Consent Mode v2 and enhanced conversions in GTM: a checklist

If your measurement setup lacks Consent Mode v2, enhanced conversions and, for lead generation, CRM conversion imports, Google Ads is optimizing with less data than it could have. All three are implemented with Google Tag Manager and can be validated in a couple of hours. This is the checklist I use when I review an account’s tracking.

Key takeaways

• Consent Mode v2 adds two signals, ad_user_data and ad_personalization, to the existing ad_storage and analytics_storage.
• Google has required it for European Economic Area traffic since March 2024. Elsewhere it is not mandatory for Google, but it helps with local privacy laws and with any European visitors you get.
• Enhanced conversions send hashed first-party customer data (email, phone) to recover conversions that cookies no longer capture.
• If you generate leads, the conversion that matters is the closed deal in your CRM, not the submitted form.
• Server-side GTM pays off with high traffic, or when you need to enrich data without exposing it in the browser.

Consent Mode v2: what it is and what changed

Consent Mode is how your Google tags learn what the user accepted in your cookie banner. Version 2 adds two parameters:

• ad_user_data: whether the user agrees to their data being sent to Google for advertising.
• ad_personalization: whether they agree to it being used to personalize ads, for example in remarketing.

Without these signals, Google stops using that data for audiences and conversion measurement for users in the European Economic Area. If you get European traffic, even a small share, this already affects you.

Basic or advanced mode

In basic mode, Google tags do not load until the user consents. If they decline, nothing is sent, and Google estimates the lost conversions with a general model.

In advanced mode, tags load with consent denied by default and send cookieless pings while the user has not accepted. That allows more accurate, advertiser-specific modeling. Choosing between them is also a legal decision, so review it with whoever advises your company on privacy.

Why it matters outside Europe

Three reasons. If you get visitors from Europe, Google’s rules already apply to that traffic. Many countries and US states now have privacy laws, and a banner that genuinely blocks tags based on the user’s choice is the foundation for complying with them. And the discipline Consent Mode forces (which tag fires, when, with what permission) tends to surface tracking problems nobody had noticed.

GTM implementation checklist

1. Pick a consent management platform (CMP) that supports Consent Mode v2 and has a GTM template.
2. Set the default consent state before any tag fires, using the “Consent Initialization - All Pages” trigger.
3. Set region-specific defaults if you need them: denied for the EEA, whatever you decide for everywhere else.
4. Make sure the banner sends a consent update when the user chooses, and that it persists on subsequent pages.
5. Check that Google Ads, GA4 and Floodlight tags use built-in consent checks, and that third-party tags (Meta, TikTok, others) have additional consent requirements configured.
6. Remove duplicate tags: the same pixel loaded from the site code and from GTM is one of the most common causes of inflated conversions.
7. Document in the container which tag depends on which consent type.

Enhanced conversions for web

Enhanced conversions take data the user already gave you at checkout or in a form (email, phone, name, address), hash it with SHA-256 and send it along with the conversion. Google matches it against signed-in users and recovers conversions that would otherwise be lost to blocked or deleted cookies.

To implement them:

1. Accept the customer data terms in your Google Ads conversion settings and turn on enhanced conversions.
2. In GTM, create a user-provided data variable. The most reliable source is the data layer your platform builds, not form fields read with CSS selectors that break with every redesign.
3. Attach that variable to the Google Ads conversion tag.
4. Check that the email arrives normalized: lowercase, no spaces.

Enhanced conversions for leads and offline conversions

In lead generation, optimizing for form submissions teaches Google to find more form submissions, not more customers. The fix is to tell it what happens next.

There are two ways to do it:

• With the GCLID. Capture Google’s click identifier (plus the gbraid and wbraid parameters for iOS traffic) in a hidden form field, store it in your CRM with the lead and, when the lead progresses or closes, upload that conversion to Google Ads.
• With enhanced conversions for leads. Instead of the GCLID, you use the hashed email or phone captured in the form. It holds up better when the GCLID gets lost along the way.

Uploads can be scheduled from Google Sheets, handled by native integrations in some CRMs such as HubSpot or Salesforce, or sent through the API. What matters most is defining which stages you import (qualified lead, opportunity, closed deal) and what value each one carries. That is when bidding starts favoring leads that look like your real customers.

How to validate it works

• GTM preview mode. The consent tab shows the default state and the update on each event.
• Tag Assistant. Browse the site accepting and rejecting the banner, and check which tags fire in each case and with what consent state.
• Google Ads diagnostics. On the conversion action, enhanced conversions diagnostics show whether data is coming in and the coverage. It takes a few days to populate.
• Compare with your backend. Match a week of Google Ads conversions against real orders or deals for the same period. They will not match exactly (attribution, modeling, windows), but a large, sudden gap means something broke.

Do you need server-side GTM?

A server-side container receives events on a server you control and forwards them to Google, Meta or other platforms. The benefits are concrete: less third-party code in the browser, the ability to enrich events with data you do not want to expose (such as product margin, which I cover in ROAS vs. POAS), and first-party cookies set by the server, which in browsers like Safari tend to last longer than cookies created by JavaScript.

It also has a cost: monthly hosting and technical maintenance. I recommend it when there is meaningful traffic, several ad platforms, or a need to enrich data. For a small site on a single platform, a well-configured web container is enough.

Reviewing and fixing this setup is part of the measurement work in my service.

Start with item 6 on the checklist: look for duplicate tags on your site. It is the fastest check, and the one that most often changes an account’s numbers.