# Consent Mode v2: What the Four Signals Actually Do

Source: https://cookieaegis.com/blog/2026-11-08-consent-mode-v2-four-signals.html

[Home](../index.md) / [Blog](index.md) / Your CMP Script Belongs in the Head, Not at the Bottom of the Page / Consent Mode v2: What the Four Signals Actually Do


Published 2026-11-08

Consent Mode v2 is four switches, not one. Most sites set them as a bundle and never learn what each one controls, which is why the analytics look fine while the ads stop working, or the ads work while the measurement quietly goes blind. The four signals are ad\_storage, analytics\_storage, ad\_user\_data, and ad\_personalization, and they do different jobs.

Google made Consent Mode v2 mandatory in March 2024 for any site using Google Ads or Google Analytics in the EEA. A CMP that only sends two of the four signals leaves the other two at their defaults, and the default is denied. That is the most common configuration mistake in the field: the banner works, the CMP is certified, and half the signals never arrive.

## What each signal gates

ad\_storage controls whether advertising cookies can be written. analytics\_storage controls whether analytics cookies can be written. Those two are the old pair, and most teams know them. The two that get missed are ad\_user\_data, which controls whether personal data can be sent to Google for advertising purposes, and ad\_personalization, which controls whether that data can be used to personalize ads. A visitor can allow ad\_storage and deny ad\_personalization, and the site will run ads without building a profile from them. Treating the four as one switch throws that distinction away.

The practical split shows up in the numbers. Deny analytics\_storage and Google Analytics stops writing cookies, but in advanced mode it still sends cookieless pings that Google models into aggregate estimates. Deny ad\_user\_data and the data never leaves for advertising at all, so there is nothing to model. Teams that read a modelled recovery as real traffic are reading the ping, not the person.

## Basic mode hides the problem

In basic mode, denied means blocked: no tags fire, nothing is sent. In advanced mode, denied means modelled: tags fire without identifiers and Google fills the gaps statistically. Advanced mode recovers measurement, which is why vendors push it, but it also means your consent choice is doing two different things depending on a setting most site owners never see. If you cannot say which mode you run, you cannot say what a denial means on your site.

The check is simple and nobody runs it. Open your own site, reject everything, and watch the network tab for googletagmanager and google-analytics requests. Then check the consent state your CMP reports for each of the four signals. If the CMP says denied and the requests still carry identifiers, the wiring is wrong. If the CMP says granted and nothing fires, the tag configuration is wrong. Either way the banner is not the problem; the plumbing after it is.

## The one-line version

Four signals, four jobs, and a mode setting that changes what denial means. Get the mapping right before you argue about accept rates, because an accept rate measured on a broken mapping is a number about your configuration, not your visitors.

Keep reading: [Consent Mode v2 and Server-Side Tagging: What Changes When the Tag Moves](https://cookieaegis.com/blog/2026-11-07-consent-mode-v2-server-side-tagging.md), [Where Your CMP Script Sits in the Head, and Why It Matters](https://cookieaegis.com/blog/2026-11-06-cmp-script-head-placement.md), and [Cookie Banner Dark Patterns: The Designs That Draw Fines](https://cookieaegis.com/blog/2026-11-07-cookie-banner-dark-patterns-fines.md) cover the nearby cases in this series.

## Frequently asked questions

### What are the four Consent Mode v2 signals?

ad\_storage for advertising cookies, analytics\_storage for analytics cookies, ad\_user\_data for sending personal data to Google for advertising, and ad\_personalization for using that data to personalize ads. Each can be granted or denied independently.

### When did Consent Mode v2 become mandatory?

Google required it from March 2024 for sites in the EEA using Google Ads or Google Analytics. A CMP has to signal all four consent states to Google tags for measurement and advertising to work as configured.

### What is the difference between basic and advanced mode?

In basic mode a denial blocks the tag entirely. In advanced mode the tag still fires without identifiers and Google models the missing data statistically. The same denial means two different things depending on the mode.

### How do I check my four signals are wired correctly?

Reject everything on your own site, then watch the network tab for Google requests and compare them with the consent state your CMP reports. Requests carrying identifiers after a denial mean the wiring is wrong.