Consent Mode v2: What the Four Signals Actually Do
Consent Mode v2 is four switches, not one. Most sites set them as a bundle and never learn what each one controls, which is why the analytics look fine while the ads stop working, or the ads work while the measurement quietly goes blind. The four signals are ad_storage, analytics_storage, ad_user_data, and ad_personalization, and they do different jobs.
Google made Consent Mode v2 mandatory in March 2024 for any site using Google Ads or Google Analytics in the EEA. A CMP that only sends two of the four signals leaves the other two at their defaults, and the default is denied. That is the most common configuration mistake in the field: the banner works, the CMP is certified, and half the signals never arrive.
What each signal gates
ad_storage controls whether advertising cookies can be written. analytics_storage controls whether analytics cookies can be written. Those two are the old pair, and most teams know them. The two that get missed are ad_user_data, which controls whether personal data can be sent to Google for advertising purposes, and ad_personalization, which controls whether that data can be used to personalize ads. A visitor can allow ad_storage and deny ad_personalization, and the site will run ads without building a profile from them. Treating the four as one switch throws that distinction away.
The practical split shows up in the numbers. Deny analytics_storage and Google Analytics stops writing cookies, but in advanced mode it still sends cookieless pings that Google models into aggregate estimates. Deny ad_user_data and the data never leaves for advertising at all, so there is nothing to model. Teams that read a modelled recovery as real traffic are reading the ping, not the person.
Basic mode hides the problem
In basic mode, denied means blocked: no tags fire, nothing is sent. In advanced mode, denied means modelled: tags fire without identifiers and Google fills the gaps statistically. Advanced mode recovers measurement, which is why vendors push it, but it also means your consent choice is doing two different things depending on a setting most site owners never see. If you cannot say which mode you run, you cannot say what a denial means on your site.
The check is simple and nobody runs it. Open your own site, reject everything, and watch the network tab for googletagmanager and google-analytics requests. Then check the consent state your CMP reports for each of the four signals. If the CMP says denied and the requests still carry identifiers, the wiring is wrong. If the CMP says granted and nothing fires, the tag configuration is wrong. Either way the banner is not the problem; the plumbing after it is.
The one-line version
Four signals, four jobs, and a mode setting that changes what denial means. Get the mapping right before you argue about accept rates, because an accept rate measured on a broken mapping is a number about your configuration, not your visitors.
Keep reading: Consent Mode v2 and Server-Side Tagging: What Changes When the Tag Moves, Where Your CMP Script Sits in the Head, and Why It Matters, and Cookie Banner Dark Patterns: The Designs That Draw Fines cover the nearby cases in this series.
Frequently asked questions
What are the four Consent Mode v2 signals?
ad_storage for advertising cookies, analytics_storage for analytics cookies, ad_user_data for sending personal data to Google for advertising, and ad_personalization for using that data to personalize ads. Each can be granted or denied independently.
When did Consent Mode v2 become mandatory?
Google required it from March 2024 for sites in the EEA using Google Ads or Google Analytics. A CMP has to signal all four consent states to Google tags for measurement and advertising to work as configured.
What is the difference between basic and advanced mode?
In basic mode a denial blocks the tag entirely. In advanced mode the tag still fires without identifiers and Google models the missing data statistically. The same denial means two different things depending on the mode.
How do I check my four signals are wired correctly?
Reject everything on your own site, then watch the network tab for Google requests and compare them with the consent state your CMP reports. Requests carrying identifiers after a denial mean the wiring is wrong.