Consent Mode v2 explained: what Google learns before consent
Basics
You reject all cookies on a website – and requests to Google still show up in your browser's network tab. This is exactly where Consent Mode begins: Google's answer to the question of how tags should behave when consent is missing. Since March 2024, Google has required version 2 in the European Economic Area whenever advertising features are involved.
What actually gets transmitted comes down to a single setup decision: Basic or Advanced. The difference is bigger than the two names suggest.
A signal, not a switch
Consent Mode is, first of all, just an interface between your consent banner and Google's tags. The banner sets four signals to either granted or denied: analytics_storage and ad_storage have been around from the start, while ad_user_data and ad_personalization arrived with version 2. The tags read these signals and adapt their behaviour.
Just as important is what Consent Mode is not: not a consent banner, not a legal basis, and not a blocker. It merely tells Google what the tags should respect – how strictly that happens depends on the mode.
Basic: nothing loads without consent
In Basic mode, Google tags are only loaded after consent has been given. Before that, not a single request goes out to Google – no data, no cookies, no modelling either. If someone rejects, that's the end of it.
From a privacy perspective this is the clearest state; from a measurement perspective it is the most incomplete: visitors who reject simply never appear in your statistics.
Advanced: pings without cookies
In Advanced mode, Google tags load immediately – before any consent. Without consent they neither set nor read cookies, but they do send so-called cookieless pings to Google. Among other things, these contain:
- The consent state itself, granted or denied per signal
- The page being viewed, including its referrer
- A timestamp plus coarse browser and device information – and, as the sender, inevitably your IP address
- A random number per page view that does not allow recognition across pages
Google uses these pings to model missing data in Google Analytics 4 and Google Ads: the behaviour of those who reject is extrapolated from the behaviour of those who consent. Your reports look more complete – none of it is actually measured.
Where technology turns into a legal question
Even a ping without a cookie is a request to Google's servers, IP address included. Germany's § 25 TDDDG governs storing and accessing information on the end device – without a cookie it may not be triggered at all. The transmission itself, however, is data processing under the GDPR, and supervisory authorities do not agree on whether it can happen before consent.
This is the point where the choice between Basic and Advanced should not be left to the marketing team alone: what gets transmitted is something you can measure – whether that is acceptable for your website is something to settle with your privacy counsel.
How to find out what your website does
Open your website in a private window, then the developer tools (network tab), and filter for google. Reload the page without touching the banner: every request that already fires happens before any consent. Then reject once and keep watching the tab – if requests with gcs= or gcd= parameters keep appearing, your setup is running in Advanced mode.
No. Consent Mode merely translates the decision made in your banner into signals for Google's tags. Without a banner there is nothing to translate – and certainly no consent.
In the network tab of your developer tools: if requests to Google go out before any banner interaction, typically carrying gcs= or gcd= parameters, you are running Advanced. With Basic, nothing happens until consent is given.
Yes – visitors who reject appear neither in reports nor in models. Advanced mode estimates that gap from the cookieless pings. In neither case are they actually measured.
That is precisely the legal question from the article: without a cookie, Germany's § 25 TDDDG may not be triggered, but the GDPR question about the transmission remains – and supervisory authorities do not assess it uniformly. A reliable answer comes from your privacy counsel, not from a blog article.
In writing, not gut feeling
The Cookienator visits your website like a real visitor – before consent, after rejecting, after accepting – and shows you exactly which requests go out in each phase.
Scan your website now