The default consent state is the set of permissions a website’s tags start with before a visitor has answered the cookie banner. In Google’s consent mode it is a short instruction, run before any other tag loads, that marks each type of storage as granted or denied until the visitor makes a choice.
How the default consent state works
Google’s consent mode uses named consent types. analytics_storage covers analytics cookies and ad_storage covers advertising cookies. Two newer types, ad_user_data and ad_personalization, cover two separate permissions: passing a visitor’s data to Google for advertising at all, and using it to tailor the ads that person sees later, as remarketing does. Other types cover functional, personalisation and security storage, which are usually granted because they relate to cookies the site needs in order to work.
The default command sets each type before the Google tag, GA4 or any ad tag runs. When the visitor clicks Accept, Reject or saves their preferences, your consent management platform sends an update command with the new values, and the tags change their behaviour from that point. On later pages the platform reads the stored choice and sends the update again straight after the default.
Two settings fine-tune this. A region list applies a default only to visitors in certain countries, using ISO codes such as GB for the United Kingdom. A wait_for_update value, in milliseconds, asks tags to hold briefly so a slow banner can send its update before anything fires.
What tags do while consent is denied depends on how they are set up. In basic consent mode, Google tags do not load until consent is granted. In advanced consent mode, they load and send cookieless pings, which Google uses to model the data it cannot collect.
Why it matters
In the UK, the Privacy and Electronic Communications Regulations require consent before non-essential cookies are stored on a visitor’s device, and the ICO treats advertising cookies, and analytics cookies in most set-ups, as non-essential. A default of granted means tags set those cookies as the page loads, before anyone has agreed, which is the very thing the rules forbid. For UK visitors the default should be denied for analytics_storage, ad_storage, ad_user_data and ad_personalization until the person opts in.
The Data (Use and Access) Act 2025 allows some analytics cookies to be used without consent under specific conditions, but it does not extend to advertising cookies. At the time of writing (October 2026), check the ICO’s current guidance against your own set-up before relying on that exemption, and keep advertising types denied by default whatever you decide.
Google also requires valid consent signals for UK and EEA visitors under its EU user consent policy. Without them, Google Ads cannot build remarketing lists from that traffic, and parts of its conversion measurement fall away.
Common mistakes
- Setting the default after the Google tag has already loaded, so the first page view goes out before any consent rules apply. In Tag Manager, the default belongs on the Consent Initialization trigger.
- Defaulting to granted and relying on the banner to switch things off later.
- Writing the region as “UK” instead of “GB”, so the rule never matches a UK visitor.
- A banner that saves the visitor’s choice but never sends the update command, so people who accepted are still treated as denied and no data arrives.
- Setting analytics_storage and ad_storage but leaving out ad_user_data and ad_personalization.
- Running two consent set-ups at once, such as a platform template and a hand-written default with different values.
How to act on it
Open your site in a private window and leave the banner alone. In Tag Assistant or Tag Manager preview, check the consent details on the first event: all four analytics and advertising types should read denied. Accept, and confirm they change to granted; then reject on a fresh visit and confirm they stay denied. Check your browser’s stored cookies too, to make sure no _ga or advertising cookies appear before you have chosen.
Decide between basic and advanced consent mode with whoever advises you on privacy, and record the reasons. Consent set-up decides how much conversion data Google Ads receives from UK visitors, so I review it at the start of any PPC management work.