Skip to content
Pierre Bossetti

Consent Mode v2

GDPR Compliance & Consent Mode v2

Cookie banner killed 30-50% of your traffic data? I build lightweight, open-source consent setups with tarteaucitron.js and Google Consent Mode v2. You stay compliant with GDPR and the Swiss nFADP, and you keep your data.

The data blackout and the false dilemma

You added a cookie banner. A week later, GA4 shows 30% to 50% less traffic. Google Ads sees fewer conversions. Smart Bidding runs on thin data, so your CPA spikes and your ROAS drops. Lost signals starve the algorithm and raise your CAC.

So you face a choice that looks impossible: stay legal and go blind, or keep your data and risk a fine. That is a false dilemma.

The risk is real. Many cosmetic WordPress banner plugins do not block scripts before consent. The banner shows, but GA4 and ad pixels still fire. That is not compliance. Under the Swiss nFADP (nLPD), decision-makers can face personal criminal fines up to 250,000 CHF. In the EU, GDPR fines hit the company.

Here is the way out. Strict compliance is not a penalty. It is a technical opportunity. With Google Consent Mode v2, you respect the visitor's choice and still model the data you can't observe, legally.

Debunking the myths

Myth 1: "If a user refuses, I lose 100% of the data."

Not with Advanced Consent Mode v2. When a visitor denies consent, your tags still load, but they behave differently. They send anonymous, cookieless pings. No user ID. No cookie. Google's AI uses these signals to model the missing conversions. For Google Ads, this can recover up to 70% of the conversion paths you would otherwise lose. Your bidding gets its signal back.

Myth 2: "Any free banner plugin works."

It doesn't. Most free plugins are cosmetic HTML overlays. They show a banner and block nothing. A real CMP acts as an execution firewall. It physically blocks scripts until the visitor gives explicit consent. If your banner does not block, you carry the legal risk and still get the traffic loss.

Myth 3: "Consent banners destroy website speed."

Heavy commercial CMPs like OneTrust do. They load big bundles, trigger layout thrashing and push your INP score up. Slow pages cost you conversions. I use tarteaucitron.js instead. It is open source and lightweight. It runs asynchronously and keeps the main thread free. Your site stays fast and you stay compliant.

The four signals and the technical wiring

Since March 2024, Google requires four consent signals. Each one controls a specific behavior:

  • analytics_storagecontrols GA4 cookies and measurement.
  • ad_storagecontrols advertising cookies for Google Ads and other ad tags.
  • ad_user_datacontrols whether user data can be sent to Google for advertising.
  • ad_personalizationcontrols personalized advertising, such as remarketing.

Watch the last two. If ad_user_data andad_personalization are not set to granted after consent, your Google Ads retargeting lists stop updating right away. Your audiences go stale and your remarketing campaigns quietly stop working.

tarteaucitron.js connects to Google Consent Mode v2 natively. It sets the default state, then updates all four signals from the visitor's choice. No external vendor. No lock-in. No monthly fee. You own the code and you can audit every line.

Preventing race conditions with precision wiring

A race condition happens when a tag runs before the CMP has set the default "denied" state. The tag fires with full permissions. That breaks privacy law, and it corrupts your data, because those hits should never have been collected as granted.

I fix this with two settings:

  • The right trigger. In GTM, the consent default runs on the Consent Initialization - All Pages trigger. It fires before any other tag.
  • A short wait. I setwait_for_update to a value like 500ms. Tags wait that long for the CMP to resolve a returning visitor's saved choice before they fire.

Here is the clean setup. First the default state, then the update after the visitor accepts:

// Default state before user interaction: everything denied
gtag('consent', 'default', {
  analytics_storage: 'denied',
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  wait_for_update: 500
});

// Update state once user gives explicit consent via CMP
gtag('consent', 'update', {
  analytics_storage: 'granted',
  ad_storage: 'granted',
  ad_user_data: 'granted',
  ad_personalization: 'granted'
});

Everything starts as denied. Nothing is stored and nothing is shared. Only when the visitor gives explicit consent through the CMP does the update call switch the signals to granted. A visitor who refuses stays on the default state, and Consent Mode sends the cookieless pings that feed conversion modeling. Compliant by default. Measured by design.