What is Google Consent Mode
Google Consent Mode is a mechanism by which Google tags on a site learn the visitor's consent choices and adjust their behaviour. Shopify's documentation puts the v2 rule plainly: event data sent to Google from visitors in the European Economic Area is not used for personalized advertising unless Consent Mode v2 is active and valid consent has been obtained.
The signal is set through the gtag consent call. Shopify's Google Tag Manager custom-pixel tutorial shows the four v2 parameters in one update: ad_storage, analytics_storage, ad_user_data and ad_personalization, each granted or denied.
What the signal does, and does not do
When consent is denied, Google tags can still send requests. The requests carry the denied state and set no cookies. It is the fact most often missed in a cookie compliance review, because a scanner that looks for cookies finds none and reports success.
We measured it. On one national retailer's site, with analytics consent refused and the consent string reading essential-only, every GA4 request on the page carried gcs=G100. The tag manager's consent mode marked them denied, and they still reached Google as cookieless pings: seven requests on one page, page view, search, view search results, an ad impression and three unnamed events, all through the retailer's own tag-manager proxy to the retailer's own property. Consent mode did what it is built to do. The visitor's "no" did not stop the requests. It labelled them.
On the same site, the tag-management rules that gate marketing tags by consent category did stop their tags: with Targeting refused, zero Google conversion or remarketing calls fired. Two different mechanisms, two different results, on one page. A gate stops the request. Consent mode labels it.
Consent mode analytics: what "consented users" means in your data
GA4 consent mode has a second consequence for anyone reading the data. If your history was collected with consent mode signalling denied for most visitors, the property holds cookieless pings for them. If your history was collected with consent mode signalling granted for everyone because the notice never offered a choice, the consent dimension is a constant.
The retailer's notice offered one privacy policy link and one close button, no accept, no reject, no manage; the consent platform ran an opt-out model with every category active before any interaction. The only control that turned a category off sat three pages away, below a newsletter form. An AI asked "how did consented visitors convert" on that data answers from a field that never varied. It has no way to know that. The grading rubric on /how-we-grade calls that answer "answered when it should have refused".
How to check if consent mode is enabled
Three checks, from the outside in. No login needed for the first two.
- Watch the network.Open the site on a fresh profile, refuse in the notice, and look at requests to Google's collect endpoint. A gcs parameter on the request means consent mode is signalling; G100 is the denied state we observed under refusal.
- Check the frames.The retailer's checkout was a shell document with four child frames, and the analytics stack ran inside one of them; a reading in the top window saw none of it. A consent check that stops at the top window can pass a page that fails.
- Read the container.The consent initialization and the consent update should be visible in the tag container or, on Shopify, inside the custom pixel where Shopify documents the snippet must be placed. The default state, the update on choice, and which tags are gated by which category are all readable there.
Consent mode v2 implementation: two things the audit looks for
- Default before choice. What the tags signal between page load and the visitor's click. A default of granted for everyone is the constant-field problem above.
- Gate plus signal, or signal alone. Whether the tags that should not fire without consent are actually stopped by a gate, or only labelled by consent mode. On the retailer's site, 279 of 280 tag rules in the analytics container carried no gate at all. That number is the difference between "we implemented consent mode" and "our data respects consent".
The full per-state measurement is the cookie audit on /cookie-audit. The variable that carries the consent state into the container usually lives in the data layer; see /data-layer. The site-wide measurement is on /tracking-audit; the engagement is on /answer-audit.