Consent Mode v2 built to survive a DPO review

Google's behavioural modelling has a floor, and most sites that buy Consent Mode v2 sit under it. GA4 models unconsented traffic only where the property records at least 1,000 events a day carrying analytics_storage denied, and at least 1,000 daily users who saw the banner, on 7 of the previous 28 days. Below that you carry the loss with nothing modelled back. Week one measures your denied volume against that floor and gives you the answer in writing before anyone opens a container. What gets built: A consent initialisation layer that sets all four signals — ad_storage, analytics_storage, ad_user_data, ad_personalization — to denied by default in the page head, ahead of the CMP and ahead of GTM, so no tag can fire in the gap while the banner loads. The CMP (OneTrust, Cookiebot, Didomi or Sourcepoint) is then wired to update, mapped purpose by purpose against TCF v2.2 where the site carries a TCF string, with the Google Additional Consent string handled separately rather than assumed to follow. In GTM the Consent Initialisation trigger goes in front of everything, and every tag gets an explicit consent requirement rather than an inherited default — including the ones somebody added in 2022 and left unowned. Then the harder half, where most implementations fail: the state machine. Consent is not one event. A user rejects, browses, accepts later through the footer link, returns next week with a stale string, changes region mid-session on a VPN, or arrives from an AMP page with no CMP at all. Each transition is tested and recorded. What you can show a regulator: An evidence pack: a matrix of consent states against every tag and network request in the container, captured from the browser's own request log, showing what fired and what did not under accept-all, reject-all, granular partial consent, and re-consent mid-session. Dated HAR exports and screenshots, one set per state. This is the artefact your DPO or your FCA-facing compliance function asks for, and it is the reason this practice exists rather than a cheaper one. What we will not do: We will not implement advanced consent mode where nobody has written down the legal basis for pinging Google on a rejection. That is a decision for your DPO, not a checkbox in a container, and where the answer is not on paper we build basic mode and record why. We will not fire any tag on reject-all, including the one your media agency describes as just analytics. We will not build a server-side path whose purpose is to move a cookie out of the browser's lifetime rules while the user has said no. We do not write cookie policies, review contracts or give legal advice. Who should not buy this: Sites that have not chosen a CMP. Pick one, then talk to us. Teams looking for a number that goes back up: consent mode does not restore what consent removed, it models a portion of it, and if the brief is to make the dashboard resemble 2021, we are the wrong shop. And anyone who wants this done without the compliance owner in the room. Here they are the approver, not a stakeholder to be informed afterwards.