Google Consent Mode v2 for Shopify: Complete Setup Guide

Google Consent Mode v2 is the consent framework that keeps Google Ads and GA4 measuring after a visitor denies cookies, and on Shopify it is the piece most stores configure last because it is the one that runs entirely on the platform side. When a European or UK visitor lands on a Shopify store and rejects the consent banner, the browser refuses to set advertising cookies, and without Consent Mode the conversion Pulse that the store captures server-side never turns into a Google Ads conversion because Google does not know what it is allowed to count. The Shopify signal recovery guide treats this as one of the recovery levers that close the gap between real orders and reported conversions, and this guide covers the v2 specifics: what the four signals control, how modeling fills the gap for denied visitors, and the two working implementations on Shopify.

The Quick Answer

Consent Mode v2 sends four consent signals to Google, in addition to the two that original Consent Mode used. The four are ad_storage, analytics_storage, ad_user_data, and ad_personalization. Google enforced the two new signals, ad_user_data and ad_personalization, for European Economic Area and UK traffic in March 2024, and advertisers who only send the original two lose audience building, remarketing, and part of conversion measurement for EEA visitors. The setup on Shopify maps the store’s own consent state, read through the Customer Privacy API, into these four Google signals, sends them with every page load, and updates them the moment the visitor changes their choice. When a visitor denies consent, Google receives a cookieless ping instead of nothing, and its conversion modeling estimates how many denied visitors converted so campaign optimization keeps data.

What Consent Mode Is

Consent Mode is Google’s mechanism for adjusting tag behavior based on a visitor’s consent choice, and it exists because European regulations require consent before a site reads or writes advertising and analytics cookies. Original Consent Mode carried two signals. ad_storage controlled whether Google could store advertising cookies, and analytics_storage controlled whether Google could store analytics cookies. Version 2, announced in 2023, added ad_user_data, which controls whether user data can be sent to Google for advertising purposes, and ad_personalization, which controls whether personalized ads can be shown. The two new signals came from the EU Digital Markets Act, which required Google to obtain explicit consent before using personal data for targeted advertising in the EEA.

The four signals are boolean, so each is either granted or denied, and a complete implementation sends all four with a default state on every page load before any Google tag fires, then updates the state when the visitor interacts with the consent banner. Google treats a setup that only sends the original two signals as version 1, which means the two newer signals default to denied for EEA traffic and advertising features that depend on them stop working.

Why Consent Mode v2 Matters for Shopify

Consent Mode v2 matters for Shopify because a meaningful share of a store’s traffic comes from regions where the banner decision gates measurement. Any store advertising to the European Economic Area or the United Kingdom must send the v2 signals, and the two newer signals are the ones most setups miss. Without ad_user_data and ad_personalization set to granted for consenting visitors, Google Ads silently degrades measurement by an estimated 20 to 40 percent in EEA and UK regions, per the Digital Heroes implementation research. The degradation does not look like a tracking failure. The store still captures the Pulse, the server still confirms delivery, and Clarity Score stays healthy, yet the conversion is held on the Google side because the consent state says Google may not use the data for advertising.

The enforcement is not optional for EEA traffic. Since March 2024, Google requires the v2 signals for advertising features in the EEA and UK, and without them audience building and remarketing stop, and conversion measurement degrades for visitors who have not granted consent. A store can lose conversion visibility on a large traffic segment without any change to its server-side tracking.

Basic vs Advanced Consent Mode

Consent Mode ships in two implementations, and the choice determines how much conversion data Google can model. Basic consent mode blocks Google tags entirely until the visitor grants consent, which means Google receives nothing for denied visitors and builds a general model based on all advertisers. Advanced consent mode loads the tags with defaults set to denied and sends cookieless pings when consent is denied, which lets Google build an advertiser-specific model calibrated to the store’s own traffic and consent rates.

Advanced mode is the one to use for Shopify advertising. Google’s documentation states that conversion modeling through consent mode recovers, on average, more than half of the ad-click-to-conversion journeys lost to consent, and that advanced settings can recover about twice as much on average. The advertiser-specific model is what makes that recovery possible, and it only works when the store sends the cookieless pings for denied visitors. A basic implementation that blocks tags gives Google a general model with much less recovery.

How Conversion Modeling Fills the Gap

Modeling is how Google estimates conversions for visitors who denied consent, and it works because Google can compare the behavior of consented visitors against the cookieless pings it receives from denied visitors. Google’s analysis of its own data found that consented users are typically two to five times more likely to convert than unconsented users, so modeling cannot simply scale the observed denied-visitor conversion rate. The model uses observable journeys from consented users, applies them to the attribution paths of denied users, and produces an aggregate estimate that respects the consent choice while keeping the optimization algorithm usable.

The quality of the model depends on two things the store controls. The first is that consent mode is implemented on every page, because a page without consent mode creates a gap in the modeling data. The second is that the store sends cookieless pings for denied visitors, because those pings generate the advertiser-specific calibration factors that make the model accurate. Julian Juenemann of MeasureSchool has documented that client-side pixel loss already runs forty to sixty percent for the average Shopify store, and a store that skips cookieless pings adds a consent modeling gap on top of that browser-level loss.

What Each of the Four Signals Controls

ad_storage controls whether Google can store advertising cookies, and when it is denied Google sends requests through a different domain, like pagead2.googlesyndication.com, so previously set third-party cookies are not sent in the request headers. analytics_storage controls whether Google can store analytics cookies for GA4, and when it is denied Google sends cookieless measurement to Analytics for basic measurement and modeling. ad_user_data controls whether user data can be sent to Google for advertising purposes, including hashed first-party data used by enhanced conversions. ad_personalization controls whether personalized ads can be shown to the visitor.

For most Shopify stores, the operational rule is to send all four as granted for consenting visitors and all four as denied for non-consenting visitors. Some stores add ads_data_redaction and url_passthrough for extra privacy handling: ads_data_redaction strips ad click identifiers from the URLs Google receives when ad_storage is denied, and url_passthrough passes ad click, client ID, and session ID information through URL parameters when cookies cannot be stored. Both are advanced options that trade a little measurement precision for stricter data handling.

How Consent State Fits Into Signal Recovery

Consent state is the last gate in the signal recovery chain, and it is the one that signal loss audits most often skip. The Shopify signal loss audit documents consent as a silent governor: the Pulse fires, the server confirms delivery, and Clarity Score reads healthy, yet the conversion is held on the platform side because the consent state says tracking is not allowed. This is why a store can compare Shopify orders against Google Ads conversions and still see a gap after every other leak reads clean.

The consent state is also part of event quality. The CAPI event quality checklist includes passing the current consent state with every purchase Pulse, not a cached default from an earlier session, because a stale consent state reads as signal loss even when the Pulse is delivered. Consent and identity data interact in the same Pulse, and treating consent as a field you send rather than a banner you display is what turns the implementation into measurement.

How to Set Up Consent Mode v2 on Shopify

Shopify does not ship Consent Mode v2 natively. The built-in cookie banner writes consent state through the Customer Privacy API, but it does not translate that state into the four Google signals, and Google never hears the decision. There are two working implementations, and both start with the same foundation: Shopify’s Customer Privacy API, which has been the runtime source of truth for consent state on a Shopify storefront since 2023. The API exposes the store’s consent state and fires a trackingConsent event whenever the visitor changes their choice.

Option 1: A Consent App With v2 Built In

The lowest-effort path is a consent management platform that maps Shopify’s Customer Privacy API to the four Google signals for you. Pandectes, Consentmo, Cookiebot, and ConsentLite all support Consent Mode v2 on Shopify, and most surface only the four operational signals to the visitor while hardcoding the functional and security cookies to granted. The app installs from the Shopify App Store, sets consent defaults to denied for the regions you choose, and calls the consent update command when the visitor accepts. The main checks are that v2 signals are included on the plan you pay for, that the default denied state fires before the Google tag loads, and that the app works inside Shopify’s pixel sandbox rather than requiring you to move your tags.

Option 2: A Custom Script in theme.liquid

The no-subscription path is a short script that reads Shopify’s Customer Privacy API and calls the gtag consent commands directly. The minimum viable implementation is about forty lines of JavaScript in theme.liquid. It sets the four defaults to denied before the Google tag loads, subscribes to the Customer Privacy API consent event, maps the store’s marketing and analytics flags to the Google signals, and calls the update command when consent changes. This gives the store full control and avoids a third-party subscription, at the cost of maintaining the mapping yourself when Shopify or Google changes the API surface.

A complete custom implementation does four things in order. First, it sets ad_storage, analytics_storage, ad_user_data, and ad_personalization to denied as the default state on every page, before any Google tag runs. Second, it loads the Customer Privacy API and reads the current consent state. Third, it maps the store’s marketing flag to ad_storage, ad_user_data, and ad_personalization, and the analytics flag to analytics_storage. Fourth, it listens for the consent change event and calls the update command with the new state whenever the visitor interacts with the banner.

The custom path has one Shopify-specific complication. Google tags running inside Shopify’s Customer Events sandbox are isolated from the main page, so a consent banner that lives on the main page cannot directly communicate with them. A working solution bridges that gap through the Customer Privacy API events, which the sandbox respects, or runs the tags outside the sandbox entirely. The apps solve this for you, which is why most stores choose the app even when they can write the script.

How to Verify the Setup

Verification is where most broken Consent Mode setups are caught, because a misconfigured banner looks correct in the store admin. Open Google Tag Assistant in a Chrome incognito window and load the store. Accept the banner and confirm the consent tab shows all four signals set to granted and that GA4 and Google Ads tags fire normally. Close the incognito window, open a new one, reject the banner, and confirm you see the default denied state plus cookieless pings still firing. The test fails when the consent update never fires after the visitor accepts, which means the banner is writing Shopify state that Google never receives.

In Google Ads, check the Diagnostics tab to see whether Consent Mode is detected and whether conversion modeling is active. The consent mode impact results, available in the Diagnostics tab for eligible domain and country pairs, show the conversion modeling uplift after the modeling start date. Modeling requires eligibility thresholds, including an ad click threshold per country and domain, and advanced implementations do not require the threshold that basic implementations do. If the uplift is lower than expected, the likely causes are consent mode missing on some pages or detected consent rates too low to receive full modeling benefits, both of which point back to the implementation rather than to the store’s offer.

Maintaining Consent Mode as the Rules Shift

Consent Mode is not a set-and-forget configuration. Google continues to expand which destinations expect the signals, the enforcements tighten each year, and Shopify’s theme and checkout surfaces change the way consent state flows. The maintenance cadence matches the rest of signal recovery: a weekly check of Clarity Score per Channel, a monthly re-run of the consent verification in Tag Assistant, and a re-check whenever the theme or checkout changes, because a theme update is the most common way a custom consent script silently stops working.

Stores that treat consent state as a first-class field in their tracking stack, sent with every Pulse and verified against the platform’s own diagnostics, keep Google Ads optimization usable even as consent rates shift. The stores that treat the banner as a compliance checkbox end up paying for clicks they cannot see convert, because the measurement gap that consent leaves behind is invisible until the modeling stops.

FAQ

Does Shopify support Google Consent Mode v2 natively? No. Shopify’s built-in cookie banner writes consent through the Customer Privacy API, but it does not translate that state into the four Google signals. You need a consent app with v2 built in or a custom script in theme.liquid that maps the API state to gtag consent commands.

What are the four Consent Mode v2 signals? ad_storage, which controls advertising cookies, analytics_storage, which controls analytics cookies, ad_user_data, which controls whether user data can be sent to Google for advertising, and ad_personalization, which controls whether personalized ads can be shown. Sending only the original two counts as version 1 and loses the advertising features for EEA traffic.

What happens if I only send the original Consent Mode signals? Google treats the setup as version 1. For European Economic Area and UK traffic, audience building and remarketing stop, and conversion measurement degrades by an estimated 20 to 40 percent, because ad_user_data and ad_personalization default to denied.

How does Consent Mode recover conversions from denied visitors? Advanced consent mode sends cookieless pings when consent is denied, and Google’s conversion modeling uses those pings to build an advertiser-specific model that estimates how many denied visitors converted. Google reports that modeling recovers more than half of lost ad-click-to-conversion journeys on average, with advanced settings recovering about twice as much.

Related Resources

• The Shopify signal recovery guide covers consent as one lever in the full recovery strategy.
• The Shopify signal loss audit documents consent as the silent governor that hides a residual gap after every other leak reads clean.
• The CAPI event quality checklist includes passing the current consent state with every purchase Pulse.
• The iOS privacy playbook for Shopify ads covers the broader privacy landscape that Consent Mode sits inside.