Connect your cookie banner to Consent Mode v2: Cookiebot, Usercentrics, Borlabs Cookie, Real Cookie Banner

The banner is there, the signals maybe not

A cookie banner on the page does not mean Google Analytics and Google Ads learn about the consent. Consent Mode v2 is a second channel next to that: four signals your banner has to hand to the Google tags, once as a default before the decision and once as an update after it.

That channel is exactly what is often missing or wired up wrong. This guide shows for Cookiebot, Usercentrics, Borlabs Cookie and Real Cookie Banner which setting produces the signals according to the vendor’s documentation, how Shopify solves it in the shop and how you check in ten minutes whether the signals really arrive.

---

The four signals in short

Consent Mode v2 works with four signals, each of which can be granted or denied:

Signal	Governs
ad_storage	Storage for advertising, for example conversion cookies
ad_user_data	Whether user data may be sent to Google for advertising purposes
ad_personalization	Whether the data may be used for personalised advertising
analytics_storage	Storage for analytics, for example the GA4 client identifier

First the page sets a default before any Google tag loads:

gtag('consent', 'default', {
  'ad_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied',
  'analytics_storage': 'denied',
  'wait_for_update': 500
});

After the decision in the banner comes the update:

gtag('consent', 'update', {
  'ad_storage': 'granted',
  'ad_user_data': 'granted',
  'ad_personalization': 'granted',
  'analytics_storage': 'granted'
});

Google’s consent mode documentation requires the default command to come before any command that sends measurement data. This is where most banner integrations fall over: the banner does send an update, but the Google tag was faster.

How to set up the signals in Tag Manager in general is covered in the GA4 Consent Mode v2 guide. Whether your tags should send nothing or cookieless signals before the decision is settled in Consent Mode Basic vs Advanced.

---

What changed on 15 June 2026

Until June 2026 there were two switches for the advertising data coming out of Google Analytics: the consent signal ad_storage and the Google Signals toggle in the GA4 property.

According to Google Analytics Help, Google Analytics has transitioned since 15 June 2026 to Consent Mode as the single control. Since then the Google Signals toggle only governs whether Analytics data is associated with signed-in users for reporting. Which advertising data goes from Google Analytics to the linked Google Ads account is decided by the consent signal alone.

For you this means: the mapping of your banner categories to ad_storage, ad_user_data and ad_personalization is now the only switch. Google Signals being off no longer protects you. Cookiebot describes the consequence for accounts with Google Signals off in its own documentation: Google Ads starts using advertising cookies as soon as users consent to ad_storage. If you do not want that, set the default for ad_storage to denied.

---

Cookiebot

Cookiebot is listed as a certified CMP on Google’s partner page. According to the Cookiebot documentation, the Cookiebot script sends the update after consent automatically. The default is something you have to ensure yourself, in one of three ways depending on how the script is embedded.

Embedding via Google Tag Manager, described in Cookiebot’s GTM deployment guide:

1. Add the “Cookiebot CMP” template from the Tag Manager template gallery to your workspace.
2. Create a new tag of type Cookiebot CMP and paste the Domain Group ID from your Cookiebot account into the “Cookiebot ID” field.
3. Choose “Consent Initialization - All Pages” as the trigger.
4. Check the default in the “Default Consent State” section. Without an entry, denied applies until the user has decided.

According to the same guide, Cookiebot’s categories are mapped to the signals in a fixed way:

Cookiebot category	Signal
marketing	ad_storage, ad_user_data, ad_personalization
statistics	analytics_storage
preferences	functionality_storage, personalization_storage
necessary	security_storage, always allowed

Embedding via the WordPress plugin: enable the Google Consent Mode option in the plugin and keep the plugin up to date.

Embedding the script directly: insert the default snippet with the attribute data-cookieconsent="ignore" before gtag.js or the GTM snippet. Cookiebot additionally recommends the attribute data-consentmode-defaults="disabled" on the Cookiebot script so that your own default applies rather than Cookiebot’s fallback default.

On pricing, the documentation says explicitly: Consent Mode is included in every Cookiebot subscription, including the free one.

---

Usercentrics

Usercentrics is also listed on Google’s partner page. The step-by-step guide says it plainly: Usercentrics does not handle the default itself. You set it either with a script as high as possible in the head after the banner script or through the Usercentrics template in Tag Manager in the “Default Consent State” section with “Add region”.

The banner sends the update by default. The toggle for it sits in the Admin Interface under “Configuration > CMP Settings”.

The second important point: Usercentrics does not map categories to signals but individual Google services from its own database. According to the guide:

Service in the Usercentrics configuration	Signal
Google Analytics 4	analytics_storage
Google Ads, Google Ads Conversion Tracking, Google Ads Remarketing, Conversion Linker	ad_storage
Display & Video 360, Campaign Manager 360, Search Ads 360	ad_storage

ad_user_data and ad_personalization follow the value of ad_storage. Three rules from the documentation:

1. If no Google service is in the configuration or it was added as a custom service, no signal is set on the update.
2. If several services hang on the same signal, all of them must be consented to before the signal goes to granted.
3. At least one service must exist for each signal. Missing services are added under “Service Settings > Data Processing Services” with “Add DPS via Database”.

Basic or Advanced is decided, according to the article on Advanced and Basic, by the triggers in Tag Manager, not by a setting in the banner.

---

Borlabs Cookie (WordPress)

Borlabs Cookie 3.0 supports Consent Mode v2, documented in the Borlabs documentation. Two routes:

Without Tag Manager: install the “Google Analytics” or “Google Ads” package from the library. According to Borlabs, Basic mode is already enabled once the respective package is installed.

With Tag Manager, described in the guide to Google Tag Manager in Borlabs Cookie 3.0 (German only):

1. Open the Google Tag Manager package under “Bibliothek”, click “Details” and enter the GTM ID under “Google Tag Manager - Einstellungen”.
2. Enable the option to store Tag Manager locally. The service group of the GTM service then switches from “Statistik” to “Essenziell”. Tag Manager may then load before consent, as long as the tags in the container only fire after consent.
3. Switch on “Aktivieren des Einwilligungsmodus” and assign the service groups to the consent types. In the documentation’s example, consent to the “Marketing” group triggers the signals Ad Storage, Ad User Data, Ad Personalization and Personalization Storage.
4. Every assigned service group needs at least one active service, otherwise the assignment does not take effect.
5. For services whose code Tag Manager delivers, enable “Code-Ausführung deaktivieren” under “Zusätzliche Einstellungen” in the service settings.

Two notes from the same guide that are often overlooked: with local storage, changes in the GTM container only become active once you click “Einstellungen speichern” in the Google Tag Manager service. And Tag Assistant always loads the standard code, not the local copy.

On certification, Borlabs writes in a separate article that its application to the partner programme is pending and that certification is not required to use Consent Mode.

---

Real Cookie Banner (WordPress)

The devowl documentation describes the entry point under “Cookies > Settings > Google Consent Mode”. There you activate Google Consent Mode. The option “Google Tag Manager integration” passes the consents to Tag Manager as additional consent types, next to it are options such as “Collect additional data via URL parameters” and “Redact ads data without consent”.

The mapping to the signals happens per service. According to the documentation, the service templates come pre-filled for this, you can adjust the mapping in the service configuration.

For Tag Manager, the GTM guide describes this route:

1. Create the “Google Tag Manager” template under “Services (Cookies) > Add service”. If Tag Manager is already embedded in the theme, enable “Create content blocker for this service” so it is blocked until consent.
2. Switch on “Google Tag Manager integration” in the Consent Mode settings.
3. Each service receives its own identifier under “Technical handling” at “Requested consent types for Google Consent Mode”, for example google-analytics-analytics-4.
4. In Tag Manager, choose “Require additional consent for tag to fire” on the respective tag and enter the identifier under ”+ Add required consent”.
5. In Tag Manager, enable the consent overview under “Admin > Container Settings”.

The older event-based route is described in the guide to Google Tag Manager or Matomo Tag Manager: under “Settings > General” choose the tag manager at “Load services after consent via” and assign opt-in and opt-out events per service under “Event names for Google Tag Manager”. In both cases the consent signals come from the Consent Mode setting.

Real Cookie Banner is not listed on Google’s partner page as of this article. The documentation makes no statement about plan limits for Consent Mode.

---

Shopify: the Customer Privacy API

A different logic applies in the shop. According to Shopify Help, Shopify ships its own banner, configured under “Settings > Customer privacy > Cookie banner”. New stores have “Use automated settings” active, the banner then appears for visitors from the EEA and the United Kingdom, provided markets are active there.

The consent ends up in the Customer Privacy API. It knows four purposes: analytics, marketing, preferences and sale_of_data. The decision is set with setTrackingConsent, read with currentVisitorConsent (values yes, no or empty for undecided) and on every change the event visitorConsentCollected fires.

For Google, Shopify Help on privacy settings states: if you use a third-party banner, you must integrate it with Shopify’s customer privacy settings and remove the Shopify banner under “More actions > Remove cookie banner”. If you use your own custom pixel, you must insert the Consent Mode call into the pixel code yourself. Shopify provides an example in its Tag Manager pixel tutorial and points out that the example values may not fit every region.

The consequence: your WordPress banner does not talk to the Customer Privacy API.

---

Test protocol for every banner

This protocol works regardless of vendor, because it only checks what arrives at Google.

1. Open a private window, start the developer tools on the Network tab and filter for collect and doubleclick before the page loads.
2. Load the page and click nothing. Look at the first requests to google-analytics.com and googleads.g.doubleclick.net. In Basic mode nothing may appear here at all. In Advanced mode, requests appear with the gcs parameter in the denied state.
3. Read the gcs and gcd parameters. According to the Usercentrics documentation, gcs starts with G1 followed by two digits: the first stands for ad_storage, the second for analytics_storage, 0 means denied, 1 granted. gcd contains the state of default and update for all four signals in one string.
4. Run through the four cases, each in a fresh private window:

Case	Expectation in the request
Reject all	all four signals denied, no analytics or advertising cookies
Accept all	all four signals granted, new request with gcs on granted
Analytics only	analytics_storage granted, the three ad_ signals denied
Withdraw after consent	update to denied, no measurement with an identifier afterwards

5. Open Tag Assistant, load the page and, following Google’s verification guide, select the earliest Consent event in the summary. In the Consent tab, the “On-page Default” column must show Denied and the API Call section must contain all four parameters. After clicking accept, select the most recent Consent event and see Granted under “On-page Update”.
6. An empty Consent tab means, according to Google, that consent mode is not implemented or the Google tag was blocked.
7. Repeat all of it on a second page type, on Shopify at least on a product page and in the checkout.

---

What mistakes look like

Default after the Google tag. In Tag Assistant the entry under “On-page Default” is missing or Google reports that the ad tag already read or wrote a cookie before the default was set. The cause is almost always the order: with Cookiebot the missing “Consent Initialization” trigger, with Usercentrics the missing default script, with Borlabs a tag in the container that fires without a consent condition.

Category on the wrong signal. The “analytics only” case delivers ad_storage as granted or analytics_storage stays denied after full consent. With Usercentrics this is usually a Google service that is missing or was added as a custom service, with Borlabs a service group without an active service, with Real Cookie Banner a service template with an altered mapping.

Two banners side by side. If you copy the WordPress banner into the shop as well, you have two systems there: the copied banner and Shopify’s Customer Privacy API, which knows nothing about it. Shopify points out that without a connected third-party banner, non-essential data may not be collected at all.

Container change does not arrive. With Borlabs and locally stored Tag Manager, the change looks correct in Tag Assistant, live the old copy applies until “Einstellungen speichern” is clicked.

---

What FW Delta does

The link between banner and signals is one block of the measurement setup. FW Delta sets up the technical side: default before the Google tag, documented mapping, triggers, the Shopify side and the test protocol above with recorded results. The GA4 and Consent Mode v2 service covers the consent layer, the web tracking service covers the measurement foundation around it.

Whether your setup sends the signals correctly today is what the tracking check looks at, based on the real requests from your site.

The legal assessment of the banner texts, the categories and the legal bases stays with you or your legal advisers. This guide is a technical explanation, not legal advice.