Consent Mode v2 for WooCommerce: basic vs advanced, set up right

Consent Mode v2 for WooCommerce: the short answer

A WooCommerce store selling to European customers needs two things. First, a cookie banner that collects valid consent: equal Accept and Reject buttons, no pre-ticked boxes, and no tracking before a choice. Second, Google Consent Mode v2, which passes that choice to Google tags through four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization. Without Consent Mode v2, Google Ads remarketing and parts of conversion measurement stop working for EEA and UK traffic. Without a valid banner, you risk action from your data protection authority.

We checked the guidance and documentation below on 24 October 2026. This is a practical guide, not legal advice. Which mode you choose and what your banner says should be confirmed with your privacy adviser or DPO.

Why it matters: the law and the Google requirement

There are two separate layers, and stores often confuse them.

The legal layer. Article 5(3) of the ePrivacy Directive requires consent before storing or reading non-essential information on a user's device. That covers analytics and advertising cookies, and according to the EDPB's Guidelines 2/2023 on the technical scope of Article 5(3), also tracking pixels and similar techniques. The consent itself must meet the GDPR standard: freely given, specific, informed and unambiguous, and as easy to withdraw as to give. Each country implements the ePrivacy rules in national law; in the UK it is PECR, enforced by the ICO.

The Google layer. Google's EU user consent policy requires advertisers to obtain consent for European users. Since March 2024, Google has expected the two newer signals, ad_user_data and ad_personalization, for EEA traffic, and its EU user consent policy covers the UK and Switzerland as well. Google Analytics' consent settings help page says that without them, audiences used in linked advertising products only include users outside the EEA.

What regulators look at in a banner

The EDPB cookie banner taskforce report (January 2023) summarises what European DPAs agreed on:

Banner practice	Taskforce position
No reject option on the layer with the accept button	A vast majority of DPAs: infringement
Pre-ticked boxes on the second layer	Not valid consent
Reject only as a link inside text or outside the banner	Not valid consent unless the link has enough visual prominence
Deceptive colours or contrast that push Accept	Assessed case by case; can make consent invalid
Claiming legitimate interest for non-essential cookies	Not a valid basis for storing cookies
Essential cookies (cart, session, security)	Exempt under Art. 5(3), but the taskforce warned against labelling non-essential cookies as essential

What breaks without Consent Mode v2

Feature	Without the v2 signals for EEA and UK users
Google Ads remarketing audiences	EEA users stop being added
GA4 audiences shared with Google Ads	Only non-EEA users are included
Enhanced conversions and tag-based conversion tracking	ad_user_data is required for these measurement features
Conversion modelling	No consent pings means no modelling to fill the gaps
Customer Match uploads	Both consent fields must be granted for EEA lists

Options: basic vs advanced Consent Mode

Google's Consent Mode documentation describes two implementations:

	Basic	Advanced
When Google tags load	Only after the visitor interacts with the banner	Immediately, with consent defaulting to denied
If the visitor refuses	Nothing is sent to Google	Cookieless pings are sent (no cookies or device identifiers)
Conversion modelling	General model	Advertiser-specific model, more detailed
Privacy risk	Lowest	Higher: some data is sent without consent
Data recovered	Least	Most
Good fit	Stores that want the conservative reading of the law	Stores with enough traffic to meet modelling thresholds and legal sign-off

Our default recommendation for small and mid-sized stores is basic mode, unless your privacy adviser approves advanced mode and you have enough traffic for Google's modelling thresholds. Modelling only works above a certain data volume (for GA4 behavioural modelling, Google requires at least 1,000 events a day with analytics_storage denied for 7 days, and at least 1,000 daily consenting users on 7 of the previous 28 days), so a store with a few hundred visits a day gains little from advanced mode while taking on the extra risk.

Choosing a consent platform for WooCommerce

You have three realistic routes:

• A Google-certified CMP plugin (for example Complianz, CookieYes, Cookiebot or Usercentrics; check Google's current partner list). These set the default and update commands for you and integrate with Google Tag Manager.
• Google Tag Manager with a CMP template, which gives you central control over every tag, Google and non-Google.
• A custom banner in a custom-built store. This is the usual route on fully custom builds, but it means you own the consent logic, the logging and the testing.

The WP Consent API plugin lets WordPress plugins (including Google's Site Kit) read the consent state set by a CMP. Check that your CMP and your other plugins support it, or you will have tags that ignore the banner.

What the banner and cookie policy must tell visitors

Valid consent has to be informed. A one-line "We use cookies to improve your experience" does not meet that bar. The first layer should say, in plain language, what you want to do and with whom; the second layer and the cookie policy carry the detail.

• The purposes in plain words: measuring visits, showing ads on Google and Meta, remembering preferences.
• The categories of partners or the named vendors that receive data (Google, Meta, TikTok, your analytics tool).
• Accept all and Reject all with equal size, colour weight and position, plus a link to granular settings.
• A link to the cookie policy listing each cookie, its provider, purpose and lifetime.
• A permanent way to change the choice later, usually a "Cookie settings" link in the footer.
• The same banner and choices in every language the store sells in.

Avoid "cookie walls" that block the store until the visitor accepts. Several DPAs have found that refusing access unless the visitor accepts tracking makes consent not freely given.

The banner and your Core Web Vitals

A badly built banner is also a performance problem. It is often the largest element on a mobile screen, so it can become the Largest Contentful Paint element, and a banner that pushes content down when it appears causes layout shift (CLS).

• Load the CMP script early but keep it small; avoid CMPs that pull several hundred kilobytes before first paint.
• Render the banner as an overlay fixed to the bottom of the viewport, so it does not push the page content.
• Do not hide the page behind a full-screen overlay; it hurts both conversion and the "freely given" test.
• Test the product page and checkout on a mid-range phone with the banner visible, not only after you have accepted it.

Selling to the UK as well

If you also sell to British customers, the UK rules are close but separate. PECR still requires consent for most non-essential cookies, and the ICO expects rejecting to be as easy as accepting. Since the Data (Use and Access) Act 2025, however, PECR allows analytics cookies used only to produce statistics that improve your own site without consent, provided you give clear information and a simple, free way to object; advertising cookies still need consent. See the ICO's guidance on storage and access technologies. Google treats UK traffic like EEA traffic for the ad_user_data signal. One banner configured to EU standards usually satisfies both.

Step by step: setting up Consent Mode v2 in WooCommerce

1. Inventory what your store loads

• List every tag and script: GA4, Google Ads, Merchant Center conversion tags, Meta Pixel, TikTok, Pinterest, Hotjar or Clarity, chat widgets, embedded YouTube.
• Mark which are essential (cart, checkout, payment, fraud prevention, login) and which need consent.
• Check plugins that inject their own tracking, such as review widgets and marketing plugins.

2. Set the default consent state before any tag fires

The default command must run before Google tags load. A typical default for European visitors looks like this:

gtag('consent', 'default', {
  ad_storage: 'denied',
  analytics_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  wait_for_update: 500
});

When the visitor chooses, the CMP sends an update with the granted signals, for example gtag('consent', 'update', { analytics_storage: 'granted' }). If you sell outside Europe too, you can use the region parameter to apply different defaults by country; get that rule approved before relying on it.

3. Map banner categories to signals

Banner category	Consent Mode signals	Typical tools
Necessary	None (always on)	Cart, session, payment, security
Statistics / Analytics	analytics_storage	GA4, Microsoft Clarity
Marketing / Advertising	ad_storage, ad_user_data, ad_personalization	Google Ads, Merchant Center, Meta, TikTok
Preferences	Usually none for Google	Language, currency memory

Some CMPs let visitors grant ad storage but refuse personalisation. Make sure each toggle maps to the right signal.

4. Block non-Google tags properly

Consent Mode does nothing for Meta, TikTok or Pinterest. Fire them from Tag Manager only on a consent trigger, let the CMP block them, or use their own consent controls (for the Meta Pixel, fbq('consent', 'revoke') before init and fbq('consent', 'grant') after consent). Server-side tagging and the Meta Conversions API still need a consent check before you send events.

5. Test it

• Open the store in a private window with Google Tag Assistant: the consent state should show denied on page load, before you touch the banner.
• Refuse: no _ga or _gcl cookies should appear, and no Meta Pixel requests should fire.
• Accept: the update command fires, cookies appear, and tags send events.
• Change your choice from the footer link: withdrawing must be as easy as accepting.
• Check Google Ads diagnostics and Google Analytics' consent settings page for consent signals from EEA users.
• Place a test order: the purchase conversion must still be tracked when consent is granted.

6. Keep records and keep it current

• Log consent choices with timestamp and banner version, so you can prove consent.
• Re-scan the store after every new plugin; new trackers appear silently.
• Update the cookie policy when you add tools.
• Re-check the banner when your DPA publishes new guidance.

Common mistakes

• GA4 hard-coded in the theme and also in Tag Manager, so one copy ignores consent.
• The default command placed after the GA4 tag, so the first hit goes out without consent.
• A banner with only "Accept" and "Settings".
• Consent Mode v1 signals only (ad_storage and analytics_storage), without ad_user_data and ad_personalization.
• Caching plugins serving a cached page with the banner state of another visitor.

What it costs

Item	Typical cost (estimate)
CMP subscription	Free tiers exist; paid plans usually a few to a few dozen euros a month, depending on traffic and domains
Setup in an existing WooCommerce store (inventory, CMP, GTM, Consent Mode v2, testing)	Usually one to three days of work, fixed quote
Advanced mode with legal review and server-side tagging	Larger project, scoped after a call
New Raao store	GDPR-compliant cookie consent is included in every project

All Raao prices are in EUR excluding VAT, with fixed quotes. Every store we build, from the Starter package (from €1,900) up, ships with legal pages and GDPR cookie consent. See ecommerce and pricing. If you want us to review your current banner and tags, book a free 30-minute call.

What we check in a consent audit

We have no public case study dedicated to consent, so here is exactly what we look at when we take over a store:

• Which cookies and requests fire before any interaction with the banner.
• Whether Accept and Reject are equally visible on the first layer.
• Whether Consent Mode v2 sends all four signals, and in the right order.
• Whether Meta, TikTok and other pixels respect a refusal.
• Whether GA4 and Google Ads receive consent signals from EEA traffic.

Getting this right protects both your compliance and your data. It also matters for stores using server-side tracking and multiple marketing feeds, as on Kuiba, where each new channel is another tag that has to respect consent.