Developer Hub › Google Consent Mode v2

Google Consent Mode v2 + LGPD

Exact gtag() calls, default denied state, update triggers, and LGPD category-to-signal mapping — with copy-paste JavaScript for Brazilian sites.

Add to your site free — 2 minutes JavaScript blocking guide

How do you implement Google Consent Mode v2 for LGPD?

Fire the default call synchronously before any Google tag loads. Place gtag('consent', 'default', {...}) as the very first script in your <head> — before GTM, before GA4, before any Google tag. Set all signals to 'denied' by default. Then, after the visitor accepts via the consent banner, call gtag('consent', 'update', {...}) with only the granted signals.

Under LGPD, analytics and marketing consent are opt-in — the default denied state is not optional. Visitors in Brazil who decline should never be tracked. The wait_for_update parameter tells Google tags to pause for up to 500ms for a returning visitor's stored consent to load before firing in restricted mode.

Copy-paste default snippet

Place this before your GTM or GA4 script tag — not after, not inside GTM. This must be synchronous, not async.

<!-- Step 1: dataLayer init — must be FIRST -->
<script>
    window.dataLayer = window.dataLayer || [];
    function gtag() { dataLayer.push(arguments); }

    // Default: everything denied — LGPD requires opt-in
    gtag('consent', 'default', {
        ad_storage:           'denied',
        analytics_storage:    'denied',
        ad_user_data:         'denied',
        ad_personalization:   'denied',
        functionality_storage: 'denied',
        personalization_storage: 'denied',
        security_storage:     'granted', // always granted (Necessary)
        wait_for_update:      500         // ms to wait for returning visitor consent
    });
</script>

<!-- Step 2: CookieFácil consent manager — fires update after banner -->
<script data-cfasync="false"
        src="https://cdn.cookiefacil.com.br/cdn/cf-banner.min.js?site=YOUR_SITE_ID"></script>

<!-- Step 3: GTM — loaded after consent manager -->
<script async src="https://www.googletagmanager.com/gtm.js?id=GTM-XXXXX"></script>

CookieFácil fires the update call automatically after the visitor accepts. You do not need to write the update call yourself.

LGPD category to GCM signal mapping

When a visitor consents to a category in the banner, these signals are updated to 'granted'.

LGPD Category Google Consent Mode v2 Signal(s) Default state
Necessary security_storage Always granted
Analytics analytics_storage denied until opt-in
Marketing ad_storage, ad_user_data, ad_personalization denied until opt-in
Functional functionality_storage, personalization_storage denied until opt-in

The update call (manual implementation)

If you are not using CookieFácil, fire this after the visitor accepts.

// Fire this after the visitor accepts analytics consent
document.addEventListener('cf:consent', function(e) {
    const { analytics, marketing, functional } = e.detail;

    gtag('consent', 'update', {
        analytics_storage:      analytics  ? 'granted' : 'denied',
        ad_storage:             marketing  ? 'granted' : 'denied',
        ad_user_data:           marketing  ? 'granted' : 'denied',
        ad_personalization:     marketing  ? 'granted' : 'denied',
        functionality_storage:  functional ? 'granted' : 'denied',
        personalization_storage: functional ? 'granted' : 'denied',
    });
});

CookieFácil fires this update call automatically. The manual version above is for teams building their own consent UI who want to integrate with GCM v2.

Choose the right plan for your business

Start free and scale as your consent volume grows. Billed in BRL — no credit card required to start.

Free

Start collecting consent records

  • 1 site · 1,000 visitors/month

  • Cookie consent banner — LGPD + GDPR ready

  • Basic consent reports

Start Free
Most Popular

Basic

For growing businesses

  • 2 sites · 5,000 visitors/month

  • CSV export of consent records

  • Remove CookieFácil branding

Get Started

Professional

For multiple sites and agencies

  • 5 sites · 50,000 visitors/month

  • CSV + PDF + advanced reports

  • Custom CSS and geo-targeting rules

Get Started
See all plans and features →

Frequently asked questions

  • How do you implement Google Consent Mode v2 for LGPD?

    Place gtag('consent', 'default', {...}) synchronously before any Google tag, with all signals set to 'denied'. After the visitor accepts via the consent banner, call gtag('consent', 'update', {...}) with granted signals only. Use wait_for_update: 500 so returning visitors' stored consent loads before tags fire.

  • Is Google Consent Mode v2 required for LGPD compliance?

    Not legally, but practically essential. Without it, Google Ads and GA4 operate in restricted mode after LGPD blocks them — losing up to 40% of conversion data. GCM v2 models conversions from users who declined, preserving campaign measurement.

  • What is wait_for_update in Google Consent Mode v2?

    wait_for_update tells Google tags to wait up to N milliseconds for a consent update before firing in restricted mode. Set it to 500ms — enough time for the consent banner to initialize and fire the update signal if a returning visitor already has a stored consent decision.

  • Which gtag consent signals map to which LGPD categories?

    analytics_storage → Analytics category. ad_storage + ad_user_data + ad_personalization → Marketing category. functionality_storage → Functional category. security_storage → always granted (Necessary). personalization_storage → Functional category.