Google Consent Mode v2 and GTM tag gating for DPDP
We set up Google Tag Manager on websites that serve people in India, so Google Analytics, ads and other tags wait for the visitor's choice. Then we test every choice and record what fires.
- Part of Implementation, from ₹39,999
- Tested in four states
Written by Shuruthi Sellamuthu. Last reviewed .
What are tag gating and Consent Mode v2?
Tag gating means no analytics or advertising tag fires until the visitor says yes to that purpose. Google Consent Mode v2 is how Google's own tags read that choice, through four consent signals. We set up both in Google Tag Manager and test them.
Under the DPDP Act, 2023, consent comes before the data is used and can be withdrawn (Act Sections 6(1) and 6(4)). The Act does not name any tool.
How tag gating works
A banner that only looks right is the common failure: the visitor sees a choice, but the tags have already fired. Tag gating fixes the part behind the banner.
Without gating: tags load with the page, whatever the visitor clicks.
With gating: each tag waits for a yes to its own purpose.
What we see in practice
We often find a banner that was never connected to Google Tag Manager, so the tags fire before any choice. We see Reject do nothing: after Accept and then Reject, tags keep firing or cookies stay. And we find hard-coded scripts, such as a pixel or chat widget pasted into the theme or a plugin, that bypass Google Tag Manager.
-
The default is denied
Before the visitor chooses, every consent type starts at denied. Only strictly necessary cookies are on.
-
Every tag is tied to a consent type
In Google Tag Manager, each tag is set to wait for the matching consent type: analytics tags for analytics, ad tags for marketing. No consent, no tag.
-
Hard-coded scripts move into Google Tag Manager
A script pasted straight into the website code ignores the banner. We list those scripts and move them into Google Tag Manager, so they follow the same rules.
How Google Consent Mode v2 works
It is Google's way of passing the visitor's banner choice to Google tags. The choice travels as four consent signals. Each one is either granted or denied, and Google Analytics and Google Ads tags change how they behave to match. Version 2 added the last two signals.
| Consent signal | Banner choice it usually follows | What it controls |
|---|---|---|
analytics_storage | Analytics | Whether analytics cookies, such as the Google Analytics cookies, can be stored and read. |
ad_storage | Marketing | Whether advertising cookies can be stored and read. |
ad_user_data | Marketing | Whether visitor data can be sent to Google for advertising purposes. |
ad_personalization | Marketing | Whether the data can be used for personalised advertising, such as remarketing. |
Consent Mode is not a banner and does not block anything on its own. It needs a consent platform to collect the choice, and tag gating for tags that are not from Google. We set up the cookie consent banner and connect the two.
How the choice reaches each tag
One example visitor: yes to analytics, no to marketing.
-
1. Banner
The visitor chooses
The banner records a choice for each purpose.
- Strictly necessaryAlways on
- AnalyticsYes
- MarketingNo
-
2. Google Tag Manager
Consent state is updated
Everything started at denied. Only the analytics signal changes.
- analytics_storagegranted
- ad_storagedenied
- ad_user_datadenied
- ad_personalizationdenied
-
3. Tags
Each tag checks its consent type
Tags tied to analytics fire. Tags tied to marketing wait.
- Google AnalyticsFires
- Google AdsWaits
- Meta PixelWaits
- LinkedInWaits
- HeatmapsFires
Which purpose a tool belongs to is agreed with you and written in the consent mapping sheet. If the visitor later changes the choice, the consent state changes and the tags follow.
Basic or Advanced: how the two modes compare
Google offers two ways to run Consent Mode. They differ in what happens before a visitor chooses, and when a visitor says no. Google documents both in its consent mode overview and its consent mode setup guide.
| Basic mode | Advanced mode | |
|---|---|---|
| What loads before consent | Google tags are blocked. Nothing from Google Analytics or Google Ads loads until the visitor chooses. | Google tags load with every signal set to denied. They do not set or read analytics or advertising cookies while consent is denied. |
| What Google receives if the visitor says no | Nothing. The tags never fire for that visit. | Limited cookieless signals, known as pings. They carry the consent state and basic information about the visit, with no cookie identifiers. |
| Effect on your reports | Reports show the visitors who said yes. There is little data for modelling the rest. | Reports show the visitors who said yes. Google may also model part of the gap, if your property has enough data to qualify. |
| The question for your legal contact | Is a clean "nothing before a yes" the position we want? | Are we comfortable with cookieless pings being sent before, or without, consent? |
Who decides?
You do, with your legal contact. We explain both modes, show what each sends on your own site, and set up the one you choose. We do not call either one "compliant". Tags that are not from Google are gated the same way in both modes.
What happens to your GA4 and ads data?
Reported traffic usually drops. Your real traffic does not.
Once tracking waits for consent, visitors who say no are no longer counted in the same way. The visits still happen. They just stop appearing in Google Analytics and in your ad platforms as they did before.
How big the change is depends on how many of your visitors say yes, so it differs from site to site. We do not quote a typical figure, because we would be guessing.
Google Analytics
Sessions, users and conversions cover the visitors who agreed to analytics. In Advanced mode, modelling may fill part of the gap.
Google Ads and other ad platforms
Fewer conversions are recorded, and remarketing audiences grow only from visitors who agreed to marketing.
What we do about it
We note the date gating goes live, so the change in your reports has a clear cause. Before and after are best compared with that in mind.
The four-state test
We test as a new visitor for every choice and record what fires each time. The setup is done when all four states behave as expected, for every tag.
-
No choice
The banner is showing and nothing has been clicked. No analytics or marketing tag should fire.
-
Accept
The tags for the accepted purposes fire, and the consent signals change to granted.
-
Reject
Analytics and marketing tags stay off. The signals stay denied.
-
Accept, then Reject
The visitor changes their mind through the preference link. The tags stop.
What you receive
- An updated Google Tag Manager container, with version notes
- A consent mapping sheet for every tag
- A test record for the four states, with what fired each time
| Tag | Purpose | Waits for |
|---|---|---|
| GA4 configuration | Analytics | analytics_storage |
| Google Ads conversion | Marketing | ad_storage, ad_user_data |
| Meta Pixel | Marketing | Marketing consent in the banner |
Where this sits in pricing
Tag gating and Consent Mode v2 are part of every Implementation plan, from ₹39,999. Starter covers up to 15 tags and Growth up to 40.
Server-side tagging is an add-on, from ₹60,000: server-side Google Tag Manager with consent signals. Hosting is paid by you, and it takes 2 to 3 weeks.
Not sure what your tags do today? The Website Audit shows what fires before consent.
After launch, a monthly DPDP Care Plan reviews new tags and checks each one against a consent type.
View full pricingAccess. We need access to Google Tag Manager, your consent platform and the website CMS. We never need your CRM.
Scope. DPDPWeb works on websites only: cookie banners, form consent, and privacy and cookie policy pages. We are not a DPO service and not a law firm. Nothing on this site is legal advice.
Consent Mode and tag gating questions
For the law behind this, read the website guide to the DPDP Act.
Will our Google Analytics data drop?
Usually, yes. Once tracking waits for consent, visitors who say no are no longer counted in the same way. We explain the options in Google Consent Mode v2 and what each means for your reports. The choice is made with your legal contact.
Does the DPDP Act require Consent Mode v2?
No. The Act has no cookie-specific rule and does not name any tool. Cookies and tags fall under its general consent rules. Consent Mode v2 is simply how Google tags read the visitor's choice, so it is the practical way to make Google Analytics and Google Ads follow the banner.
Should we choose Basic or Advanced mode?
That is your decision, made with your legal contact. Basic sends nothing to Google until a visitor says yes. Advanced sends limited cookieless signals while consent is denied, which may allow some modelling. We explain both, show what each sends on your site, and set up the one you choose.
Does this cover tags that are not from Google?
Yes. Consent Mode signals are read by Google tags. Other tags, such as Meta Pixel, LinkedIn, heatmaps and chat, are tied to a consent type in Google Tag Manager, so they wait for the same choice.
Some of our tags are pasted into the website code. Can you still gate them?
Yes. We list the hard-coded scripts and move them into Google Tag Manager. For that we use our access to the website CMS, or work with a developer on your side to remove the old snippets.
What access do you need?
Google Tag Manager, your consent platform and the website CMS. We use the CMS to remove hard-coded scripts. We never need your CRM.
Do we need server-side tagging?
No. Tag gating and Consent Mode v2 work without it. Server-side tagging is an optional add-on, from ₹60,000, for teams that want it.
See what your tags do before consent
Share your URL. We look at your tags, explain Basic and Advanced mode for your site, and reply with scope and timeline in writing.
Book a free call