Google Consent Mode v2 and consent

Consent Mode v2 has been required since March 2024 for Google Ads and GA4 to keep processing data from the EU. It is often understood as replacing the consent banner. It does not.

Is this a risk?

Consent Mode v2 is only the technical interface that passes the decision from the banner (consent or rejection) on to Google. Consent itself still has to be obtained via a consent tool; access to the device for analysis and advertising remains subject to consent under Section 25(1) TDDDG. In “advanced” mode, the Google tag loads before the decision and sends cookieless signals — without a working banner there is no legal basis for this. If the banner is missing entirely or the tag fires despite a rejection with cookies, the integration is vulnerable.

What you can do

• Use a consent tool (CMP) that sets the signals ad_storage, analytics_storage, ad_user_data and ad_personalization and only lets the tag run with cookies after active consent.
• Choose “basic” mode if no request should go to Google at all before consent — then the tag only loads after consent.
• Name Google in the privacy policy as recipient, together with purpose, legal basis (consent), storage period and the US transfer.
• Check in a private window: does anything from googletagmanager.com or google-analytics.com load with cookies set before the click on “Accept”?

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.