GA4 and Consent Mode v2: Complete Implementation and Audit Guide

The 2024 deadline is historical context, not a new upgrade today.

Universal Analytics has already been replaced by GA4 and the additional Consent Mode v2 signals are no longer a new requirement. The useful question today is not whether code was installed once, but whether the current website, CMP, Google Tag Manager, GA4 and Google Ads remain correctly connected after changes to the theme, plugins, checkout and campaigns.

What is Google Consent Mode v2?

Consent Mode adjusts Google tag behaviour according to consent state. Google’s official Consent Mode overview distinguishes basic and advanced implementations. In both cases, the user’s choice must come from an appropriate consent interface or CMP.

What does Consent Mode not do?

• It does not display or design the cookie banner.
• It does not decide legal basis or compliant consent wording.
• It does not repair incorrect GA4 events or duplicate installations.
• It does not guarantee complete data recovery through modelling.
• It does not automatically govern every non-Google script, pixel or embed.

The four primary consent signals need explicit mapping.

The final two were added for Consent Mode v2. A CMP category label is not evidence of correct behaviour; you need to verify which signal it updates and which tags follow that choice.

Basic or advanced consent mode: what is the real difference?

Point	Basic	Advanced
Before a choice	Relevant Google tags are blocked.	Tags load with a default denied state.
Pre-consent communication	No data is sent to Google.	Cookieless measurements/consent pings may be sent.
Modelling	More limited input for modelling.	Potentially richer modelling where eligible.
Decision	Depends on technical, commercial and legal assessment — not a universal recipe.

CMP, banner, Consent Mode, GTM and GA4 have different jobs.

1. The CMP displays choices, records the decision and supports withdrawal or change.
2. Consent Mode communicates status to Google tags.
3. GTM or the Google tag applies the correct order and activation rules.
4. GA4 and Google Ads receive permitted signals and events.
5. The business and its legal counsel/DPO define legal basis, policies and retention.

Default consent must be set before measurement commands.

Google’s implementation guide requires the default state to be set before commands that send measurement data and updated when the user interacts with the consent interface. If default arrives late, tags may have already executed. If update never arrives, accepting the banner does not change measurement behaviour.

GTM template, Custom HTML or gtag: the method changes, the logic does not.

In Google Tag Manager, a CMP template with proper Consent API support and Consent Initialization is generally preferred. A hardcoded implementation uses the Google tag API. Custom HTML solutions require extra care with execution order. We do not mix plugin, theme and GTM installations without an inventory because this commonly produces duplicate pageviews and conversions.

GA4 needs an event plan, not only page_view.

Before implementation, document the actions that are meaningful business signals: form submission, phone lead, registration, product view, add to cart, checkout and purchase. Every event needs a clear trigger, parameters, consent behaviour and acceptance test. Seeing GA4 load does not prove that it measures correctly.

Google Ads conversions and GA4 key events are not always the same thing.

Check which conversions are imported from GA4, which use a Google Ads tag, which participate in bidding and which remain observational. Attribution windows, duplicate counting, enhanced conversions and cross-domain journeys need separate documentation. Consent configuration cannot repair a flawed conversion architecture.

For eCommerce, verification must follow a real order from start to finish.

In WooCommerce, OpenCart or custom commerce, verify product views, cart, coupons, checkout steps, payment redirects, thank-you pages, currency, tax, shipping and order-ID deduplication. Test acceptance, refusal and changed choices. Off-domain payments require cross-domain and referral review so the purchase is not attributed to the wrong source.

Verification happens in the browser and the platforms, not by assumption.

• Tag Assistant: consent state before and after the choice.
• Network requests: endpoints and parameters that actually appear.
• GTM Preview: event order, consent initialization and tag firing.
• GA4 DebugView/Realtime: event names, parameters and duplicates.
• Google Ads diagnostics: conversions, enhanced conversions and consent status.
• CMP records: categories, versioning, withdrawal and regional behaviour.

Google provides separate guidance to verify a Consent Mode implementation and review consent checks in Analytics.

Consent diagnostics are a signal, not a complete acceptance test.

A green status does not prove that every page, region, device and checkout journey behaves correctly. Combine diagnostics with a recorded matrix covering denied, granted, partial choice, withdrawal and returning visitors.

The most common failures involve order, duplication and incorrect mapping.

• Default consent is set after GA4 configuration.
• The banner changes visually but sends no consent update.
• GA4 is installed through both a plugin and GTM.
• All advertising signals are attached to one generic category without verification.
• Custom scripts ignore the CMP choice.
• Tags fire on page view instead of the correct consent condition.
• SPA route changes produce inconsistent virtual pageviews.
• Testing is performed only as a returning visitor who has already accepted.

Conversion modelling has limits and eligibility requirements.

Advanced mode may provide more consent-aware signals for modelling, but it does not mean every missing conversion is reconstructed or reports become absolute truth. Volume, eligibility, implementation quality and platform logic affect the result. Compare modelled data with CRM records, orders and actual business outcomes.

Technical implementation does not replace privacy governance.

Document vendors, purposes, data flows, retention, account ownership and withdrawal. The business and its legal counsel or DPO decide which tags are permitted, in which regions and under which legal basis. We do not present Consent Mode as a “GDPR button” or use generic fine threats as marketing.

When should the implementation be audited again?

After a change to the CMP, theme, plugin, GTM container, domain, checkout, payment provider, app/SPA, server-side tagging, Google Ads strategy or major redesign. Also investigate abrupt changes in conversions, direct traffic, attributed revenue or consent rates without a matching business explanation.

A useful audit delivers evidence and account ownership.

Firstidea documents a current-state diagram, tag inventory, CMP mapping, event/conversion matrix, test cases, findings, priorities and retest. GA4, GTM, Google Ads and CMP accounts remain client-owned. Where relevant, the audit connects to Digital Marketing, Google Ads, Website Optimization or technical takeover of an existing system.

Checklist before implementation is considered complete.

• Documented tags, owners and purposes.
• Default state before measurement commands.
• Correct update for acceptance, refusal and partial choice.
• All four consent signals verified.
• No duplicate GA4 or Ads tags.
• Event and conversion matrix with expected values.
• eCommerce purchase deduplication and cross-domain test.
• Tag Assistant, DebugView and platform diagnostics.
• Region, mobile, incognito and returning-user tests.
• Documented rollback and review date.

Frequently asked questions about GA4 and Consent Mode v2.

Do I need Consent Mode v2 if I do not run Google Ads?

It depends on the Google tags in use, processing purposes, region and legal assessment. Do not decide solely from whether a campaign is active.

Does Consent Mode replace the cookie banner?

No. The CMP/banner asks for and records a choice; Consent Mode communicates status to Google tags.

What are the four v2 signals?

analytics_storage, ad_storage, ad_user_data and ad_personalization.

Should every website use advanced mode?

No. Basic versus advanced requires technical, commercial and legal assessment.

Why does the banner look correct while tags fire too early?

Default consent often executes late, or a second tag installation exists outside CMP control.

Can a plugin handle the whole implementation?

A plugin may help, but mapping, order and actual network requests still require verification. Activation is not an acceptance test.

How do I verify that it works?

Use Tag Assistant/GTM Preview, network inspection, GA4 DebugView, Google Ads diagnostics and a test matrix for different consent choices.

Does modelling replace all missing data?

No. It has eligibility and quality limits. Comparison with CRM, orders and actual outcomes remains necessary.

What changes for WooCommerce or OpenCart?

You need a complete eCommerce event test, order deduplication, payment/cross-domain review and confirmation that plugins do not create duplicate tags.

Is server-side tagging required?

Not for every project. It is a separate architecture decision and does not bypass consent or privacy requirements.

When should the audit be repeated?

After material CMP, theme, checkout, tag, domain or campaign changes, and periodically according to the change log.

Does Firstidea provide legal certification?

No. We provide technical audit and implementation evidence. Legal basis, policies and regulatory interpretation belong to the business’s legal counsel or DPO.