice on page load. Google’s Tag Manager documentation suggests at least 500 ms.
How do I set Consent Mode in Google Tag Manager?
Either paste the default snippet before the container (Google’s Tag Manager example does this), or use a consent template that sets defaults on the Consent Initialization – All Pages trigger. Templates should use setDefaultConsentState and updateConsentState rather than gtag('consent', …).
What are url_passthrough and ads_data_redaction?
url_passthrough passes ad click and session information through URL parameters (such as gclid, _gl, wbraid) when cookies are denied. ads_data_redaction removes ad click identifiers from Google Ads and Floodlight requests while ad_storage is denied; it has no effect once ad_storage is granted.
Which region codes can I use?
ISO 3166-2 codes: a country such as DE or a subdivision such as US-CA. The most specific match wins, and a default without a region applies to everyone not covered by another default.
Update history
New features, fixes and data refreshes for this tool, newest first.
-
· v1.0
LaunchedFirst release.
Data this tool relies on
- Google Consent Mode documentation — checked 2026-11-10, reviewed every 6 months (next review by 2027-05-10)
Missing something or found an error? Tell us — requests that come up often go into the next update. All tool updates
Connect the banner and the policy
Consent Mode needs a banner that calls the update and a policy that explains it.