Consent Mode v2 init snippet · EU/EEA default-deny

Default-deny init. Paste as the FIRST script in <head>, before any Google tag (GTM, gtag.js, AdSense) loads. Your CMP must call gtag('consent', 'update', …) on user choice.

Scope law GDPR Last reviewed 2026-05-05

Editorial research — not legal advice

Signal	Default · EU/EEA/UK/CH	Default · US	After Accept	After Reject	What it controls
`ad_storage`	denied	granted	granted	denied	Cookies for advertising (DoubleClick, etc.)
`ad_user_data`	denied	granted	granted	denied	Send user data to Google for ad measurement
`ad_personalization`	denied	granted	granted	denied	Personalised advertising (remarketing audiences)
`analytics_storage`	denied	granted	granted	denied	Analytics cookies (GA4 _ga, _ga_<container>)
`functionality_storage`	denied	granted	granted	denied	Functional cookies (UI state, language)
`personalization_storage`	denied	granted	granted	denied	UI personalisation (recommendations, themes)
`security_storage`	always	always	always	always	Strictly necessary (CSRF, auth, fraud detection)

Template body

<!-- Consent Mode v2 default-deny — paste as the FIRST script in <head>, before GTM/gtag -->
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag() { dataLayer.push(arguments); }

  // Default-deny for all consent signals (EU/EEA/UK/CH baseline)
  gtag('consent', 'default', {
    'ad_storage':           'denied',
    'ad_user_data':         'denied',
    'ad_personalization':   'denied',
    'analytics_storage':    'denied',
    'functionality_storage': 'denied',
    'personalization_storage': 'denied',
    'security_storage':     'granted',  // always granted — strictly necessary
    'wait_for_update':      500          // 500ms grace period for CMP to load and call update
  });

  // Set developer ID for Consent Mode v2 (replace XXXX with your value, optional)
  // gtag('set', 'developer_id.dXXXXXX', true);
</script>

<!-- After your CMP renders the banner and the user clicks Accept/Reject, your CMP must call: -->
<!-- (this is what your CMP does internally — for reference only)
<script>
  gtag('consent', 'update', {
    'ad_storage':         'granted',  // or 'denied' based on user choice
    'ad_user_data':       'granted',
    'ad_personalization': 'granted',
    'analytics_storage':  'granted'
  });
</script>
-->