Free scan

Fix guides

Consent Mode default is not set: how to fix it

Google tags need a consent default (usually "denied") before they fire, so they know what they may do before the visitor answers the banner. Set it with gtag("consent", "default", …) or your consent tool's Consent Mode integration, above the Google tag, and include ad_user_data and ad_personalization for Consent Mode v2.

Check your own site: the free scan tells you in about a minute whether this problem is on your page.

What the finding means

The scan saw a cookie banner, but no gtag("consent", "default", …) command in the dataLayer, and Google's own requests carried no consent default either. Without a default, Google tags behave as if consent was never asked: they may set cookies before the visitor answers, and Google cannot apply Consent Mode modelling to visitors who decline.

For visitors in the EEA and the UK, Google requires Consent Mode v2 signals (ad_user_data and ad_personalization) for ad personalisation and remarketing features. The related findings mean the same setup is incomplete: Consent Mode v2 parameters missing (the default lacks the two v2 parameters) and Consent default is set too late (a Google tag ran before the default).

Fix it with your consent tool (easiest)

Most consent platforms set the default for you once their Google Consent Mode integration is on. Look for a setting called "Google Consent Mode", "Consent Mode v2" or "Google integration" in Cookiebot, CookieYes, OneTrust, Usercentrics, Didomi, Complianz, iubenda or similar, and make sure it is set to v2.

If you use Google Tag Manager, use the consent tool's template from the Community Template Gallery and fire it on the Consent Initialization – All Pages trigger, so it runs before every other tag.

Fix it in code (gtag.js)

Put the default above the Google tag snippet, so it runs first:

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('consent', 'default', {
    ad_storage: 'denied',
    ad_user_data: 'denied',
    ad_personalization: 'denied',
    analytics_storage: 'denied',
    wait_for_update: 500
  });
</script>
<!-- then the Google tag (gtag.js) or GTM snippet -->

When the visitor accepts, update the values your banner covers:

gtag('consent', 'update', {
  ad_storage: 'granted',
  ad_user_data: 'granted',
  ad_personalization: 'granted',
  analytics_storage: 'granted'
});

You can limit the denied default to the countries where you show a banner with the region parameter, for example region: ['AT', 'BE', 'DE', …], and add a second, granted default for everyone else.

Check that it works

  1. Open the page in a private window and, before touching the banner, type dataLayer in the browser console. The first entries should include ["consent", "default", {…}] with all four parameters.
  2. In the Network tab, Google requests (collect, pagead) carry a gcd parameter once a default is set.
  3. Run the Plumfinch scan again: the finding should change to "Consent Mode v2 default is set before tags fire".

Sources

Updated 2026-10-27. Based on the platforms' public documentation; menus and names change, so check the linked pages if a step looks different.