Consent mode is a way to tell Google tags what a visitor has agreed to, so the tags adjust how they collect data. It does not store the visitor's choice, decide the correct values for you, or block other vendors' tags. Those jobs belong to your consent banner and your tag setup.
Definitions
Consent management platform (CMP): the banner and preferences tool where visitors make a choice.
Consent mode: Google's mechanism for passing that choice to Google tags, as described in Google's developer documentation.
Default and update: two calls. A default call sets the starting state before the visitor chooses. An update call sends the new state after they act.
What it does
According to Google's guide, consent mode lets you control data collection based on user consent for advertising and analytics purposes. You set a default for each consent type with gtag('consent', 'default', ...). When the visitor interacts with your banner, you send gtag('consent', 'update', ...). Google tags then adjust their behavior. For example, when ad_storage is denied, new cookies will not be set for advertising purposes.
What it does not do
| Common assumption | What the documentation says |
|---|---|
| It remembers the choice | It does not. You must persist the choice, for example in a first party cookie or local storage |
| It knows the right values | It does not. You must make sure the correct values are set for every consent type |
| It blocks tags | The page describes Google tags adjusting behavior, and does not say it blocks tags outright |
| It hides the page URL | Data sent to Google still includes the full page URL |
| Order does not matter | If the consent code runs out of order, defaults will not work |
The last two matter to security and privacy reviewers. A page URL can carry identifiers, so removing sensitive parameters at the source still matters. See personal data in URLs sent to analytics.
Steps to set it up sensibly
- Decide which consent types you will use and what each default should be.
- Run the default call on every page before any config or event commands.
- Wire your CMP to send the update call as soon as the visitor acts.
- Persist the choice and replay it on later page loads.
- Test with a fresh browser profile in each state: no choice, accepted, rejected.
- Separately check non Google tags. Consent mode will not govern them, so they need their own conditions.
The gap teams miss
Many teams assume that configuring consent mode means no tracking before consent. The documentation does not promise that. It describes Google tags changing how they store data. Third party pixels from other vendors need their own blocking or trigger conditions in your tag manager. A test with the browser network panel is the only way to know. Does your cookie banner actually block tags gives a method.
This is not legal advice. Which consent is needed, and when, depends on your law and facts, so involve your privacy counsel.
Quick check
Does consent mode save the visitor's choice?
No. Google's guide says you should persist it yourself and update the status as soon as the visitor interacts.
Does it stop all trackers on the page?
No. It addresses Google tags. Other vendors need their own controls.
Where Safeguard fits
Safeguard's compliance and evidence automation can help you keep dated records of controls and reviews. It does not run consent banners. You can try a free scan on your repositories.
Sources
Last reviewed: 19 October 2026.
