Marketing Tips

Consent Mode v2 with GTM and Cookiebot: Setup Guide for Australian Small Business

16 August 2026

Google's Consent Mode v2 rolled out in late 2024, and if you're running Google Analytics or Google Ads in Australia, you need to understand it. Simply put, Consent Mode v2 lets you keep tracking customers even when they reject cookies, using aggregated data instead. It's compliant, it protects your analytics data, and it's increasingly required by regulators. The good news? With Google Tag Manager and Cookiebot working together, the setup isn't complicated. Here's what every Australian small business owner needs to know.

Consent Mode v2 is Google's answer to privacy regulations. Think of it as a translator between your website visitor's consent choices and what Google Analytics and Google Ads are allowed to do with their data. When someone visits your site and rejects cookies, Consent Mode v2 tells Google "this user said no", so Google doesn't fire certain tracking pixels. But here's the clever bit: instead of losing all that data, Google uses modelled conversions to estimate what that user might have done. You still get insights. Your data doesn't just vanish.

Under Australian privacy laws like the Privacy Act 1988 and Australian Consumer Law, you're required to get consent before tracking most behavioural data. Consent Mode v2 makes that legally defensible. It's also important if you're running Meta Ads tracking alongside Google products, since both platforms respect consent signals.

How Consent Mode v2 Works

When a visitor lands on your site, Cookiebot displays a consent banner. They choose "Accept all", "Reject all", or select specific categories. Cookiebot captures that choice and passes it to Google Tag Manager. GTM then tells Google Analytics and Google Ads what consent level applies. If they've consented to analytics, you get full tracking. If they've rejected it, Google Ads and Analytics adjust how they collect and use data, falling back to modelled conversions for measurement.

The system is built on two consent states: analytics mode (can I track page views and general user behaviour?) and marketing mode (can I track for ads retargeting?). Each one has its own yes or no. GTM manages this handshake, Cookiebot captures the user's choice, and Google's platforms respond accordingly.

The Cost of Not Implementing It

Without Consent Mode v2, your analytics can drop significantly when visitors reject cookies. Some businesses see 30 to 40 percent data loss overnight. Google Analytics stops tracking rejected users completely. You can't measure their behaviour, conversions, or campaign effectiveness. Your return on ad spend becomes unreliable because you're only measuring the consented portion of your audience, creating a blind spot on your actual performance.

Regulators and privacy bodies like the Australian Information Commissioner's Office (OAIC) are increasingly monitoring consent implementation. Businesses without a proper system face potential complaints, audits, and reputational damage. Cookiebot and Consent Mode v2 give you a defensible, auditable trail showing you asked for consent and respected user choices.

Think of this three-part setup as a chain: Cookiebot asks the user, GTM delivers the message, and Google's products act on it. Each layer does a specific job. Removing one breaks the chain.

Google Tag Manager's Role

Google Tag Manager is the traffic controller. It sits between your website and all the tracking tools you use (Google Analytics, Google Ads, Facebook Pixel, etc.). Without GTM, you'd have to manually add tracking code to every page, which is a maintenance nightmare for small businesses.

In a Consent Mode v2 setup, GTM becomes the consent enforcer. It holds default consent settings (what happens if a user hasn't made a choice yet), listens for consent updates from Cookiebot, and then allows or blocks specific tags from firing based on those updates. GTM won't send analytics data to Google if the user rejected analytics consent. It won't fire your retargeting pixel if they rejected marketing consent.

What Cookiebot Does

Cookiebot is the consent capture layer. It scans your website, finds every cookie and tracking script running, categorises them, and displays them in a user-friendly banner. When a visitor makes a choice, Cookiebot stores that decision and broadcasts it to GTM. It also provides an audit trail showing what was consented to, when, and by whom. For compliance purposes, this trail is gold.

Cookiebot also handles technical cookies (those needed for site functionality) separately from marketing and analytics cookies, which aligns with Australian Privacy Act requirements and best practice.

How They Work Together

The flow is straightforward: visitor arrives, Cookiebot banner shows, visitor chooses, Cookiebot sends that choice to GTM, GTM updates its consent state, GTM allows or blocks tags. If they accept all, every tag fires normally. If they reject analytics, GTM blocks the analytics tag but allows the technical one. Cookiebot keeps a record. Google sees the consent status and responds with full, partial, or modelled tracking accordingly.

Clean modern flat-vector illustration showing three connected geometric icons representing the consent system: a browser

Step 1: Set Up Cookiebot on Your Website

Creating Your Cookiebot Account

Head to Cookiebot's website and sign up. You'll choose a plan (they have a free tier if your site is under 50,000 visits per month, but most small businesses end up on a paid plan for full features). Enter your domain name and set your jurisdiction to Australia. This ensures Cookiebot's default settings match Australian privacy expectations.

Installing the Cookiebot Script

Cookiebot gives you a script snippet to add to your site. If you're using WordPress, there's a plugin. If you're on a custom platform or site builder, you'll paste the script into your site's <head> section. The script needs to load before any other tracking code, so placement matters.

Once installed, Cookiebot will start scanning your site automatically, identifying cookies, scripts, and pixels already running.

Scanning Your Site for Cookies

Cookiebot's crawler will take a few hours to scan all your pages and identify tracking tools. It classifies them into categories: technically necessary (login, shopping cart), analytics (Google Analytics), marketing (Google Ads, Meta Pixel, retargeting), and other. Review the scan results. If something's misclassified or missing, you can manually add or correct it. This step ensures your consent banner is accurate and complete.

Adding the Consent Mode Tag

In GTM, create a new tag of type "Consent Mode". This tag is the bridge between Cookiebot's decisions and Google's systems. Set it to initialise before any other tags fire. The Consent Mode tag tells Google what your default consent levels are (typically "denied" unless the user has already chosen).

Setting Default Consent States

Define what happens if a user hasn't seen or interacted with the Cookiebot banner yet. Most setups use "analytics_storage: denied" and "ad_storage: denied" as defaults, meaning you're not tracking until the user explicitly opts in. This is the safest approach and most aligned with Australian privacy expectations. You can adjust this, but "denied by default" is best practice.

Testing Your Configuration

Use GTM's Preview Mode to test. Open your site, interact with the Cookiebot banner, accept all cookies, and watch the GTM debug panel. You should see the Consent Mode tag fire, then see analytics and ads tags fire. Reject cookies and reload. The analytics and ads tags should not fire. If they do, your configuration has a gap.

Step 3: Connect Cookiebot to GTM

Installing the Cookiebot Template in GTM

Cookiebot provides a community template for Google Tag Manager. In GTM, go to Templates, search for Cookiebot, and add the official template. This template acts as the listener, waiting for Cookiebot to send consent updates to your data layer.

Mapping Consent Categories

Once the template is installed, create a trigger based on Cookiebot's consent events. Map Cookiebot's categories to GTM's consent types: Cookiebot's "Statistics" maps to "analytics_storage", Cookiebot's "Marketing" maps to "ad_storage". This ensures when a user rejects marketing cookies in Cookiebot, GTM updates the ad_storage consent state to "denied".

Triggering Tags Based on Consent

Now set up your individual tags (Google Analytics, Google Ads conversion tracking, etc.) to fire only when the relevant consent state is "granted". Analytics tags should require "analytics_storage: granted". Ads tags should require "ad_storage: granted". This way, the tags respect user consent automatically.

Clean modern flat-vector illustration of a website cookie consent flow: simplified browser window shape at top with a sm

What Happens When Users Reject Cookies

Modelled Conversions Explained

When someone rejects analytics cookies, Google Analytics doesn't stop working. Instead, it uses modelled data. Google looks at similar users who did consent, infers patterns, and estimates what the rejected user probably did. If 1,000 users consented and 500 rejected, and the consented group had a 5 percent conversion rate, Google estimates the rejected group likely had a similar rate and includes that in your reports as "modelled conversions".

This isn't guesswork. It's based on aggregated, anonymised data. Your reports stay meaningful even when a chunk of users reject cookies. The tradeoff is that individual-level remarketing data is lost; you can't retarget someone who rejected marketing cookies.

Data Quality Trade-offs

With Consent Mode v2, your analytics won't be 100 percent complete if users reject cookies. Expect some data loss, especially in remarketing and conversion-level detail. However, you'll capture more data than if you had no consent system at all, and you're compliant with privacy law. The data you do get is clean and auditable, which is worth more to most small businesses than inflated numbers from non-compliant tracking.

Common Setup Mistakes and How to Avoid Them

GTM Preview Mode Errors

The most common mistake is testing in GTM Preview Mode with cookies already allowed in your browser. GTM Preview Mode doesn't clear consent state, so you'll see tags firing even though the config says they shouldn't. Always test in a private or incognito window, or clear your site cookies before testing. Better yet, use different browsers: one where you've accepted all cookies, one where you've rejected all.

Cookie Categories Not Matching

Cookiebot categorises cookies one way, but GTM's consent states are named differently. If Cookiebot calls something "Analytics" and your GTM tag is looking for "analytics_storage", they won't connect. Double-check that Cookiebot's category names match the data layer variable names GTM is listening for. Cookiebot's integration guide for Google Consent Mode spells this out clearly.

Delayed Consent Implementation

Some businesses set up Cookiebot and GTM but leave their old non-consent-aware tracking code still firing. You end up with double tracking, audit confusion, and compliance risk. Remove or disable the old tracking code once Consent Mode v2 is live. GTM should be your only tracking engine.

Clean modern flat-vector illustration showing a maintenance checklist concept: a simplified calendar grid in dark charco

Regular Cookie Scans

Every time you add a new plugin, tool, or script to your site, Cookiebot's scan may find new cookies. Run a fresh scan every quarter. New cookies that aren't categorised or disclosed create compliance gaps. Review and categorise any new items before they become a problem.

Updating Your Privacy Policy

Your privacy policy needs to explain how you use cookies, what consent means, and how users can withdraw consent. A Cookiebot link to your cookie policy should be visible in the consent banner. If your Privacy Policy is outdated or missing, you're not truly getting informed consent. Review it annually and update it whenever your tracking tools change. The Australian Privacy Act 1988 overview from OAIC outlines what must be disclosed.

Monitoring Analytics Data Quality

After six to eight weeks of Consent Mode v2 running, check your Google Analytics report. Compare consent rates, modelled conversion data, and session counts to your baseline. If consent rates are very low (under 20 percent), your banner messaging or placement might need adjustment. If modelled conversions are missing or look odd, your GTM config may need tweaking. Treat this as ongoing maintenance, not a one-time setup.

Conclusion

Consent Mode v2 with GTM and Cookiebot is now the standard for tracking in privacy-conscious markets like Australia. The setup itself isn't complicated if you follow the steps: Cookiebot asks and records consent, GTM manages the consent state, and Google's tools respond accordingly. You get compliant tracking, defensible data, and auditable proof that you're respecting user privacy.

The key is treating it as a system, not three separate tools. Each one does its job, but they have to talk to each other. Test thoroughly in different browsers before you go live. Check your configuration against Google's official Consent Mode v2 documentation if anything feels unclear. And review your setup every few months as your site and tools evolve.

If the technical side feels overwhelming or you're running multiple advertising platforms like Google Ads and Meta Ads, it's worth having someone audit your setup once it's live. A few hours of expert review now beats months of data quality issues or compliance headaches later. The investment pays for itself in cleaner reporting and peace of mind.

Frequently asked questions

Do I need Consent Mode v2 if I only use Google Analytics on my Australian website?

Yes, you need Consent Mode v2 if you use Google Analytics 4 or Google Ads in Australia. Without it, you'll lose 30-40% of your tracking data when users reject cookies, and your campaign performance measurements will be incomplete. Consent Mode v2 fills those gaps with modelled data while keeping you compliant with Australian privacy law.

How much does Cookiebot cost for a small business website?

Cookiebot starts at free for websites with under 100 subpages and low traffic. For most Australian small business sites, the paid plans start around $9 USD per month (approximately $14 AUD) and scale based on your page count and monthly page views. The investment is worth it to maintain accurate tracking data.

Can I set up Consent Mode v2 without using Cookiebot?

Yes, you can use any compliant Consent Management Platform (CMP) or build a custom cookie banner that triggers Consent Mode v2 signals. However, Cookiebot is popular because it integrates directly with GTM templates and automatically handles the technical consent signal mapping. Manual setups require more technical knowledge and ongoing maintenance.

Will Consent Mode v2 affect my Meta Ads tracking?

Consent Mode v2 is a Google product that directly affects Google Analytics and Google Ads tracking. Your Meta Pixel tracking is governed by separate consent requirements under Australian privacy law. You'll need to configure Cookiebot (or your CMP) to handle Meta Pixel consent separately, though the same user consent choices typically apply to both platforms.

What happens to my Google Analytics data if I implement Consent Mode v2 halfway through the year?

You'll see a noticeable jump in tracked events and conversions after implementation because Consent Mode v2 will start filling in data gaps from users who reject cookies. Your historical data before implementation won't change, so year-over-year comparisons will show an artificial increase. Document your implementation date in your analytics notes to account for this when reviewing trends.

How accurate is the modelled conversion data from Consent Mode v2?

Google's modelled conversions use machine learning to estimate conversions from users who rejected cookies, based on patterns from users who accepted. Google doesn't publish exact accuracy rates, but internal testing suggests modelled data typically recovers 60-80% of the conversion visibility you'd lose without Consent Mode v2. It's not perfect, but it's substantially better than having no data at all from non-consenting users.