Consent Mode v2 Audit Guide: The 6-Step Check Every Google Ads Account Needs in 2026

After June and August 2026 changes, Consent Mode v2 does more work than ever. Here's the 6-step audit every Google Ads account needs right now.

Consent Mode v2 Audit Guide: The 6-Step Check Every Google Ads Account Needs in 2026

A Google Consent Mode v2 audit checks six things: tag firing, default consent state, update events, ad_storage as the controlling signal, CMP rejection path testing, and documentation. After the June 15, 2026 consolidation that made ad_storage the single authority for ad data, and the August 3, 2026 IP personalization change affecting UK, EU, and Swiss traffic, Consent Mode is doing more work than ever. This guide walks the full audit, with common failure modes for each step.

Why the audit matters more in 2026

Consent Mode v2 launched in March 2024 as a requirement for advertisers using Google Ads with EEA traffic. Two changes in 2026 made it more consequential.

June 15, 2026: Google consolidated the ad consent signals. Previously, ad_storage, ad_user_data, and ad_personalization all carried weight in the consent picture. After June 15, ad_storage became the single authoritative signal for whether ad data can be collected and used. Get this wrong and either you lose conversions you should be measuring, or you collect data you don't have consent for.

August 3, 2026: For UK, EU, and Swiss traffic, IP-based personalization now requires explicit consent. Before this change, IP addresses were treated as a less sensitive signal. Now they sit alongside cookies and identifiers under the same consent framework.

If your last consent mode review was in 2024 or early 2025, your implementation is likely out of date.

The 6-step audit

Step 1: Verify tag firing

Open the page in an incognito window. Use the Tag Assistant Chrome extension or your browser's network tab. Confirm that the Google tag (gtag.js or GTM) loads on every page where it should: every public page, every conversion page, every form thank-you page.

What you're looking for:

Common failure: the tag is missing on a key conversion page because a developer deployed a new landing page template without copying the tag over. This is the single most common Consent Mode issue and the easiest to miss.

Step 2: Check default consent state

Before any user interaction, your default consent state must be set. For EU/UK/Swiss traffic, this should be denied for ad_storage, ad_user_data, ad_personalization, analytics_storage, and any other consent types you've defined.

Inspect the dataLayer or run a console command to see the current consent state:

Or check the dataLayer for the consent.default event. You should see all relevant consent types set to "denied" before user interaction.

Common failure: the default is set to "granted" globally, which violates EU consent requirements. Or the default is set correctly for ad_storage but missing for analytics_storage, which causes inconsistent behavior.

Step 3: Verify update events fire on consent change

When a user interacts with the cookie banner (accepts, rejects, or makes a granular choice), the CMP should fire a consent update event. This event tells the Google tag to switch from the default state to the user's chosen state.

Test the path:

1. Load the page in incognito.

2. Confirm default consent is "denied."

3. Click "Accept all" on the banner.

4. Check the dataLayer for the consent update event.

5. Confirm consent state changed to "granted."

6. Confirm tracking tags now fire fully (network requests to google-analytics.com, googleadservices.com, etc.).

Then repeat with "Reject all" and confirm the opposite behavior.

Common failure: the update event fires, but the consent state in the tag doesn't change. This usually means the CMP and the Google tag aren't properly integrated, often because the CMP was installed before the Google tag and the configuration wasn't refreshed.

Step 4: Confirm ad_storage is the controlling signal

After the June 15, 2026 consolidation, ad_storage is the single authority for ad data collection. Audit every script and tag that previously checked ad_user_data or ad_personalization independently. They should now defer to ad_storage.

For most properly implemented setups using Google's templates, this happened automatically. For custom implementations or legacy installations, it didn't.

To verify:

Common failure: a custom GTM trigger checks ad_user_data instead of ad_storage and continues firing ad tags during a rejection scenario. Easy to miss, expensive to discover.

Step 5: Test the CMP rejection path

This step is the one most teams skip. Most QA focuses on the acceptance path because that's where conversions come from. The rejection path is where compliance lives.

Walk through:

1. Load the page in incognito.

2. Click "Reject all" on the banner.

3. Confirm default consent stays "denied."

4. Browse the site. Hit a thank-you page. Fill a form.

5. Watch the network tab. Confirm no PII or identifiers are sent to Google in conversion or page view requests.

6. Confirm conversion pings still fire in "consent denied" mode, but without user-level data. These pings power Google's modeled conversions.

Common failure: the thank-you page fires a conversion event with the user's email address in plaintext, regardless of consent state. The CMP rejected ad_storage, but a hardcoded conversion tag ignored the signal entirely.

Step 6: Update privacy policy and documentation

The privacy policy is part of the audit. After the August 3, 2026 IP personalization change, your privacy policy must disclose:

Internally, document your consent mode implementation. The audit log should include:

This documentation matters when the next change rolls out, when a new team member joins, or when a DPO asks how the system works.

Common failure modes

In addition to the failures called out in each step, watch for these account-wide issues:

How often to audit

Set a calendar reminder for two scheduled audits per year, plus one after any of the following:

Frequently asked questions

Is Consent Mode v2 required?

For advertisers using Google Ads or GA4 with traffic from the European Economic Area, the United Kingdom, or Switzerland, yes. Without Consent Mode v2, Google will suppress personalization features and remarketing audiences for those users.

What's the difference between basic and advanced Consent Mode?

Basic Consent Mode blocks all Google tags from firing until consent is granted. Advanced Consent Mode allows tags to fire in a limited "cookieless" mode that sends anonymous signals for modeling. Advanced is the more common choice because it preserves conversion modeling.

What changed on June 15, 2026?

Google consolidated ad consent signals so that ad_storage is the single authoritative control for whether ad data can be collected. Previously, ad_user_data and ad_personalization carried independent weight. Now they defer to ad_storage.

What changed on August 3, 2026?

For UK, EU, and Swiss traffic, IP-based personalization now requires explicit user consent. Before, IP was treated as less sensitive. Now it sits inside the same consent framework as cookies and identifiers.

How do I know my implementation is compliant?

Run the six-step audit above. Compliance has two dimensions: technical (the tags behave correctly based on consent state) and legal (your privacy policy and CMP banner meet local requirements). The audit covers the technical side. Work with a privacy counsel for the legal side.

Can I use a custom CMP, or do I need Google's CMP partner?

You can use any CMP, but Google publishes a list of certified CMP partners that are pre-integrated with Consent Mode v2. Certified partners cut implementation time significantly. If you're using a non-certified CMP, plan for more custom integration work.

Bottom line

The six-step Consent Mode v2 audit catches the issues that quietly cost conversions or create compliance exposure. After the June and August 2026 changes, your last audit is likely out of date. Block two hours on the calendar, walk the six steps, document what you find, and schedule the next audit in six months.

*Want help auditing your Consent Mode v2 implementation? Book a call with us.*

Related articles