Shopify Consent Mode v2 with Google Tag Manager: Setup Guide

What Consent Mode v2 is

Consent Mode is Google's mechanism for passing a visitor's consent state to its tags (GA4, Google Ads, Floodlight, and others). Instead of simply firing or not firing a tag, the tag adjusts what it does: whether it may read or write cookies, and whether it may use data for advertising purposes.

Version 2 added two new signals to the original two. Since March 2024, Google has required v2 signals to use audience and remarketing features and to measure conversions for visitors in the European Economic Area and the UK. If you advertise to those regions through Google Ads, this is not optional.

The four consent signals

Each signal is either granted or denied. There are additional signals (functionality_storage, personalization_storage, security_storage), but the four above are the ones that matter for Shopify ecommerce tracking.

Basic mode vs advanced mode

• Basic mode: Google tags do not load at all until the visitor consents. Nothing is sent from visitors who decline. Simple and conservative, but you lose all measurement for non-consenting visitors.
• Advanced mode: Google tags load immediately with all signals defaulting to denied. Before consent they send cookieless pings without identifiers, and if the visitor consents, tags upgrade to full measurement. Google can use those pings for conversion and behavioral modeling to partly fill the gap, subject to volume thresholds.

Which one you choose is a business and legal decision. Advanced mode recovers more data, while basic mode is the stricter interpretation. Ask your privacy counsel if you are unsure. This guide is general information, not legal advice.

What is specific to Shopify

• Two places tags run. Storefront GTM (in your theme) and the GTM instance inside your Customer Events custom pixel are separate. Each needs the right consent state.
• Shopify has its own privacy layer. Shopify's customer privacy settings and Customer Privacy API determine whether pixels run and expose the visitor's consent state to them. Make sure Shopify's settings and your CMP do not contradict each other.
• Sandbox boundaries. The pixel cannot read consent set by scripts in your theme. Forward the consent state into the pixel's GTM instance (for example with a consent update pushed when Shopify reports the visitor's choice).

Background on the pixel side is in the Customer Events guide.

Setting up Consent Mode v2 with GTM

1. Choose a CMP that supports Google Consent Mode v2. Common options include Enzuzo, Iubenda, CookieYes, OneTrust and Cookiebot. Many provide a GTM template.
2. Enable the consent overview in GTM (Admin → Container settings → Enable consent overview) so you can see each tag's consent requirements.
3. Add the CMP's GTM template tag and fire it on the Consent Initialization – All Pages trigger, so defaults are set before any other tag runs.
4. Set default consent states. Typically denied for all four signals in regions that require consent (EEA, UK, and others as advised), and granted elsewhere if your policy allows. Use region-specific defaults rather than one global value.
5. Make the CMP update consent when the visitor chooses, so GTM sees the change in the same session.
6. Review tag consent settings. Google tags have built-in consent checks. For non-Google tags (Meta, TikTok, Pinterest and so on), add additional consent checks, for example requiring ad_storage.
7. Mirror consent into the Customer Events pixel so checkout events respect the same choice.

How to test that it works

• In GTM Preview, open the Consent tab for a given event to see the default and updated state, and confirm tags with consent requirements are blocked or allowed as expected.
• In your browser's Network tab, look at Google requests (to google-analytics.com or googletagmanager.com) for the gcs and gcd parameters, which encode the consent state sent.
• Test three paths: first visit with no choice, after accepting all, and after rejecting all. Placing a test order on each path helps confirm purchase behavior.
• Check GA4 and Google Ads diagnostics for consent-related warnings over the following days.

Common Consent Mode mistakes

• Default set too late. If the default fires after tags, early hits ignore consent. Use Consent Initialization.
• CMP not sending the v2 signals (ad_user_data, ad_personalization), only the original two.
• Non-Google tags ignoring consent. Meta, TikTok and Pinterest tags need explicit consent checks, as they do not read Google's signals on their own.
• Pixel and theme out of sync. The theme GTM respects consent while the checkout pixel fires regardless.
• Assuming consent mode replaces a banner. It only transmits the state. You still need a compliant way to collect it.

Consent Mode in the tagging packs

Both Shopify DIY Tagging Packs include a Consent Mode GTM container you can import. It already contains a consent tag configured for Enzuzo, and it can work alongside other CMPs such as Iubenda, CookieYes, OneTrust and Cookiebot. Final behavior depends on your banner configuration, consent categories and regional settings, so configuring each platform's consent individually is a separate piece of work. Watch the Consent Mode v2 video walkthrough for the setup, and see what each pack includes.