Google Consent Mode v2 on Shopify (2026): Setup and How to Verify It

Last updated: September 25, 2026

Google Consent Mode v2 tells Google's tags what each visitor agreed to, using four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization. If you sell to shoppers in the EEA or the UK and want remarketing, audience building and conversion modeling to keep working, Google requires these signals. On Shopify, consent is collected through the Customer Privacy API, either by Shopify's own cookie banner or by a compatible consent app, and the Google & YouTube app passes those signals to Google for you. Stores that run their own Google Tag Manager setup have to wire the signals themselves, and that is where most broken setups come from.

This guide explains what the four signals do, the difference between basic and advanced mode, both Shopify setup paths, and how to confirm it actually works.

What is Consent Mode v2 and who needs it?

Consent Mode is Google's way of adjusting tag behavior based on consent. Version 2 added two signals that specifically govern advertising use of user data. Since March 2024, Google has required them for traffic from the European Economic Area if you want to use that data for personalized advertising and related measurement features, and the UK follows the same approach.

Signal	What it controls
ad_storage	Whether advertising cookies can be read or written
analytics_storage	Whether analytics cookies (GA4) can be read or written
ad_user_data	Whether user data can be sent to Google for advertising purposes
ad_personalization	Whether data can be used for personalized ads such as remarketing

If your store only sells to the US, Consent Mode is not a legal requirement from Google's side, but US state privacy laws are expanding, and a correctly configured setup costs you nothing. If you sell into Europe at all, treat it as mandatory.

Basic vs advanced Consent Mode: which should a Shopify store use?

	Basic mode	Advanced mode
Before consent	Google tags do not load at all	Tags load with signals set to denied
If visitor declines	No data sent to Google	Cookieless pings sent, no cookies set
Conversion modeling	Limited	Fuller modeling of declined-consent conversions
Legal caution	Most conservative	Some regulators and lawyers question pings sent before consent

Advanced mode recovers more measurement, because Google can model conversions from visitors who declined. Basic mode is the safer reading of strict consent rules. In Germany in particular, where the TDDDG governs access to devices, some privacy counsel advise against any tag activity before consent. The honest answer: the choice is a legal one as much as a technical one. Ask whoever advises you on privacy for your markets, then configure accordingly.

How does consent flow on a Shopify store?

Shopify centralizes consent in its Customer Privacy API. The chain looks like this:

1. Collection. A cookie banner asks the visitor. This can be Shopify's built-in banner, configured under Settings > Customer privacy, or a consent app that integrates with the Customer Privacy API. 2. Storage. Shopify records the choice. 3. Distribution. App pixels and custom pixels respect that choice based on the permissions they declare, and the Google & YouTube app translates it into Consent Mode signals for Google.

The weak point is anything outside that chain. A GA4 or Google Ads tag hardcoded in theme.liquid, or a GTM container loaded directly in the theme, does not automatically know what the visitor chose. That is the setup that needs manual wiring.

Setup path A: Shopify's banner plus the Google & YouTube app

This is the simplest path and the right one for most stores.

Step 1. Go to Settings > Customer privacy and set up the cookie banner. Make sure regions that require opt-in, such as the EEA and UK, are configured to require consent before tracking, and that visitors can accept, decline or set preferences.

Step 2. Confirm your Google tracking runs through the Google & YouTube app, not through a separately pasted tag. Remove any old hardcoded Google tags from the theme, otherwise they fire regardless of consent.

Step 3. Check that other ad platforms also run through their official apps or through custom pixels with the correct permission level, so the whole store follows the same consent decision.

Step 4. Verify, using the steps later in this guide.

Setup path B: a consent app plus Google Tag Manager in the theme

Use this when you need GTM for tags the apps do not cover. Two things must happen: a default consent state before any Google tag loads, and an update when the visitor chooses.

Place the default command at the very top of the head section, above the GTM snippet:

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag() { dataLayer.push(arguments); }

  // Denied by default for regions that require opt-in
  // (list every EEA country code plus GB)
  gtag('consent', 'default', {
    ad_storage: 'denied',
    analytics_storage: 'denied',
    ad_user_data: 'denied',
    ad_personalization: 'denied',
    region: ['DE', 'FR', 'NL', 'IT', 'ES', 'GB'],
    wait_for_update: 500
  });

  // Granted by default everywhere else
  gtag('consent', 'default', {
    ad_storage: 'granted',
    analytics_storage: 'granted',
    ad_user_data: 'granted',
    ad_personalization: 'granted'
  });
</script>

Region-specific defaults take precedence over the general one, so EEA and UK visitors start denied while others start granted. Adjust the second block if your privacy counsel wants opt-in everywhere.

Then update consent when Shopify records the visitor's choice. Many consent apps send the update for you, check their documentation first. If yours does not, listen for Shopify's consent event:

<script>
  document.addEventListener('visitorConsentCollected', function (event) {
    var c = event.detail;
    gtag('consent', 'update', {
      ad_storage: c.marketingAllowed ? 'granted' : 'denied',
      ad_user_data: c.marketingAllowed ? 'granted' : 'denied',
      ad_personalization: c.marketingAllowed ? 'granted' : 'denied',
      analytics_storage: c.analyticsAllowed ? 'granted' : 'denied'
    });
  });
</script>

Returning visitors who already chose also need their stored choice applied on page load, which good consent apps handle. Test both first visits and return visits.

One warning: do not run the same Google tag in both GTM and the Google & YouTube app. You will double count conversions and create two sources of consent truth.

Does server-side tracking remove the need for consent?

No. Moving tags to a server changes where data is processed, not whether you need permission to collect it. A server-side container still has to respect the visitor's consent state and pass Consent Mode signals onward. Our server-side GTM guide covers the architecture, and the Meta CAPI guide covers the Meta side, where the same principle applies.

How do I verify Consent Mode is working?

1. Test from an opt-in region. Use a VPN set to Germany or the UK, open the store in a private window, and do not click the banner yet.

2. Use Tag Assistant or GTM preview. Both show a Consent view with the default state on page load and the updated state after you click accept or decline. Before any click, all four signals should show denied for an opt-in region.

3. Read the network requests. In your browser's developer tools, filter requests to Google Analytics or Google Ads. The gcs parameter shows storage consent: G100 means both ad and analytics storage denied, G111 means both granted. The gcd parameter carries the full set of v2 signals. If gcd is missing, v2 is not being sent.

4. Accept, then decline. Repeat the checks after each choice and on a second page view, so you know the stored choice is applied.

5. Check platform diagnostics after a week. Google Ads and GA4 report a consent mode status for your tags. It should show consent signals being received from your EEA and UK traffic.

What are the most common Consent Mode mistakes on Shopify?

Mistake	Result	Fix
Old Google tag hardcoded in theme.liquid	Fires regardless of consent	Remove it, track through the app or consent-aware GTM
Default command placed after GTM	Tags fire before consent state exists	Move the default to the very top of the head
Only v1 signals sent	EEA personalization and audiences stop working	Include ad_user_data and ad_personalization
Banner defaults everyone to accepted	Consent is not valid under EU rules	Require an active choice in opt-in regions
Same tag in GTM and the app	Double conversions	Choose one pipe per tag

Consent problems also show up as analytics gaps. If your GA4 numbers look far below Shopify's for European traffic, our guide to GA4 and Shopify discrepancies explains how to separate consent effects from genuine tracking faults.

Want it checked properly?

Consent Mode is easy to set up badly and hard to notice, because the store keeps working while measurement quietly degrades. 7SEA Marketing audits and configures tracking and consent for Shopify brands selling into the US, UK and EU as part of our analytics service.

Frequently asked questions

Do I need Google Consent Mode v2 on my Shopify store?

If you have visitors from the EEA or the UK and use Google Ads or GA4, yes. Google requires the v2 signals for that traffic to keep personalized advertising, remarketing audiences and related measurement working. US-only stores are not required by Google to use it, though it is good practice.

Does Shopify support Consent Mode v2?

Yes. Shopify collects consent through its Customer Privacy API, using its built-in cookie banner or a compatible consent app, and the Google & YouTube app passes the resulting Consent Mode signals to Google. Custom GTM setups in the theme need to set default and update commands themselves.

What is the difference between basic and advanced Consent Mode?

In basic mode, Google tags do not load until the visitor consents. In advanced mode, tags load with denied signals and send cookieless pings, which lets Google model conversions from visitors who declined. Advanced mode recovers more measurement but carries more legal caution in strict jurisdictions.

How can I tell if Consent Mode v2 is working?

Test from an opt-in region with Tag Assistant or GTM preview, confirm all four signals are denied before interaction and update after you choose, and check network requests for the gcs and gcd parameters. After a week, check the consent status diagnostics in Google Ads and GA4.

Does server-side tracking remove the need for consent?

No. Server-side tagging changes where data is processed, not whether you need consent to collect it. A server-side setup must still respect the visitor's consent choice and forward Consent Mode signals.