Consent Mode v2: what does it actually do, and who is responsible for the legal side?

Consent Mode is a way of telling Google's tags what the visitor agreed to, so the tags behave accordingly. It does not decide what the law requires and it does not make you compliant. The responsibility for getting consent properly and for what you do with the data stays with you, so this is a question for your own legal adviser, not a tag setting.

Here is the mechanical part. Consent Mode v2 uses four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization. Your banner sets each to granted or denied. Google's tags read them and change what they collect and send. When the visitor has not agreed, tags can still send limited, cookieless signals in some modes, and Google may use modelling to estimate what is missing.

There are two common ways to run it, usually called basic and advanced. In basic mode, tags do not load until the visitor chooses. In advanced mode, tags load with everything denied and update when the visitor chooses. Advanced gives Google more signals to model from, and it is also the one that needs careful setup. Check Google's current documentation for what each mode sends, because the details change.

Order matters. The default state has to be set before any Google tag fires, which means the consent code needs to load first. If the tag manager loads before the defaults are set, the first page view can be sent with the wrong state, and fixing it later does not undo that.

The legal side is not in the code. Whether you need an opt-in, in which regions, what wording the banner must use, how long you can keep the choice, and what you may do with the data are decisions about your situation. A consent platform can record and enforce a choice. It cannot choose the basis for you.

What you can check yourself is whether the setup does what you intend. Decline everything on a test visit and watch the network requests: ad and analytics cookies should not be set, and the consent signals should show denied. Then accept and confirm they change to granted. Repeat on mobile and on a returning visit.

A made-up example, invented for illustration: a shop sets up a banner, accepts all by default after five seconds, and finds that most visitors 'consent' without clicking. That setup records consent that nobody gave and is the kind of thing that creates legal risk. The banner needs the visitor's own action.

DataCops includes a TCF 2.2 consent banner served from your own domain with Google Consent Mode v2 on by default: all four signals start denied and update when the visitor chooses, and DataCops checks the choice again on the server and skips web events marked as declined. It does not make you compliant. If you keep your own banner, set Consent Mode up there and in your Google tag.

Do you currently run basic or advanced mode, or are you not sure which one your banner uses?