Digital MarketingSearch Engine Optimization

GTM, Consent Mode v2 and click IDs: what we built on our own site

Updated 11 min readBy Jaskirat Singh Talwar

An orange cube and a rounded tile joined by thin lines on a soft blue-grey gradient

The 2017 version of this article gave eight reasons to use Google Tag Manager. They still hold, and they are no longer the point. In 2026 the tag container is where consent, analytics and advertising measurement meet; get it wrong and you either collect data without consent or lose conversions you paid for. When we rebuilt impingesolutions.com we built this from scratch: one GTM container, site code that only pushes events to the dataLayer, Consent Mode v2 denied by default in the EEA, UK and Switzerland and granted elsewhere, a Cookiebot banner only where the defaults deny, GA4 and Google Ads as tags, enhanced conversions for leads, click IDs captured only after marketing consent, and a staff flag to keep our own clicks out. This is what we built, why, and how to repeat it.

Key takeaways

  • Google's consent-mode documentation is explicit about order: call the default consent command "on every page of your site before any commands that send measurement data", because "if your consent code is called out of order, consent defaults won't work".
  • Google's EU user consent policy requires, for end users in the EEA and UK, valid consent for "the use of cookies or other local storage where legally required" and for "the collection, sharing, and use of personal data for personalization of ads".
  • Advanced consent mode loads tags before the choice and sends cookieless pings while consent is denied, which enables Google's advertiser-specific conversion modelling; basic consent mode sends nothing until consent, "not even the default consent status".
  • Enhanced conversions send first-party data hashed with SHA256; the "for leads" variant covers sales that close off the website. Click IDs (gclid, gbraid, wbraid) arrive through auto-tagging.

Why Tag Manager, still

Four of the 2017 reasons survive: one snippet instead of a tag per vendor; a preview mode (now Tag Assistant) that shows which tags fired and with what data; versions you can roll back; and permissions so a contractor can edit a tag without touching the website. Two were overtaken: Universal Analytics is gone (GA4 is a Google tag inside the container), and "built-in tags" now include the consent integrations that matter.

The reason to add in 2026 is control of order: consent defaults must be set before any tag loads, the consent platform must update them, and every tag must respect them. A container with a Consent Initialization trigger and a Consent Overview page is the only sane place to manage that.

What we built

Piece What it does on impingesolutions.com Why
Consent defaults (inline, before GTM) A small script sets all seven consent types to denied for a list of EEA, UK and Swiss region codes and to granted elsewhere, with wait_for_update of 500 ms, ads_data_redaction on and url_passthrough on Google's order rule; the region-specific default wins; no banner where none is owed
GTM container snippet Standard snippet plus the noscript iframe One place for every tag
Site events The site never calls gtag(). One track() helper pushes named events to the dataLayer: generate_lead, newsletter_signup, resume_submit (forms), cta_click with type, text and area, phone_click, whatsapp_click, book_call_open and book_call_scheduled (Calendly) Site code describes what happened; the container decides what to do with it. Changing a destination never needs a deploy
Cookiebot CMP tag The Cookiebot template from the Community Template Gallery, fired on Consent Initialization, configured to show the banner only in the EEA, UK and Switzerland Updates consent mode rather than blocking scripts; banner only where the defaults deny
GA4 Google tag and event tags Page views and the dataLayer events above as GA4 events; generate_lead, book_call_scheduled, phone_click and whatsapp_click marked as key events; custom dimensions for form type, page, CTA type, area and text Key events are the GA4 "goals"; the custom dimensions make the CTA reports readable
Google Ads tag, conversion linker, conversion tags Lead form submit and booked call as primary conversions; phone, WhatsApp and newsletter as secondary; enhanced conversions on the lead form via a user-provided data variable (e-mail and phone from the form, read before the form resets) Primary conversions drive bidding; secondary ones inform without counting twice
Click-ID capture On arrival, gclid, gbraid and wbraid are stored for the tab only, and only if the Cookiebot marketing consent is true; a lead form sends them with the enquiry, the form backend validates them against a strict pattern and prints them in the lead e-mail Lets a closed deal be matched to the ad click later (offline conversion import) without storing anything before consent
Staff flag Opening any page with ?internal=1 sets a first-party cookie; the container then skips Ads conversions and marks GA4 events as internal traffic, which the GA4 filter drops; ?internal=0 clears it Office and home IP filters miss laptops on other networks

None of this needs server-side tagging; for a site of this size a well-ordered web container is enough. All of it is live: the container was published on 14 October 2026, Cookiebot shows its banner only in the EEA, UK and Switzerland, and the phone, WhatsApp and newsletter conversion actions are set to secondary in Google Ads.

Consent Mode v2, in detail

Consent mode is a set of signals Google tags read before deciding what to store and send. The ones we set: ad_storage, ad_user_data and ad_personalization (the three that Google's advertising products read, and that its EU user consent policy requirements for EEA and UK audiences depend on), analytics_storage, and three more that the consent platform uses for its own categories: functionality_storage, personalization_storage and security_storage (always granted).

region sets different defaults per territory: ours deny everything for the EEA members plus Iceland, Liechtenstein, Norway, the UK and Switzerland, and grant elsewhere. wait_for_update gives the CMP a window (we use 500 ms) to apply a stored choice before any tag sends data. ads_data_redaction further redacts ads data while ad_storage is denied, and url_passthrough carries click and session information through URLs when cookies cannot be set.

We chose advanced consent mode. In Google's description, basic mode holds every tag until the visitor responds and sends "no data... not even the default consent status" if they decline, leaving only a general conversion model. Advanced mode loads the tags with the defaults, sends cookieless pings while denied, and switches to full measurement on consent, which enables advertiser-specific modelling. It is only appropriate if your defaults are genuinely denied where consent is required, which is what the region list is for. Visitors outside the EEA, UK and Switzerland are not shown a banner; our privacy policy describes this.

Enhanced conversions and click IDs

Enhanced conversions add hashed first-party data to a conversion. Google's documentation describes "a secure one-way hashing algorithm called SHA256" applied to data such as e-mail, name, address and phone, and distinguishes enhanced conversions for web (sales on the site) from enhanced conversions for leads, for "sales that happen off their website, such as from website leads". Ours is the leads variant: the form's e-mail and phone go into a user-provided data variable at submit time; nothing is written to the page or stored.

Click IDs are the other half. With auto-tagging on, Google Ads appends gclid to landing URLs; gbraid "can help you measure app conversions driven by ad campaigns on iOS" and is added "for all iOS14.5+ clicks"; wbraid was introduced in 2021 "to help comply with Apple's policies" for traffic affected by App Tracking Transparency. We keep all three for the tab, only after marketing consent, and attach them to enquiries so that a lead that becomes a client months later can be reported back to Google Ads with its original click.

How to build it: the procedure

  1. Decide the consent policy with whoever owns legal: which regions see a banner, which consent types default to denied there, what the privacy policy says.
  2. Create one GTM web container and remove every direct gtag.js, GA4 or Ads snippet from the site; two paths to one destination double count.
  3. Put the consent default script inline, before the GTM snippet, on every page, with region arrays for your denied territories, wait_for_update, ads_data_redaction and url_passthrough.
  4. Add the CMP's template tag on the Consent Initialization trigger and set the banner regions in the CMP to match step 1.
  5. Replace every inline analytics call with a dataLayer.push of a named event, and keep the event list in one file in the repository.
  6. Add the GA4 Google tag and one event tag per dataLayer event. Mark lead events as key events and register report parameters as custom dimensions.
  7. Add the Google Ads tag, the conversion linker and one conversion tag per action, with primary and secondary status set in Google Ads. Check the Consent Overview page: every Google tag should show built-in consent checks.
  8. Set up enhanced conversions for leads with a user-provided data variable fed from the form before it resets, and confirm in the diagnostics report after a week.
  9. Capture click IDs in site code only after marketing consent, send them with lead submissions, validate them on the server, and store them with the lead.
  10. Define internal traffic in GA4 (IP ranges for offices, a traffic_type parameter for the staff flag), run the filter in testing mode, then activate it; Google notes a filter can take 24 to 36 hours to apply.
  11. Test in Tag Assistant preview from inside and outside the consent regions (a VPN is enough): nothing stored before consent where denied, no banner where granted, the lead event fires once.
  12. Publish the version with a description and repeat the preview check after every change to the forms.

The two posts this one absorbs

The old "how to install Google Analytics" guide pasted a tracking snippet into every page; in 2026 that is step 6 above, done once as a tag, and GA4 has replaced the product it described. The old "generate leads with Google Analytics" post was about goals, values and UTM parameters; the modern equivalent is key events in GA4 (any event "can become a key event"), imported into Google Ads so "conversion counts" stay "consistent between the two products", with click IDs doing for paid traffic what UTM tagging did. One addition since: GA4's default channel grouping now includes "AI Assistant" for referrals from ChatGPT, Gemini, Copilot and similar sources, while Google counts its own AI Overviews and AI Mode under Organic Search. Our GEO guide covers that measurement, and the Search Console guide the search side.

FAQ

Do I need Consent Mode if my customers are in North America?

If any EEA, UK or Swiss visitor can reach your site and you use Google's advertising products, Google's EU user consent policy applies to those visitors. Regional defaults let you comply there without showing a banner to visitors you are not required to ask; confirm the position with your legal advisor.

What is the difference between basic and advanced consent mode?

Basic mode blocks Google tags until the visitor responds and sends nothing if they decline, "not even the default consent status". Advanced mode loads tags with denied defaults, sends cookieless pings while denied, and switches to full measurement on consent, which supports advertiser-specific conversion modelling.

What are enhanced conversions for leads?

A way to improve attribution for sales that close off the website. First-party data from the lead form (e-mail, phone) is hashed with SHA256 and sent with the conversion, so the lead can be matched to the ad click, and a later offline sale can be attributed back to the campaign.

Why capture gclid, gbraid and wbraid on the form?

So a lead that becomes a customer weeks later can be reported back to Google Ads with the click that produced it. gclid is the standard click ID from auto-tagging; gbraid and wbraid are the privacy-preserving variants Google introduced for iOS traffic affected by App Tracking Transparency. Capture them only after marketing consent.

How do I keep my own team out of the analytics?

Define internal traffic in GA4 by IP range and by a traffic_type parameter, activate the data filter, and set the parameter from a first-party cookie for staff on other networks. The same cookie can tell the container to skip Google Ads conversion tags.

Impinge Solutions sets up analytics and conversion tracking (GA4, Google Tag Manager, Consent Mode v2, consent platforms and click-ID capture) as part of website builds and migrations. Ask us to review your tracking.

Sources (14 links)
Share this article