The consent mode checklist

If you use Google Analytics or Google Ads, you've probably heard about Consent Mode. This checklist walks through setting it up so you can keep useful data while respecting visitors' choices.

This is practical guidance, not legal advice. Privacy rules vary by place and by industry, so confirm your obligations with a qualified professional.

What Consent Mode does

Consent Mode lets your Google tags adjust their behavior based on what each visitor agreed to. If someone declines, the tags respect that and stop storing cookies for the purposes they declined. Where Google's conditions are met, it can also fill some of the resulting gaps with modeled data.

It works together with a consent banner. It doesn't replace one.

The checklist

Before you start

• List what you track and why. Analytics? Advertising? Remarketing? Each purpose needs its own consent decision.
• Know where your visitors are. Requirements differ by region, so decide which rules you're designing for.
• Check that your privacy policy matches reality. It should describe what you actually collect and why.

Choose and configure a consent banner

• Use a consent management platform (CMP) that supports Google Consent Mode. Many are certified by Google.
• Give people a real choice. Accept and decline should be equally easy, and visitors should be able to change their mind later.
• Explain each purpose in plain language, without legal jargon.

Set the right defaults

• Default to "denied" for the consent types that need permission, before the banner is answered.
• Know the four signals Consent Mode uses: ad_storage, analytics_storage, ad_user_data and ad_personalization.
• Send an update the moment a visitor makes a choice, so tags change behavior straight away.

Check your tags

• Confirm Google tags honor the consent state. GA4 and Google Ads do this natively. Other vendors may need their own consent checks in Google Tag Manager.
• Make sure nothing fires before consent that shouldn't, including tags added by plugins or developers.

Test it properly

• Test every path. Accept everything, decline everything, and a mix. Do it in a private window each time.
• Use Tag Assistant or Tag Manager preview to see consent states change as you click.
• Check the browser's network requests. Declined consent should mean no storage and only the limited, cookieless signals.

Keep it healthy

• Re-test after every site change, plugin update or new tracking tag.
• Review it a couple of times a year, because rules and tools both change.
• Keep a record of how it's configured and who owns it.

Common mistakes

• A banner that looks right but doesn't actually control the tags
• Tags that load before the visitor has answered
• Different pages or subdomains with different (or missing) banners
• A consent choice that can't be changed later

If you'd like someone to check your setup, let's talk. We'll test it the way a visitor would and tell you plainly what we find.