TapCub is live — analytics, insights and live chat, free on one platform

Free tool Google Consent Mode v2 code generator

Choose gtag.js or Google Tag Manager, basic or advanced mode, and where consent is required. You get the default snippet in the right order, the update call for your banner, and a plain explanation of every parameter, all checked against Google’s own documentation.

  • 7 consent types
  • Region defaults
  • Runs locally
Generator

Pick a set-up, copy two snippets

The defaults suit a site that measures visitors from Europe with GA4: denied in the EEA, UK and Switzerland, granted elsewhere, advanced mode. Change anything; the code updates as you type.

gtag.js = the Google tag pasted in your page. Tag Manager = a GTM container.

gtag.js: G- (GA4), AW- (Google Ads) or GT-. Tag Manager: GTM-.

Advanced loads Google tags at once with denied defaults; basic waits until the visitor accepts. See the table below the tool.

Region codes are ISO 3166-2. Outside the listed regions every type defaults to granted.

How long tags wait for your banner before sending. Google’s Tag Manager guide suggests at least 500.

The localStorage key or cookie name your banner writes. Our cookie banner generator uses cookie_consent.

1. Top of <head>, before anything else from Google
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  // Consent Mode v2 defaults: must run before any config or event command
  gtag('consent', 'default', {
    'ad_storage': 'denied',
    'ad_user_data': 'denied',
    'ad_personalization': 'denied',
    'analytics_storage': 'denied',
    'functionality_storage': 'denied',
    'personalization_storage': 'denied',
    'security_storage': 'granted',
    'wait_for_update': 500,
    'region': ['AT', 'BE', 'BG', 'HR', 'CY', 'CZ', 'DK', 'EE', 'FI', 'FR', 'DE', 'GR', 'HU', 'IE', 'IT', 'LV', 'LT', 'LU', 'MT', 'NL', 'PL', 'PT', 'RO', 'SK', 'SI', 'ES', 'SE', 'IS', 'LI', 'NO', 'GB', 'CH']
  });
  gtag('consent', 'default', {
    'ad_storage': 'granted',
    'ad_user_data': 'granted',
    'ad_personalization': 'granted',
    'analytics_storage': 'granted',
    'functionality_storage': 'granted',
    'personalization_storage': 'granted',
    'security_storage': 'granted'
  });
  gtag('set', 'ads_data_redaction', true);
  // Returning visitors: re-apply the choice saved by the cookie banner
  (function () {
    var raw = null, r = null;
    try { raw = localStorage.getItem('cookie_consent'); } catch (e) {}
    if (!raw) try { var m = document.cookie.match(/(?:^|; )cookie_consent=([^;]*)/); if (m) raw = decodeURIComponent(m[1]); } catch (e) {}
    try { r = JSON.parse(raw); } catch (e) {}
    if (!r || !r.c || !(r.e > Date.now())) return;
    var c = r.c;
    gtag('consent', 'update', {
      'ad_storage': c.marketing ? 'granted' : 'denied',
      'ad_user_data': c.marketing ? 'granted' : 'denied',
      'ad_personalization': c.marketing ? 'granted' : 'denied',
      'analytics_storage': c.analytics ? 'granted' : 'denied',
      'functionality_storage': c.preferences ? 'granted' : 'denied',
      'personalization_storage': c.preferences ? 'granted' : 'denied'
    });
  })();
</script>
<!-- Google tag (gtag.js) -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"></script>
<script>
  gtag('js', new Date());
  gtag('config', 'G-XXXXXXXXXX');
</script>

Runs before the Google tag or container. Order matters: Google says consent defaults do not work if they are called after config or event commands.

What each parameter is set to

ParameterDefaultOutside listed regionsBanner categoryWhat it controls
ad_storagedeniedgrantedMarketingAdvertising storage such as cookies
ad_user_datadeniedgrantedMarketingSending user data to Google for advertising
ad_personalizationdeniedgrantedMarketingPersonalised advertising (remarketing)
analytics_storagedeniedgrantedAnalyticsAnalytics storage, for example visit duration
functionality_storagedeniedgrantedPreferencesStorage that supports site functions, such as language
personalization_storagedeniedgrantedPreferencesPersonalisation storage, such as recommendations
security_storagegrantedgrantedNecessary (not asked)Security storage: authentication, fraud prevention
2. Call this from your banner
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  // Call applyConsent() when the visitor makes or changes a choice
  window.applyConsent = function (c) {
    gtag('consent', 'update', {
      'ad_storage': c.marketing ? 'granted' : 'denied',
      'ad_user_data': c.marketing ? 'granted' : 'denied',
      'ad_personalization': c.marketing ? 'granted' : 'denied',
      'analytics_storage': c.analytics ? 'granted' : 'denied',
      'functionality_storage': c.preferences ? 'granted' : 'denied',
      'personalization_storage': c.preferences ? 'granted' : 'denied'
    });
  };
  // Example:
  // applyConsent({ analytics: true, marketing: false, preferences: false });
</script>

Call applyConsent({ analytics, marketing, preferences }) when the visitor clicks, and save the choice. The cookie banner generator does both for you.

Notes on this set-up

  • DoneOrder is right: dataLayer and gtag are defined, defaults are set, then gtag.js loads and config runs.
  • NoteDenied defaults apply to 32 region codes; a second default grants everything elsewhere. Google applies the most specific matching region.
  • NoteAdvanced mode: Google tags load at once. While consent is denied they send cookieless pings (timestamp, user agent, referrer, consent state) that Google uses for an advertiser-specific conversion model.
  • Noteads_data_redaction only matters while ad_storage is denied; once granted it has no effect.
  • NoteReturning visitors: the saved choice under “cookie_consent” is re-applied with an update before any tag runs.
  • NoteTest with Google Tag Assistant: the Consent tab shows the default and the update for each type.
Runs entirely in your browser. Nothing you type here is uploaded or stored by TapCub.

Share these inputs: the values go after the # in the link, so they never reach a server.

Version v1.0Updated Update history

Read the result

What each snippet does

Consent Mode does not show a banner. It tells Google tags what the visitor chose, so your banner and the tags work together.

The default snippet

Defines dataLayer and gtag(), then calls gtag('consent', 'default', …) for all seven types. With a region list there are two defaults: denied for the listed regions, granted for everyone else.

The update call

gtag('consent', 'update', …) maps your banner’s three categories to six consent types. Marketing controls ad_storage, ad_user_data and ad_personalization together; analytics controls analytics_storage.

The parameter table

Shows the default for each type, the value outside your regions, the banner category that changes it, and Google’s definition in one line.

The notes

Flag a wrong tag ID, an invalid region code, a short wait, and what basic or advanced mode means for the data Google receives.

Granted or denied is about storage and data use, not whether a tag exists. In advanced mode, Google tags still send cookieless pings while denied; if you want nothing sent before consent, choose basic mode.

How to use it

Four steps

Fifteen minutes, including the check in Tag Assistant.

  1. 1

    Choose set-up and mode

    Pick gtag.js or Tag Manager and enter your tag ID. Pick advanced if you want Google’s conversion modelling for visitors who decline; basic if nothing should reach Google before consent.

  2. 2

    Set where consent is required

    The EEA, UK and Switzerland preset covers the usual case. Use a custom list for specific countries or states (ISO 3166-2, such as US-CA).

  3. 3

    Paste the snippets

    The default snippet goes at the very top of <head> on every page, before the Google tag or container. Hook the update call to your banner’s buttons, or use our cookie banner, which already calls it.

  4. 4

    Verify

    Open Tag Assistant, load the page and check the Consent tab: defaults on page load, then an update after you click. Repeat in a private window for a returning-visitor test.

Basic vs advanced

Two ways to implement Consent Mode

Google describes both modes; which one fits depends on your legal advice and how much modelling you want. Summary of Google’s help article on consent mode (checked 10 November 2026):

  • Basic: Google tags are blocked until the visitor interacts with the banner. If they decline, nothing is sent to Google, not even the consent state. Conversion modelling uses a general model
  • Advanced: Google tags load immediately with denied defaults. While denied, they send cookieless pings with functional information (timestamp, user agent, referrer) and coarse flags. Modelling is advertiser-specific
  • For visitors in the EEA, Google asks advertisers who use its tags for measurement, ad personalisation or remarketing to collect consent and pass it through consent mode, including ad_user_data and ad_personalization
  • Order: the default command must run before any config or event command. Updates should be sent as soon as the visitor chooses and on every later page
Basic and advanced consent mode compared
BasicAdvanced
Tag loadingBlocked until the visitor interactsLoads with defaults set to denied
Before consentNo data sent, not even the default stateConsent state and cookieless pings
After consent grantedTags load and run normallyCookies set, full measurement sent
If consent deniedNothing sentCookieless pings only
Conversion modellingGeneral modelAdvertiser-specific model
In this generatorgtag.js loaded by loadGoogleTag() after Acceptgtag.js in the page, wait_for_update set
Worked example

One visitor, three page views

A visitor from Germany on a GA4 site with the default settings: advanced mode, EEA/UK/CH region list, restore on.

Consent state across visits
MomentWhat runsanalytics_storagead_storage
First page viewRegion default for DEdenieddenied
Clicks “Analytics only” in the bannerapplyConsent({ analytics: true }) → updategranteddenied
Next page viewDefaults, then restore reads cookie_consent and updatesgranteddenied
A visitor from CanadaThe unscoped default (not in the list)grantedgranted

Whether granting by default outside Europe is right for you is a legal question, not a technical one. Laws such as California’s CCPA work on opt-out for selling or sharing data; choose “Every visitor” if you want the stricter default everywhere.

Common mistakes

Where Consent Mode set-ups break

Almost every problem is about order or about a missing update.

Defaults after the Google tag

If gtag('consent', 'default') runs after config, Google says the defaults do not work. Put the snippet first in <head>.

Update only on the click page

Without a stored choice re-applied on later pages, returning visitors are treated as denied again. Keep “Re-apply a saved choice” on.

Only the v1 parameters

Setting ad_storage and analytics_storage but not ad_user_data and ad_personalization leaves the v2 signals unset. The generator always writes all seven.

Wrong region codes

UK is not an ISO code (use GB), and EU is not a region code at all. The tool flags codes it does not recognise.

FAQ

Consent Mode questions

Still have a question?

Chat with the team behind TapCub — we usually reply within a few hours on business days.

What is new in Consent Mode v2?

Two consent types: ad_user_data (sending user data to Google for advertising) and ad_personalization (personalised advertising). Together with ad_storage, analytics_storage and the three other storage types, that makes seven. Google’s EEA guidance asks advertisers to pass end-user consent for EEA visitors through consent mode.

Is Consent Mode a cookie banner?

No. Google says consent mode does not provide a banner; it receives the choice from your banner and adjusts how Google tags behave. You still need a banner or consent platform. Our cookie banner generator produces one that already calls the update.

Basic or advanced consent mode: which should I use?

Basic sends nothing to Google until the visitor accepts. Advanced loads tags at once and sends cookieless pings while consent is denied, which lets Google model conversions for your account specifically. Google leaves the choice to you; the deciding factor is usually your legal advice on whether those pings are acceptable.

Where does the consent default code go?

At the very top of <head>, before the Google tag or the Tag Manager container. Google’s guide is explicit that consent defaults do not work if they are called out of order, after config or event commands.

What does wait_for_update do?

It tells tags how many milliseconds to wait for an update before sending data. It gives your banner time to report a saved choice on page load. Google’s Tag Manager documentation suggests at least 500 ms.

How do I set Consent Mode in Google Tag Manager?

Either paste the default snippet before the container (Google’s Tag Manager example does this), or use a consent template that sets defaults on the Consent Initialization – All Pages trigger. Templates should use setDefaultConsentState and updateConsentState rather than gtag('consent', …).

What are url_passthrough and ads_data_redaction?

url_passthrough passes ad click and session information through URL parameters (such as gclid, _gl, wbraid) when cookies are denied. ads_data_redaction removes ad click identifiers from Google Ads and Floodlight requests while ad_storage is denied; it has no effect once ad_storage is granted.

Which region codes can I use?

ISO 3166-2 codes: a country such as DE or a subdivision such as US-CA. The most specific match wins, and a default without a region applies to everyone not covered by another default.

Changelog

Update history

New features, fixes and data refreshes for this tool, newest first.

  1. · v1.0

    LaunchedFirst release.

Data this tool relies on

  • Google Consent Mode documentation — checked 2026-11-10, reviewed every 6 months (next review by 2027-05-10)

Missing something or found an error? Tell us — requests that come up often go into the next update. All tool updates

See your data clearly. Find your growth.

Every click, backed by data. Install one line of code and see your first numbers in a minute.

No credit card · Free plans for analytics and chat · Cookieless analytics