Google Consent Mode v2 explained for Australian websites

Using Google Analytics or Google Ads? You’ve probably seen prompts about Google Consent Mode v2. In Australia it isn’t a legal requirement: it’s Google’s rule for visitors in Europe, the UK and Switzerland. What applies here is the Privacy Act 1988 (Cth), and your Consent Mode setup shapes what Google collects before visitors say yes.

What is Google Consent Mode v2?

Google Consent Mode v2 is a way for your cookie banner to tell Google’s tags what each visitor has agreed to. Your banner collects the choice. Consent Mode passes that choice on to tags like Google Analytics 4 (GA4) and Google Ads, so they change their behaviour to match.

It works through a small set of consent signals. The two original ones cover storage:

• ad_storage: whether advertising cookies can be set.

• analytics_storage: whether analytics cookies can be set.

Google updated Consent Mode in November 2023 and added two more signals. That update is the “v2”:

• ad_user_data: whether data about the visitor can be sent to Google for advertising.

• ad_personalization: whether that data can be used for personalised ads and remarketing.

Consent Mode doesn’t ask anyone for consent itself. You still need a cookie banner or another consent tool to do that. Consent Mode only carries the answer.

What’s the difference between Basic and Advanced mode?

Basic mode blocks Google’s tags completely until the visitor makes a choice. Advanced mode loads them straight away in a restricted state. That one difference decides what reaches Google from people who haven’t said yes.

• Basic mode: Google’s tags don’t load until the visitor interacts with your banner. According to Google’s Ads Help page on consent mode, nothing is sent before then, not even the consent status. If the visitor declines, the tags stay blocked.

• Advanced mode: Google’s tags load as soon as the page opens, with consent set to denied by default. No cookies are written until the visitor agrees. While consent is denied, the tags still send the consent state and what Google calls “cookieless pings”.

Advanced mode gives Google more to work with when it models the visitors you can’t see. Basic mode keeps more distance between Google and the people who decline. Which one suits your business is a privacy decision as much as a marketing one.

Why does Google require Consent Mode v2?

Google requires Consent Mode v2 to meet its own EU user consent policy, which covers end users in the European Economic Area (EEA), the UK and Switzerland. If you advertise to or measure visitors in those places and don’t pass valid consent signals, Google can limit the ad features you can use, such as remarketing and personalised ads.

That’s a condition of using Google’s products, not an Australian law. If your audience is only in Australia, the policy mostly won’t touch you. If you get meaningful traffic from Europe or the UK and run Google ads to them, it may.

How does Consent Mode fit with the Privacy Act?

The Privacy Act and the Australian Privacy Principles (APPs) don’t mention Consent Mode at all. They apply when your website collects, uses or discloses personal information, and tracking tags can do exactly that.

The Office of the Australian Information Commissioner (OAIC) covers this in its guidance on tracking pixels and privacy obligations. In plain terms, it says:

• The Privacy Act doesn’t ban tracking pixels, but you’re responsible for how they’re set up and what they send.

• Collect only what you reasonably need, and consider running pixels on some pages only.

• Tell people about your tracking in your privacy policy and at the point of collection. A banner with links to more detail is one example the OAIC gives.

• If you use pixels for targeted ads, the direct marketing rules in APP 7 apply, including a simple way to opt out.

• If the data goes overseas, APP 8 asks you to take reasonable steps before you switch it on.

• Review your tracking regularly. It isn’t set and forget.

Google tags send data to Google, and Google processes some of it outside Australia. So a GA4 or Google Ads setup sits squarely in the territory this guidance describes. For a closer look, read our guide to tracking pixels and your privacy obligations.

Why health websites need extra care

Health information is sensitive information under the Privacy Act, and the OAIC says it can generally only be collected with consent. Its guidance points out that simply visiting some health websites can reveal something sensitive about a person. In those cases, it says organisations should generally seek express opt-in consent before sensitive information may reach a third party. It also suggests avoiding third-party pixels altogether in some cases.

In 2026 the Information Commissioner found that two health providers, Medmate Australia and Monash IVF, interfered with privacy through their use of tracking pixels. If you run a clinic, allied health practice or pharmacy website, read tracking pixels on health websites before you choose a Consent Mode setup. Advanced mode sends data to Google before anyone says yes, which is worth weighing carefully on a health site.

Why opt-in consent means fewer visitors in GA4

When you ask for consent before analytics runs, GA4 only records the people who say yes. Everyone who declines or ignores the banner drops out of your reports, so your visitor numbers will go down, sometimes noticeably.

That doesn’t mean your traffic fell. It means you’re now measuring the visitors who agreed to be measured. A few things help you read the new numbers:

• Mark the date. Add an annotation in GA4 on the day your banner went live, so you don’t compare before and after as if nothing changed.

• Expect gaps in Basic mode. Declined visitors simply aren’t counted.

• Don’t count on modelling. GA4 can estimate declined visitors with behavioural modelling, but only in Advanced mode and only once your property passes Google’s thresholds. You need at least 1,000 events a day from declined visitors for 7 days, and at least 1,000 daily users who accepted on at least 7 of the past 28 days. Many small business sites won’t reach that.

• Check your other sources. Bookings, enquiries and sales in your own systems still tell you how the business is going.

Want to see what your site loads before anyone clicks your banner? Run your site through the free website privacy scanner.

How Savira handles it

Savira is an Australian consent management platform for small and growing businesses: cookie consent, consent records and privacy policies built for the Privacy Act 1988 and the Australian Privacy Principles.

Savira’s cookie banner asks visitors for their choice before non-essential tracking runs, and keeps a record of each consent choice. [Confirm: script blocking and consent records behaviour as currently live.] [Confirm with Angus: whether Savira sends Consent Mode v2 signals to Google tags. If yes, add one sentence here naming Basic or Advanced. If not, leave this section as it is.]

If your site runs on WordPress, see how the Savira WordPress cookie consent plugin sets up your banner.

For the full detail, read the OAIC’s Tracking pixels and privacy obligations and Google’s developer guide to consent mode.

This is general information, not legal advice. Every business handles information a bit differently, so if you’re not sure how this applies to yours, it’s worth checking with a lawyer or privacy adviser.