What Consent Mode and TCF signal

How it works

A consent signal is a machine-readable version of the choice made in the banner. Two standards are common:

• Google Consent Mode sets values such as analytics_storage and ad_storage to granted or denied. Google's tags read them and behave accordingly. Version 2 adds ad_user_data and ad_personalization; Google requires them for advertising with user data from the EEA.
• IAB TCF (Transparency & Consent Framework) is the advertising industry's standard. The consent tool stores the choice as a TC string and provides it through the __tcfapi interface, where advertising services query it.

The signal tells the services what the visitor chose. It does not decide whether a script loads or what it sends. Consent Mode comes in two kinds: in basic mode, Google's tags load only after consent. In advanced mode, they load straight away and, with denied, send data to Google without cookies.

After “Reject”, bytereport reads what Consent Mode and TCF report and compares it with the requests. If the page reports “denied” and tracking requests carry on regardless, the report adds a note.

What matters

• The signal does not replace blocking. What matters is that no tracking requests run after a rejection (see after “Reject”). A signal without requests is fine; no signal at all, with services cleanly blocked, is fine too.
• Default denied. The default applies until someone agrees and must be set before any Google tag loads.
• Basic mode is the clear route. Advanced mode sends data to Google before consent. Whether that is permissible is something to settle with your data protection officer before you use it.
• TCF only with a suitable tool. The TCF needs a consent tool registered with IAB Europe and is mainly meant for sites with programmatic advertising.

How to set it up

Most consent tools have a setting, or a Google Tag Manager template, that sets Consent Mode and updates it when a choice is made. Without a template, the default looks like this and goes before the tag manager or gtag snippet:

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('consent', 'default', {
    ad_storage: 'denied',
    ad_user_data: 'denied',
    ad_personalization: 'denied',
    analytics_storage: 'denied'
  });
</script>

After consent, the consent tool calls gtag('consent', 'update', …) with granted for the chosen purposes. You switch the TCF on in the consent tool. Whoever looks after the website sets up both, often together with the agency that runs your advertising and analytics.

This is not legal advice; your data protection officer or a lawyer decides the individual case.