Is Consent Mode v2 mandatory across the EU?

Yes, since March 2024 for accounts using Google Ads or Google Analytics in the EEA and UK, and enforcement has tightened since 2025.

Is installing a CMP enough to comply?

No. A CMP manages the banner, but each individual tag needs its own correctly configured consent gate: a CMP poorly wired to GTM can still fire tags without consent.

What does gcs=G100 actually mean in a network request?

It's the parameter Google Tag uses to encode consent state on every hit. G100 means ad_storage and analytics_storage are both denied; G111 means both granted plus the third personalization bit. If you see G1xx when you expected full denial, that's your leak.

Can this be detected without access to the GTM container?

Yes, partially. The browser's Network tab shows what's being sent to which domain with what gcs value, no container credentials needed. Fixing it does require access, but diagnosing the symptom doesn't.

How to spot you're sending personal data without consent

If you run a server-side Google Tag Manager container with 50+ tags, there’s a real chance some of them are sending personal data to ad platforms even when the user has denied consent. This isn’t hypothetical. It’s what a recent audit found.

The symptom isn’t always visible

The actual case: a server-side container was sending email, name, country, and zip code to Meta CAPI, TikTok Events API, and Google Ads in sessions where ad_storage and ad_user_data were denied (gcs=G100). From the outside, everything looked fine: campaigns reported conversions normally. The problem only surfaces when you audit tag by tag.

How to actually diagnose it

A surface-level review of the cookie banner won’t catch this. You have to drop down to the container’s 154 individual tags and check each one’s gate status. In this case, 128 out of 154 had a missing or misconfigured gate: 83% of the container with no real consent control.

The root cause added a second layer of difficulty: a race condition in the CMP that, under certain load conditions, marked consent as granted before the user had interacted with the banner. In most sessions the order was correct, so the bug went unnoticed in quick testing.

The fix

Explicit ad_storage and ad_user_data gates were implemented on the 15 affected server-side tags, blocking publication until it was confirmed no tag could fire without the correct consent signal, correctly timed against the user’s actual interaction.

Why this isn’t just a technical detail

GDPR fines can reach 4% of global annual revenue. A container where most tags are misconfigured isn’t an optimization nitpick: it’s an active legal exposure that, in most cases, nobody knows exists until it’s audited.

How to diagnose it on your own container

You don’t need to wait for an outside audit to know if you have this problem. Same method used in the case, stripped down to the essentials:

1. Open your site in an incognito window
2. F12 → Network → filter by the destination domain (facebook.com,
   tiktok.com, google-analytics.com, or your server-side endpoint)
3. Reject everything in the cookie banner
4. Look for the gcs parameter on any requests still going out
5. If you see G1xx instead of G100 (or no gcs parameter at all), that
   tag isn't respecting the rejection
6. Repeat tag by tag if you have container access — don't assume that
   because one is fine, they all are

Server-side isn’t safer by default

There’s a common assumption that moving to server-side tagging automatically improves privacy compliance, because “the data goes through your server, not straight to the third party.” In practice it’s the opposite: a misconfigured server-side container can forward the exact same data to the exact same third parties, just with an extra hop that creates a false sense of control. The consent gate has to exist on the server-side tag exactly like on a client-side one — moving it doesn’t fix it on its own.

This article describes a documented real case, delivered via a digital marketing agency. End client anonymized for confidentiality.