Google Consent Mode v2

One Privacy emits Google Consent Mode v2 signals automatically. Your Google tags receive denied defaults before consent and granted updates the moment a visitor accepts the relevant category. There's nothing to wire up by hand.

This page documents the calls One Privacy makes so you know what's happening under the hood. The commands, consent types, and settings follow Google's Set up consent mode on websites guide; the Consent mode overview explains what each consent type controls.

Defaults at page load

As soon as the widget loads, One Privacy pushes a default consent state with everything denied except security_storage:

emitted-by-onePrivacy.js

gtag('consent', 'default', {
  ad_storage: 'denied',
  analytics_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  functionality_storage: 'denied',
  personalization_storage: 'denied',
  security_storage: 'granted',
  wait_for_update: 500
});

The wait_for_update: 500 tells Google to wait up to 500ms for a follow-up update call before firing tags. This avoids tags firing in a denied state and then being re-fired when consent is granted.

If you load the banner through the One Privacy GTM template, the template sets the defaults instead, per region from its Default Consent Settings table, and the script above skips its own default and set calls.

📊

Make sure gtag is on the page

One Privacy creates window.dataLayer and a basic gtag function if they don't exist, but Google's tags still need to be installed on the page for the signals to actually do anything. Use Google Tag Manager or the gtag.js snippet as you normally would.

Updates after consent

When the visitor saves a choice, One Privacy maps the cookie categories to Google's signals and pushes an update:

emitted-after-consent.js

gtag('consent', 'update', {
  security_storage: 'granted',
  functionality_storage:   '<C0002 ? granted : denied>',
  personalization_storage: '<C0002 ? granted : denied>',
  analytics_storage:       '<C0003 ? granted : denied>',
  ad_storage:              '<C0004 ? granted : denied>',
  ad_user_data:            '<C0004 ? granted : denied>',
  ad_personalization:      '<C0004 ? granted : denied>'
});

Google signal	Mapped from
security_storage	Always granted (Necessary)
functionality_storage	C0002 Functional
personalization_storage	C0002 Functional
analytics_storage	C0003 Performance
ad_storage	C0004 Targeting
ad_user_data	C0004 Targeting
ad_personalization	C0004 Targeting

Regions with no banner

A geo rule set to No banner, and any visitor no rule covers, gets no banner at all. One Privacy still sends the update at initialization, with every signal granted, so Google tags leave the denied default and measure normally. A visitor who already accepted or rejected on your site keeps that choice; the grant applies only where no explicit choice exists (the cgbu key in the consent cookie is 0).

Redaction and URL passthrough

Alongside the defaults, One Privacy enables two Google Consent Mode settings on every site:

emitted-by-onePrivacy.js

gtag('set', 'ads_data_redaction', true);
gtag('set', 'url_passthrough', true);

Both only take effect while ad_storage is denied. Once a visitor accepts the Targeting category, neither one does anything. Google documents both settings in Set up consent mode on websites.

ads_data_redaction strips ad click identifiers out of the requests Google Ads and Floodlight tags send, and routes those requests through a cookieless domain. It sends Google less data, and has no effect on your pages.

url_passthrough carries the Google click ID (gclid and related parameters) between pages in the URL, since no cookie is available to hold it. Without it, a visitor who arrives from a Google ad and then declines loses the link between the ad click and anything they do afterwards, so conversions from that visit are not attributed to the ad.

Only visitors who both arrived from a Google ad and declined the Targeting category are affected. For everyone else there is no gclid to carry, so nothing changes.

🔗

What url_passthrough changes on your site

Internal links pick up a ?gclid= parameter for affected visitors. Two things to be aware of: your analytics may report /cart and /cart?gclid=... as separate pages unless query parameters are excluded, and a CDN that caches on the full URL will treat each variant as its own entry. If either matters to you, contact support and we can disable it for your site.

Turning Consent Mode off

You can stop One Privacy from sending any Consent Mode command and go back to plain tag blocking, for example when your legal team does not want cookieless pings before consent. Google's setup page calls this the basic implementation without Consent Mode; see Set up consent mode.

Set one option on the page before the One Privacy snippet:

turn-off-consent-mode.html

<script>
  window.onePrivacyOptions = { googleConsentMode: false };
</script>
<script data-oneprivacy-widget="true" src="https://.../live/<projectId>/sdk.js"></script>

If you load the banner with the One Privacy GTM template, untick Send Consent Mode default and update commands under Other Settings instead. The template sets the same option for the banner script.

With the option off:

• No gtag('consent', 'default', ...) and no gtag('consent', 'update', ...) are sent, by the snippet, the banner, or the template.
• No ads_data_redaction, url_passthrough, or developer ID set commands are sent.
• The banner, the consent cookie, window.onePrivacyCookieGroups, the one-privacy-consent-updated event, and the dataLayer push keep working exactly as before.

Google tags then get no consent state from One Privacy, so you must block them until consent yourself. In Google Tag Manager, set Require additional consent for tag to fire on each Google tag, or trigger the tag on the one-privacy-consent-updated event and check window.onePrivacyCookieGroups. See GTM dataLayer integration and the JavaScript API.

onePrivacy.debug() reports Consent default: DISABLED while the option is off, so you can confirm the switch took effect. Remove the option (or tick the checkbox again) to turn Consent Mode back on; no other change is needed.

What you don't need to do

You don't need to write your own gtag('consent', ...) calls.

You don't need to gate Google Analytics or Google Ads behind consent in your own code; the gtag signals do that for you.

You don't need to wire anything up in the dashboard for this to work.

What you do need to check

Make sure your tags honor consent. In Google Tag Manager, every Google tag (GA4, Ads, Floodlight) has a "Consent Settings" section. Check that "Require additional consent for tag to fire" is set up correctly, or use the default "No additional consent required" so the tag respects Consent Mode signals from One Privacy. Google's basic and advanced setups are described in Set up consent mode; see also Google tag gateway and load order.

Order of scripts. Make sure the One Privacy snippet is in the page before your Google tag, so the default call fires first.

Test it. Open Chrome DevTools → Network → filter for collect and verify Google Analytics requests don't fire until the visitor accepts. Then run onePrivacy.debug() in the Console to confirm the default command reached your tags on time. See Debug Google Consent Mode.

What's next

Debug Google Consent Mode.

JavaScript API.

Consent events.

Google Consent Mode (overview).