Consent Mode v2 init snippet · multi-region (EU + US)

Default-deny init. Paste as the FIRST script in <head>, before any Google tag (GTM, gtag.js, AdSense) loads. Your CMP must call gtag('consent', 'update', …) on user choice.

Scope law GDPR Last reviewed 2026-05-05

Editorial research — not legal advice

Signal	Default · EU/EEA/UK/CH	Default · US	After Accept	After Reject	What it controls
`ad_storage`	denied	granted	granted	denied	Cookies for advertising (DoubleClick, etc.)
`ad_user_data`	denied	granted	granted	denied	Send user data to Google for ad measurement
`ad_personalization`	denied	granted	granted	denied	Personalised advertising (remarketing audiences)
`analytics_storage`	denied	granted	granted	denied	Analytics cookies (GA4 _ga, _ga_<container>)
`functionality_storage`	denied	granted	granted	denied	Functional cookies (UI state, language)
`personalization_storage`	denied	granted	granted	denied	UI personalisation (recommendations, themes)
`security_storage`	always	always	always	always	Strictly necessary (CSRF, auth, fraud detection)

Template body

<!-- Multi-region Consent Mode v2 — different defaults per region -->
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag() { dataLayer.push(arguments); }

  // Strict default-deny for EU/EEA/UK/CH
  gtag('consent', 'default', {
    'ad_storage':           'denied',
    'ad_user_data':         'denied',
    'ad_personalization':   'denied',
    'analytics_storage':    'denied',
    'wait_for_update':      500,
    'region': ['AT','BE','BG','HR','CY','CZ','DK','EE','FI','FR','DE','GR','HU','IE','IT','LV','LT','LU','MT','NL','PL','PT','RO','SK','SI','ES','SE','GB','NO','IS','LI','CH']
  });

  // California / Virginia / Texas / Colorado / Connecticut — granted with opt-out
  gtag('consent', 'default', {
    'ad_storage':           'granted',
    'ad_user_data':         'granted',
    'ad_personalization':   'granted',
    'analytics_storage':    'granted',
    'region': ['US-CA','US-VA','US-TX','US-CO','US-CT']
  });

  // Rest of US — granted (no state-level consent baseline yet)
  gtag('consent', 'default', {
    'ad_storage':         'granted',
    'ad_user_data':       'granted',
    'ad_personalization': 'granted',
    'analytics_storage':  'granted'
  });
</script>

<!-- Then your CMP/preference center handles the GPC + IAB GPP signals on the US side and updates per-user -->