Technically, yes: you can set the Consent Mode v2 signals by hand in gtag (consent default "denied" plus a consent update when the user chooses). Practically it's fragile — you still need a banner UI, real blocking of trackers before consent, proof of the choice, and all four signals updated correctly. A CMP solves all of that out of the box; below is when the manual effort is worth it and when it isn't.
What Consent Mode v2 is and what it isn't
Consent Mode v2 is the mechanism by which Google tags (Analytics, Ads) receive the consent state and adjust their behaviour. Since March 2024 it is required for Google advertising features in the EEA. It has four signals:
ad_storage— advertising cookies;analytics_storage— statistics cookies;ad_user_data— sending user data to Google for advertising;ad_personalization— ad personalization (remarketing).
The key point, often misunderstood: Consent Mode is not a banner and it blocks nothing on its own. It only communicates a state. If you send "granted" without the visitor actually choosing, or you let trackers fire anyway, correctly configured Consent Mode won't save you. It's the signalling layer, not the consent layer.
What the manual, CMP-less setup looks like
The by-hand route means writing the gtag calls yourself. You set a restrictive default state before any tag loads, then update it when the user accepts:
- Default state "denied" — before the Google tags load, you call
gtag('consent', 'default', {...})with all four signals set to "denied". - Your banner shows accept and reject options (you have to build and style it yourself).
- Update on choice — on accept, you call
gtag('consent', 'update', {...})flipping the signals to "granted"; on reject, you leave them "denied". - Blocking the other trackers that aren't Google (Meta Pixel, Hotjar, chat) is entirely on you — Consent Mode doesn't handle them.
For the exact syntax and call order, the Consent Mode v2 in Romania guide goes into detail, and how to verify Consent Mode v2 shows you how to confirm the signals leave correctly.
Why the manual route is fragile
"Technically possible" doesn't mean "easy to keep correct". Here's what you have to get right by hand, every time:
| Requirement | Manual, no CMP | With a CMP |
|---|---|---|
| All four signals, in the right order | You write and test them; an ordering mistake goes unnoticed. | Sent out of the box, verified. |
| Real blocking before consent | You implement it separately for each non-Google tracker. | Included for all scripts. |
| Proof of consent | You have to store it yourself (who, what, when). | Kept automatically. |
| Banner UI (accept + equal reject) | You build and maintain it by hand. | Ready-made, bilingual. |
| Updates when Google changes things | You track and apply them yourself. | Updated by the provider. |
Each row is a place you can fail silently. A missing signal, or a banner without a reject button as visible as accept, leaves you non-compliant even though you "have Consent Mode".
When manual makes sense and when a CMP does
It's not an ideological choice, it's one of risk and time. The manual route can be reasonable if: you have a single simple site, you only use Google tags (no Meta Pixel, chat or heatmaps), you have someone technical who can maintain the code, and you're willing to periodically check the signals still leave correctly.
A CMP becomes the obvious choice when: you have several trackers to block, you want a banner and policies in Romanian and English, you need proof of consent without building the storage yourself, or you simply don't want your legal layer to depend on a JavaScript file you maintain by hand. The FewCookies banner sends all four Consent Mode v2 signals out of the box, actually blocks trackers, and includes dark-pattern detection — at €6/month tax included and a 7-day trial with no card.
Whichever you choose, verify the result
Whether you write gtag by hand or use a CMP, the only thing that matters is what actually happens in the browser. Confirm with two tools:
- The Consent Mode v2 checker: run the free check to see whether all four signals are present and start as "denied".
- A full scan: a free scan at /check shows whether any tracker fires before consent anyway — including the non-Google ones Consent Mode never touches.
If you want to understand why getting this layer right matters so much, see the article on Google Analytics without consent, and for the full self-audit, how to check if your site is GDPR-compliant.
Frequently asked questions
Is Consent Mode v2 mandatory?
Since March 2024, Consent Mode v2 is required for Google advertising features (Google Ads, remarketing) for EEA traffic. If you use these services without the four consent signals, Google limits functionality. It isn't a law in itself, but a technical Google requirement on top of the GDPR and Law 506/2004 obligations.
Does Consent Mode v2 replace a cookie banner?
No. Consent Mode only communicates the consent state to Google; it doesn't show a banner or block trackers on its own. You still need a UI that asks for consent and real blocking of non-essential scripts before the choice. Consent Mode is the signalling layer, not the consent layer.
Will I lose analytics data if I implement Consent Mode v2?
When a visitor rejects, Google can send cookieless "pings" and Analytics estimates part of the data through modelling instead of collecting everything. You lose granularity for those who reject, but keep useful aggregate data and, in return, collect legally. That's the right trade-off: valid data instead of illegal data.
Want to see which cookies and trackers fire on your site before consent? The scan is free and needs no account. Check your site for free →