Consent Mode v2 and cookie banners, configured correctly.

ad_storage governs advertising storage, analytics_storage analytics storage, ad_user_data advertising user data, and ad_personalization personalised advertising. Defaults must be set before other Google tags run.

The CMP updates signals after a choice. These technical instructions are not consent itself, so wording, categories and evidence still require legal assessment.

Sequence matters. A default command must set region and denied states before config or event commands transmit data. The CMP then issues an update after a choice. Tag Assistant reveals late defaults and parameters that never change. Set ad_user_data and ad_personalization explicitly even when an older implementation already controls ad_storage.

Basic mode blocks Google tags until consent. Advanced mode loads tags with denied defaults and sends cookieless pings without consent.

Advanced mode can support modelling but requires careful technical and legal assessment. It is not permission to send arbitrary data.

In basic mode the CMP prevents Google tags from running before acceptance, making network behaviour straightforward to verify. Advanced mode loads tags with denied signals, so requests must exclude advertising cookies and user identifiers. Inspect cookies and request parameters. Do not select advanced mode merely to increase modelled reporting when legal assessment or technical controls cannot support it.

Choose a Google-certified CMP supporting your languages, domains and systems. Cookiebot, Cookie Information and CookieScript are common Danish-market options, described without affiliation.

Assess scanning, categories, documentation, design, performance and multi-domain support. Reject dark patterns and make rejection as easy as acceptance.

Test the banner as a visitor. Check keyboard operation, visible purposes before acceptance and choice sharing across relevant domains. Confirm the scanner detects scripts loaded through GTM and embedded media, and that categories can be corrected manually. For multilingual sites, translate supplier purposes consistently. Google certification covers Google integration rather than the whole compliance position.

Provide a genuine choice, no preselected optional categories and clear separation of necessary, analytics and marketing cookies.

Document vendors, purposes, lifetimes and withdrawal. V7 implements and tests the technology, but this is not legal advice. Ask your legal adviser to review the complete position.

Compare the policy with a clean scan. Every optional cookie should have an identifiable supplier, purpose, category and lifetime. If the banner calls a tag analytics while GTM treats it as advertising, the choice is misleading. Keep a persistent route to change consent. When a supplier changes cookies or lifetimes, update the policy and categorisation together.

Open a clean browser, reject all and use Tag Assistant and network tools to check whether analytics or advertising tags fire. Inspect all four parameters, then repeat after acceptance and withdrawal.

Review Google Ads diagnostics and GA4 DebugView, but also verify actual cookies and requests across templates, mobile and languages.

Filter browser network requests for 'collect', 'g/collect' and 'pagead', then inspect cookies in Application. Under basic mode, analytics cookies must not appear after rejection. After acceptance, the GA4 event should appear once in DebugView. Clear cookies and local storage between scenarios, and confirm the change-consent control sends a fresh update rather than only changing the banner display.