Many businesses that use Google Analytics, Google Ads, and conversion tags experience a disconnect between cookie consent and Google's tools: even when the user clicks "reject" on the banner, the tags keep running. Google Consent Mode v2 is designed precisely to close this gap. By passing the user's consent choice to Google tags through signals, it adapts the behavior of those tags to consent. In this guide we cover what Consent Mode v2 is, its four core signals, and a KVKK-compliant setup step by step.
What Is Consent Mode v2, and How Does It Differ From v1?
Consent Mode is a framework that determines how Google tags behave based on user consent. While the first version (v1) used two signals, v2 added two new signals related to ad personalization and user data. This conveys consent status in more detail, especially in Google Ads and remarketing scenarios.
Consent Mode v2 has two operating modes:
- Basic mode: Google tags do not load at all before consent; no signal or data is sent until the user consents.
- Advanced mode: Tags load but, before consent, send only cookieless, identity-free, aggregated measurement signals; once consent is given, full measurement begins.
The critical point for KVKK compliance is that, whichever mode you choose, non-essential cookies must not be written before the user consents.
The Four Consent Signals
Consent Mode v2 manages consent status through four signals. Each takes the value granted or denied:
| Signal | What It Controls |
|---|---|
| `analytics_storage` | Use of analytics cookies and measurement storage |
| `ad_user_data` | Sending user data to Google for advertising purposes |
| `ad_personalization` | Use of personalized ads / remarketing |
In a setup aligned with KVKK and general consent logic, all four signals must be denied by default until the user gives explicit consent. When the user consents to the relevant category on the banner, only the corresponding signals are updated to granted.
The Correct Default Configuration
The most important step in a Consent Mode setup is the default command that runs as the page loads. This command must run before any Google tag fires:
- In the default state, all four signals are set to
denied. - The
wait_for_updateparameter allows a short window for your consent management platform (CMP) to report the user's choice. - When the user consents, an
updatecommand sets the relevant signals togranted.
Example default structure: gtag('consent', 'default', { ad_storage: 'denied', analytics_storage: 'denied', ad_user_data: 'denied', ad_personalization: 'denied', wait_for_update: 500 }). Setting the default to deny for visitors in Türkiye supports both the prior blocking principle and the requirement that consent be given by a clear action.
Step-by-Step Setup
- Run a cookie scan to detect the Google tags and other trackers on your site.
- If you use Google Tag Manager (GTM), set up a CMP (consent management platform) integration.
- On all pages, add the
consent defaultcommand that runs before the tags and set the four signals todenied. - Offer category-based selection on the banner (analytics, marketing) and make rejecting as easy as accepting.
- Ensure the CMP sends a
consent updatesignal when the user consents. - In GTM, verify with built-in consent checks that tags fire based on the correct signal.
- Log the consent choice and its version; also store preference changes.
- Test with Tag Assistant / preview mode that the signals update correctly.
Integration With a CMP
Consent Mode is not a banner on its own; it is only an interface that passes signals to Google. The layer that offers the user a choice, stores preferences, and triggers the update signal is the consent management platform (CMP). In a correct setup, the CMP captures the user's choice, maps the relevant categories to Consent Mode signals, and blocks non-essential tags before consent. Setting up Consent Mode alone, without a CMP, leaves KVKK obligations such as consent records and preference management incomplete.
Common Mistakes
- Leaving the default signals as
granted, or running the default command after the tags. - Offering only "Accept" on the banner and making rejection difficult.
- Writing analytics cookies even when
analytics_storageis denied. - Keeping no consent record; being unable to prove when and to what the user consented.
- Setting up Consent Mode but never connecting a CMP.
Example Scenario
The B2B software company "DataFlow" uses Google Analytics 4 and a Google Ads conversion tag on its website. Before the setup, it runs a cookie scan and lists all trackers. It then integrates a CMP in GTM and adds a consent default command to all pages that runs before the tags; all four signals start as denied.
When a visitor enters the site, the banner opens; the "Accept All" and "Reject All" buttons are presented with equal visibility. When the visitor consents only to analytics and rejects marketing, the CMP sends a consent update: analytics_storage: granted, but ad_storage, ad_user_data, and ad_personalization remain denied. As a result, while GA4 measures, the ad-personalization tags do not activate. DataFlow also ensures accountability by logging each choice with a date and version.
Frequently Asked Questions
Is using Consent Mode v2 alone enough for KVKK compliance?
No. Consent Mode only passes consent signals to Google tags. KVKK compliance also requires a disclosure text, a cookie policy, a banner that offers the user a genuine choice, and consent records. Consent Mode is a complementary part of this structure.
Should I choose basic mode or advanced mode?
Neither writes non-essential cookies before consent. Advanced mode enables modeling with cookieless signals before consent, providing measurement continuity; however, it requires more careful configuration. You can choose based on your measurement needs and transparency preferences.
Why should I set the default signals to `denied`?
Because valid consent must be given by the user's clear action, and non-essential cookies must not run before consent. Leaving the default as granted violates the prior blocking principle.
What happens if the user withdraws consent?
When the user updates their preference, the CMP sends a new consent update signal and the relevant signals return to denied. Make sure this update is configured correctly so that the relevant cookies are deleted and the tags stop.
This content is for general information purposes only and does not constitute legal advice. With JUS., you can run a free cookie scan and make your Consent Mode v2 and consent management setup KVKK-compliant, request a demo to get started.