Google Now Says Consent Mode ‘Defaults to a Consented State’ — and Contradicts Itself

The sentence that changed

In the “Advanced consent mode” section of About consent mode, Google lists what its tags do on load. On 11 June 2026 the second step read:

“Set default consent states. By default, consent will be denied, unless you set your own defaults.”

By 2 July 2026, and still today, it reads:

“The system defaults to a consented state unless a specific choice has been made, though there may be regional behavioral differences for specific areas like the EEA, Switzerland, and the UK.”

Further down the same page, the table comparing basic and advanced consent mode still describes advanced mode’s consent states as “Defaults set to denied, unless configured otherwise”. The page now says both things.

Which one describes what the tags do?

The new sentence matches what a tag without a default does. We loaded gtag.js with a GA4 property and no consent command at all, on a local test page from a connection in Mexico, and recorded the requests in Chromium on 11 October 2026:

• the page_view request carried no gcs parameter — no consent state at all;
• _ga and the property cookie were written before anyone clicked anything.

With an all-denied default added above the snippet, the same page_view carried gcs=G100 and wrote no cookies. In other words, outside the regions Google singles out, “no default” behaves as “granted”.

The “regional behavioral differences” are the open question. The sentence links to Google’s EEA consent mode article, which explains Google’s EU user consent requirements but does not describe any automatic default that Google applies in those regions. We did not test from an EEA, Swiss or UK connection, so we cannot tell you whether a missing default behaves differently there. We would not rely on it either way.

What to do

Set the default yourself, in <head>, before gtag.js or the GTM snippet. If you only need consent in some regions, scope it with region — Google’s consent guide documents region-specific defaults:

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  // Denied by default in the EEA, UK and Switzerland
  gtag('consent', 'default', {
    ad_storage: 'denied', ad_user_data: 'denied',
    ad_personalization: 'denied', analytics_storage: 'denied',
    region: ['AT','BE','BG','HR','CY','CZ','DK','EE','FI','FR','DE','GR','HU','IE','IT','LV',
             'LT','LU','MT','NL','PL','PT','RO','SK','SI','ES','SE','IS','LI','NO','GB','CH'],
    wait_for_update: 500
  });
  // Everyone else: decide explicitly rather than inheriting Google's default
  gtag('consent', 'default', {
    ad_storage: 'granted', ad_user_data: 'granted',
    ad_personalization: 'granted', analytics_storage: 'granted'
  });
</script>

Whether “granted” is right for the second block depends on the laws that apply to your visitors — several US states, for instance, require honouring opt-out signals. The point is that it should be your decision, written in your code, not whatever a help page says this month. Regional defaults are covered in more depth in showing the banner only where it is needed.

The fastest way to know what your tags do without a default is to look. Check what your Google tags send before consent with CookieInspector.