AdLintBack to Check Reference
GTM·Google Tag Manager·warning

Google Ads Tags May Fire Without Consent

Some of your Google Ads tags have no Consent Settings configured. They fire on every page load regardless of whether the user granted `ad_storage`. In GDPR or UK GDPR jurisdictions, that's a compliance problem first and a measurement problem second. Data from consent-denied users should never have left the browser.

CL
By Christopher LandaverdeCreator of AdLint · ad-tech tracking specialistUpdated

Why It Matters

Google Consent Mode v2 added two ad-related consent signals: `ad_storage` (whether you can use cookies for ad measurement) and `ad_user_data` (whether you can send the user's identifiers to Google). Every Google Ads tag should read these signals before firing. If the tag has no Consent Settings in GTM, it ignores them entirely. When a tag ignores those signals, you ship data from users who explicitly said no. That's the regulatory exposure. The compounding problem is that Google's modelling pipeline (the one that backfills attribution for consent-denied users) assumes the consent-denied hits were tagged as such. Hits that fired without consent metadata can't be backfilled, so you also lose the measurement Google offers as the consolation prize for being compliant. And because the same tag behaves differently across geographies and banner timings, debugging is a moving target. The fix is not the consent banner. The banner records the user's choice; the GTM tag has to read it. If the tag isn't wired to check, the banner can be perfect and the leak continues.

Tag ManagerGTM-AB12CDE · Workspace: Default
BeforeTags
  • Google Ads. Purchase Conversion
    Consent Settings: No additional consent required
    Type: Google Ads Conversion Tracking
    Fires: purchase_success
  • Google Ads. Remarketing
    Consent Settings: No additional consent required
    Type: Google Ads Remarketing
    Fires: All Pages
  • Google Ads. Sign-Up Conversion
    Consent Settings: No additional consent required
    Type: Google Ads Conversion Tracking
    Fires: signup_complete
Google Ads tags configured with no Consent Settings. Every tag fires on All Pages regardless of the user's consent state.

Coloured rows show the configuration AdLint flags.

How To Fix It

  1. In GTM, open Admin → Container Settings → Consent and turn on "Enable consent overview." That adds a Consent column to the Tags list so you can see at a glance which tags have which requirements.
  2. Open every Google Ads Conversion Tracking and Google Ads Remarketing tag. Expand Consent Settings. Tick "Require additional consent for tag to fire" and pick `ad_storage`. If the tag uses Enhanced Conversions, add `ad_user_data` too.
  3. Confirm your consent banner sets default consent to denied before any tag loads, and updates consent only after the user picks. If you use a CMP (OneTrust, Cookiebot, etc.), that lives in the CMP config, not GTM.
  4. In Preview mode, walk three flows: denied, granted, and "user changed their mind." Confirm Ads tags fire on the granted path and only the granted path.
  5. Publish.
Tag ManagerGTM-AB12CDE · Workspace: Default
AfterTags
  • Google Ads. Purchase Conversion
    Requires: ad_storage, ad_user_data
    Type: Google Ads Conversion Tracking
    Fires: purchase_success
  • Google Ads. Remarketing
    Requires: ad_storage
    Type: Google Ads Remarketing
    Fires: All Pages
  • Google Ads. Sign-Up Conversion
    Requires: ad_storage, ad_user_data
    Type: Google Ads Conversion Tracking
    Fires: signup_complete
Fixed: every Google Ads tag now requires `ad_storage` consent. Tags only fire after the consent banner records a granted state.

Green rows show the corrected state after the fix.

Example

Configuration
Required consent checks: ad_storage, ad_user_data, ad_personalization
Default state before banner choice: denied
For Your Client Report

This GTM container has Google Ads tags configured to fire without Consent Settings. Per Google's Consent Mode v2 documentation, Google Ads conversion and remarketing tags are required to honour the `ad_storage` and `ad_user_data` consent signals. Tags without explicit Consent Settings fire on every page load regardless of user choice. The exposure is both regulatory (GDPR, UK GDPR, ePrivacy) and measurement-side: Google's modelling pipeline cannot compensate for hits that were never tagged as denied. Fix: configure required-additional-consent on every Google Ads tag and verify denied, granted, and changed-consent paths in GTM Preview before publishing. Source: developers.google.com/tag-platform/security/guides/consent.

Drop this paragraph into your client deliverable. Sources back to the canonical platform documentation linked below.

References

  1. [1]Google. Consent settings in Google Tag Manager
  2. [2]Google. Consent mode for Google Ads
  3. [3]Google Developers. Consent Mode v2 reference

Audit your own files for this check

AdLint runs this check (and 177 others) against your GTM, Google Ads, Meta, TikTok, LinkedIn, Pinterest, Twitter/X, and Snapchat exports. Everything stays in your browser. No uploads, no accounts.

Run a free audit