Consent Mode v2 and GDPR: what a webshop may send

Consent Mode v2 is Google's way for a website to tell its Google tags whether a visitor agreed to cookies and to the use of their data for ads. It uses four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization. It does not ask for consent itself. Your cookie banner asks, and Consent Mode passes the answer on to Google.

This guide explains the four signals, basic and advanced Consent Mode, what EU law asks of a webshop at a high level, how server-side tracking fits in, and how ROASaurus handles consent.

What is Consent Mode v2?

Consent Mode is a Google feature for websites and apps. The site sets a default consent state for each visitor, usually denied, and updates it when the visitor answers the cookie banner. Google tags read that state and change their behavior. With consent, they work normally. Without consent, they do not read or write advertising cookies, and they send limited data or nothing, depending on your setup.

Version 2 added two signals, ad_user_data and ad_personalization. Google introduced them while it strengthened the enforcement of its EU user consent policy. For visitors in the European Economic Area (EEA), advertisers who want to use ad personalization and measurement must collect consent and share the consent signals with Google. The policy itself covers visitors in the EEA, the UK and Switzerland.

The four consent signals

A cookie banner maps its own categories to these signals. A common mapping is: the marketing or advertising category sets ad_storage, ad_user_data and ad_personalization, and the analytics or statistics category sets analytics_storage. Check how your consent tool does this, because one mapping error sends the wrong answer to every Google tag on your site.

Basic and advanced Consent Mode

Google offers two ways to implement Consent Mode. The difference is what happens before and without consent.

Technically, Consent Mode works with two commands. The default command sets the consent state before any Google tag sends data. The update command changes it when the visitor answers the banner.

// On every page, before any Google tag sends data:
gtag('consent', 'default', {
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  analytics_storage: 'denied'
});

// When the visitor accepts marketing and analytics cookies:
gtag('consent', 'update', {
  ad_storage: 'granted',
  ad_user_data: 'granted',
  ad_personalization: 'granted',
  analytics_storage: 'granted'
});

Consent management platforms usually send these commands for you. Check that they do, and that they send the update on every page after the visitor has answered, not only on the page where the banner was shown.

What EU law asks of a webshop

Two EU laws matter most for ad tracking, and Google adds its own policy on top. This is a summary at a high level.

The ePrivacy rules on cookies

The ePrivacy Directive covers storing information on a visitor's device, such as cookies, and reading it back. Cookies that are strictly necessary for a service the visitor asked for, such as the shopping cart or a login, do not need consent. Tracking cookies for advertising do. According to the EU's guidance for businesses, consent comes first: such cookies cannot be set when the page first opens. Consent should be given per purpose, and withdrawing it must be as easy as giving it.

The GDPR on personal data

The GDPR applies to every use of personal data, such as an email address, a phone number or the details of an order. Each use needs one of six legal bases, for example consent, a contract or legitimate interests. You may only process the data you need for the purpose. A service that processes personal data for you, such as a tracking tool, needs a written contract with you.

Google's EU user consent policy

If you use Google's ad products, this policy adds a contract duty. For visitors in the EEA, the UK and Switzerland, you must get valid consent for cookies where the law requires it, and for the use of personal data to personalize ads. You must keep records of consent, explain how to withdraw it and clearly name each party that receives the data.

Does server-side tracking need consent?

Server-side tracking changes where an event is sent from: your server instead of the visitor's browser. It does not change what you may send. Two points show why.

First, most server-side setups still start in the browser. A script reads the click id from the landing URL and stores it on the device, so the ePrivacy rules apply to that step. Second, sending a purchase with a hashed email, an IP address or a click id to an ad platform is processing of personal data. It needs a legal basis under the GDPR, whatever route the data takes. Our guide to what server-side tracking is explains the technical side.

Data minimization and hashing

Send what the platform needs to match and count the conversion, not the whole order. Ad platforms ask for personal fields such as email and phone to be normalized and hashed with SHA-256 before they are sent. Hashing protects the raw value on its way to the platform, but it is not anonymization: the platform compares the hash with its own user data to find a match. Treat hashed data as personal data.

What a webshop sends with and without consent

As an example of where one tool draws the line, here is what ROASaurus does on Shopify with Respect visitor consent on, which is the default.

Whether the paid order of a visitor who declined may be sent is a legal question, and the answer can differ per store and per country. ROASaurus sends it by default. If your legal advice says that purchase events also need prior consent, contact ROASaurus before you turn on server-side purchases. Consent and privacy has the details for Shopify and other webshops.

How ROASaurus handles consent and Consent Mode signals

ROASaurus does not set Google Consent Mode signals for your Google tags. It reads the visitor's choice from a different source depending on your webshop:

• On Shopify, the storefront script and the checkout pixels read Shopify's Customer Privacy API, which your cookie banner fills in. The checkout pixel also follows a choice that the shopper changes during checkout. The guide to server-side tracking on Shopify shows how this works step by step.
• On other webshops, the ROASaurus script reads OneTrust, Cookiebot, Usercentrics, Didomi, CookieYes, iubenda, Termly, Complianz, Osano, TrustArc, IAB TCF banners, the consent commands of Google Consent Mode and the WP Consent API. With Google Consent Mode, marketing consent means ad_storage and ad_user_data are granted, and you can map other categories per tool. With another banner, call tlq('consent', true) or tlq('consent', false) when the visitor chooses.
• Google Ads conversions are sent only from the Shopify checkout. ROASaurus loads the Google tag there only for shoppers who allow marketing cookies, but it does not send Consent Mode signals with it.
• From the server, ROASaurus passes the choice on in Google's own consent fields: Google Analytics 4 events carry ad_user_data and ad_personalization, granted for visitors who consented and denied for orders sent as anonymous sales, and lead uploads to Google Ads carry the ad_user_data consent.

Your own Google tags still need Consent Mode. If you run Google Ads or Google Analytics tags on your site, your banner or consent tool has to send the signals to them. If you advertise to visitors in the EEA, check with your consent tool provider or developer whether your full setup, including the Google Ads conversions from checkout, meets Google's requirements for your account.

A consent checklist for webshops

1. Install a cookie banner

   It must block marketing cookies, and analytics cookies where your law requires it, until the visitor agrees. On Shopify, use a banner that writes to the Customer Privacy API.

2. Map the banner to Consent Mode

   Set the four signals to denied by default and update them from the banner, so that your Google tags follow the visitor's choice.

3. Set your tracking tool to respect consent

   In ROASaurus, keep Respect visitor consent on in Store settings. On webshops other than Shopify, check that ROASaurus reads your consent tool, or pass the choice with tlq('consent', …).

4. Decide on server-side purchases

   Ask your legal advisor whether the paid orders of visitors who declined may be sent, and on which legal basis.

5. Update your privacy notice and contracts

   Name each ad platform that receives data, explain how to withdraw consent, and sign a data processing agreement with each processor.

6. Test both answers

   Decline cookies in a private browser window and check in the developer tools that no ad pixel loads and no visitor id cookie is set. Then accept, and check that both appear.

Sources

1. Google for Developers: Consent mode overview
2. Google Ads Help: Updates to consent mode for traffic in European Economic Area (EEA)
3. Google: EU user consent policy
4. Your Europe: Online privacy, how to use cookies on your website
5. Your Europe: Data protection under GDPR

In ROASaurus

• Help: consent and privacy
• Server-side tracking in ROASaurus
• Google Ads integration
• Shopify integration

Keep reading