Enhanced Conversions and Consent Mode: a practical guide to stop Google Ads working in the dark

You open Google Ads, look at last month’s conversions and they seem low. Then you open the CRM and there are more leads from the website. That gap almost always has two causes: conversions the tag can’t attribute to a click, and visitors who have rejected cookies without Google knowing.

The short answer is this: the solutions are called Enhanced Conversions and Consent Mode v2. The first sends Google Ads data the user has already given you (email, phone), hashed, so that more conversions are linked to your ads. The second passes on the choices made in the cookie banner, so that Google knows what it can use and can estimate the conversions it doesn’t see. Without both, Smart Bidding optimises on partial data.

In the projects we look after, it’s the first check we run on a Google Ads account, before touching bids or ads.

What is Enhanced Conversions and how does hashing work?

Enhanced Conversions is a Google Ads feature that, at the moment of conversion, sends user-provided data (email, phone number, name and address) hashed with the SHA-256 algorithm, so it can be matched to Google accounts and the conversion attributed to the right click. Google describes it as a way to make measurement more accurate and “unlock” more effective bidding (official documentation).

When someone fills in a form or completes a purchase, the tag reads the email entered, normalises it (lower case, spaces removed, phone in the international E.164 format, as set out in Google’s developer rules) and turns it into a string of characters with a one-way hash function. The address can’t be recovered from that string. Google compares the hash with those of users signed in to one of its services and, if it matches someone who clicked an ad, records the conversion even when the cookie has been lost (a change of device, a browser that restricts cookies).

Enhanced Conversions for web

This is for conversions that happen on the website: an e-commerce purchase, a quote request, a sign-up. The hashed data is sent along with the conversion tag.

Enhanced Conversions for leads

This is for businesses that sell off the website. The form collects the email and sends it, hashed, to Google when the lead comes in. Weeks later, when that contact becomes a qualified opportunity or a contract in the CRM, you upload the offline conversion using the same hashed email as the key. The GCLID is no longer the only key, but Google recommends including it when available, and it’s mandatory if you don’t collect user data with the tag (Google’s guide): it’s worth saving it in the CRM alongside the email.

For a B2B company this is the most useful variant, because Google Ads learns from the leads that become customers. We cover it in detail in from lead to contract: connecting the CRM and revenue.

What changed in 2026

Google has merged the two variants. Since April 2026 Google Ads has accepted user-provided data from three sources at once (site tag, Data Manager and API), and since June 2026 Enhanced Conversions for web and for leads has been a single on/off setting, with no more choice of method (Google’s announcement). Accounts that had already accepted the customer data terms were migrated automatically. Also, from 15 June 2026 the Google Ads API no longer accepts uploads of offline conversions and leads from advertisers who weren’t already using them, and Google points everyone to the Data Manager API (notice in the Google Ads API documentation): if you have a custom CRM integration built on the Google Ads API, it needs checking and migrating.

A word of warning: we have come across accounts with the switch turned on and no user data arriving, because the tag couldn’t find the email field.

What is Consent Mode v2 and how does it connect to Enhanced Conversions?

Consent Mode is the system through which the cookie banner passes the user’s choices to Google tags. Version 2 uses four signals, and one of them, ad_user_data, is explicit permission to send data to Google for advertising: if it is denied, Enhanced Conversions sends nothing for that user.

The four parameters, according to Google’s official reference:

• ad_storage: allows advertising cookies to be stored;
• analytics_storage: allows analytics cookies to be stored;
• ad_user_data: allows user data to be sent to Google for advertising purposes, and is required for Enhanced Conversions and for tag-based conversion tracking;
• ad_personalization: allows data to be used for personalised ads and remarketing.

In practice, Consent Mode determines what can be done for each visitor, Enhanced Conversions recovers the conversions of people who consented but lost the cookie, and modelling estimates those of people who refused.

Basic or advanced: what changes

Consent Mode can be implemented in two ways, and the choice affects how much data Google Ads has left to learn from.

Aspect	Basic Consent Mode	Advanced Consent Mode
Tag loading	Blocked until the user makes a choice in the banner	Loaded immediately, with consent denied by default
If the user refuses	No data sent to Google	Cookieless pings are sent (consent state, conversion, technical data)
Conversion modelling	Generic model	Model specific to your account, more accurate
Complexity	Simpler to set up	Requires care over the loading order of the signals
Assessment with the DPO	More straightforward	To be checked, because some technical data is sent even without consent

Source for the differences: Google Ads Help on Consent Mode.

When modelling kicks in

Google requires Consent Mode (or the IAB TCF v2 framework) to be implemented correctly and a threshold of 700 ad clicks over 7 days per country and domain grouping (official requirements). After implementation, at least seven full days are needed before modelled data appears in reports. Many niche B2B accounts never get there: for them Enhanced Conversions matters even more, because it doesn’t need volume.

What are the requirements in the EEA, and what does the Italian data protection authority say?

For traffic from the European Economic Area, Google asks you to collect consent and pass it on with Consent Mode v2: without these signals, measurement, ad personalisation and remarketing features can’t be used for those users (updates for EEA traffic). In the background is the Digital Markets Act: as a result of the DMA, since March 2024 Google has asked EEA users for consent to link its advertising services to other Google services (Google’s page on data in advertising services). In Italy, where we work, the banner must also comply with the cookie guidelines of the Garante, the Italian data protection authority.

These are two different levels: a Google rule (the EU user consent policy) and the law, which in Italy takes the form of the Garante’s Guidelines on cookies and other tracking tools (decision of 10 June 2021, in force since January 2022). The points that affect tracking:

• on the first visit, no cookies other than technical ones are installed until the user makes a choice;
• the user must be able to close the banner, for example with an X, and carry on browsing without being tracked;
• scrolling on its own doesn’t count as consent;
• cookie walls (access blocked without consent) are generally not allowed;
• the choice must be recorded and the banner must not be shown again for six months, unless something significant changes;
• there must be a link, reachable from every page, for changing your choices.

Translated into tags: the default value for all four parameters must be denied, the X must leave everything denied, and the button for changing your mind must send Google a consent update.

A clarification we always make: this guide describes how the tools are configured; it isn’t legal advice. Choices such as basic or advanced, the legal basis for data sent to suppliers or the wording of the privacy notice should be assessed with your DPO or with a lawyer who handles the company’s data protection.

What impact do they have on Smart Bidding and reports?

Smart Bidding sets bids based on the conversions it sees: if it sees too few, or the wrong ones, it bids less on searches that bring in customers and more on those that only bring clicks. Enhanced Conversions and Consent Mode increase the share of real and estimated conversions the algorithm learns from.

Take an industrial components company using a target CPA. Many visitors reject cookies, and several buyers click from their phone and then request a quote from their office computer. Without the full setup, many requests aren’t attributed: the CPA shown is higher than the real one, the algorithm lowers bids and the account shrinks back from the searches that were working. With Enhanced Conversions and Consent Mode, some of those conversions become visible again, matched to the email or modelled.

You’ll notice this in reports in three ways:

1. A jump in conversions after activation. These are conversions that weren’t being attributed before: explain this to management before it gets read as growth. In GA4, too, modelled data changes how you read the numbers: we explain this in our guide to GA4 reports for SMEs.
2. Modelled conversions mixed with observed ones. In Google Ads reports, estimates are included in the Conversions column. That’s why comparison with the CRM remains the benchmark check, as we explain in how to measure ROAS and the real impact of campaigns.
3. Learning period. It’s best not to change targets and budgets in the two weeks after activation.

What this means for lead generation and the CRM

For lead generation, the step that matters is Enhanced Conversions for leads connected to the CRM. The form sends the hashed email, the CRM records when the lead becomes qualified and when it signs, and those steps go back to Google Ads as offline conversions with a value. At that point you can ask Smart Bidding to optimise for qualified leads, or for contract value, rather than for completed forms.

Three conditions are needed: an email in the CRM identical to the one in the form, regular uploads (preferably automatic) and CRM stages with clear criteria. You’ll find the basics of this kind of first-party data in first-party data in marketing.

How do you implement them: GTM, gtag, Google tag gateway or server-side?

It depends on the site: Google Tag Manager is the most common choice, gtag.js is fine for simple or custom-built sites, and Google tag gateway and server-side tagging improve signal collection but don’t replace consent.

Google Tag Manager

This is the method we use most often (containers, tags and triggers are explained in our guide to Google Tag Manager for conversion tracking):

1. Default consent. The banner (or its GTM integration) sets the four parameters to denied with the consent initialisation trigger, which fires before all other tags.
2. Update. When the user makes a choice, the banner sends the update with the chosen values.
3. Conversion tag with user data. In the Google Ads conversion tag, turn on the inclusion of user-provided data and connect a “User-provided data” variable, fed by the dataLayer (the most robust solution), by CSS selectors on the form fields or by automatic detection.
4. Tag check. In GTM’s consent overview, check that every tag has consent checks set up, including third-party ones.

gtag.js

On sites without GTM, insert the default consent code before the Google tag, with gtag('consent', 'default', {...}), and the user data with gtag('set', 'user_data', {...}) before the conversion event. The wait_for_update parameter gives the banner a few hundred milliseconds to load before the tags fire, and url_passthrough keeps click information in the URL when cookies aren’t allowed (developer guide).

Google tag gateway

Google tag gateway for advertisers routes the Google tag and measurements through the site’s own domain, via the CDN or load balancer, rather than through Google’s domains. Google offers a guided setup with Cloudflare, while with other CDNs or your own load balancer it’s configured manually (official page). It recovers signals lost to technical blocking, but Consent Mode signals still apply when the tag goes through your domain.

Server-side tagging

With a GTM server container, data passes through a server you control before reaching the platforms: more control over what leaves the site, but infrastructure and maintenance costs. It makes sense when you have many platforms to feed or strict data requirements. Consent must be respected on the server side too.

For offline conversions from the CRM you then need the Data Manager integration (from the Google Ads interface, with connectors, or via the API). It’s the work we do in analytics and data together with integration development.

How to check that everything works, step by step

You verify it in the browser, in Tag Assistant, in Google Ads diagnostics and by comparing with the CRM. A test form is all you need.

1. Open the site in a private window and don’t touch the banner. In Tag Assistant, on the consent tab, all four parameters must show as denied from the very first event.
2. Reject, or close with the X. The state must stay denied and no advertising cookies should appear in the browser (developer tools, Application section, Cookies).
3. Reload and accept. A consent update with granted values should appear, and the tags that were waiting should fire.
4. Fill in the test form with a real email and check the network request to googleadservices.com/pagead/conversion/: the payload must contain the em parameter followed by a hashed string. If there’s only tv.1~em with nothing after it, the user data hasn’t been read (Google’s instructions).
5. Check that the conversion fires only once. In Tag Assistant, count the conversion events after the form is submitted.
6. After about 72 hours, open diagnostics in Google Ads (Goals, Summary, conversion action, Diagnostics) and read the alerts on Enhanced Conversions and data coverage: that’s the timeframe given in the same Google guide.
7. After two weeks, compare the leads in Google Ads with those in the CRM, campaign by campaign. The gap won’t be zero, but it should be stable and explainable.

Mistakes to avoid

These are the mistakes we find most often, and hardly any of them produces a visible warning.

• A banner that doesn’t send the signal to Google. The banner blocks and unblocks cookies, but isn’t connected to Consent Mode. Google receives tags with no consent state, and in the EEA features are restricted.
• Default consent set to granted. This happens with integrations set up in a hurry or copied from examples intended for other countries.
• Only the two old parameters. Half-updated banners that send ad_storage and analytics_storage but not ad_user_data and ad_personalization. Result: Enhanced Conversions and remarketing don’t work.
• Late consent update. The user accepts, but the update arrives after the conversion has already been sent as denied.
• Email field not captured. The CSS selectors point to a field that was renamed in the last redesign, or the form sits in an iframe (many CRM and booking forms do) and the tag can’t read it. It’s better to pass the email into the dataLayer at the moment of submission.
• Duplicate tag. The Google tag inserted both in the theme code and in GTM, or a CMS plugin adding its own. Conversions double and Smart Bidding overrates the campaigns.
• GA4 import and Google Ads tag both counted as primary. Two conversion actions for the same form, both used for bidding.
• Email changed in the CRM. For Enhanced Conversions for leads the key is the email entered in the form: if the salesperson replaces it with the correct company address, the match breaks.

Verification checklist

To pass on to whoever manages the website:

• Default consent denied for all four parameters, set before any tag
• A banner whose X or reject button keeps everything denied, and a link for changing choices on every page
• Consent update visible in Tag Assistant after acceptance
• Choice between basic and advanced made and shared with the DPO
• Customer data terms accepted and Enhanced Conversions switched on in Google Ads
• em parameter populated in the conversion request
• A single conversion per form submission and a single primary action per goal
• Google Ads diagnostics with no open alerts
• Offline conversion uploads from the CRM active via Data Manager, at a regular frequency
• Monthly comparison between conversions in Google Ads and leads in the CRM

Want to know whether your tracking holds up?

If the conversions in Google Ads don’t add up with the CRM, or you don’t know whether the banner sends signals to Google, we’ll check it together: Consent Mode, Enhanced Conversions, duplicate tags and the connection with the CRM. We’ll tell you what to fix and in what order, even if the answer is that everything’s fine.

You can book a call with Federico or write to us via the contact form. If you’d rather start from our services, you can see how we work on Google Ads and on analytics and data.

Frequently asked questions

Does Enhanced Conversions work if the user rejects cookies?

No. If ad_user_data is denied, hashed user data isn’t sent. For those users Google can only estimate conversions through modelling, if you use Consent Mode and reach the required thresholds.

Is Consent Mode v2 mandatory?

For EEA traffic, Google requires it in order to use measurement, remarketing and ad personalisation. It isn’t a law, but without consent signals those features are restricted. The banner, on the other hand, is a legal requirement.

Basic or advanced Consent Mode: which is better?

Advanced gives Google more data to model conversions; basic is more cautious because it sends nothing before the user chooses. The decision involves privacy considerations, so it should be made together with the DPO.

How long does it take to see the effects?

Enhanced Conversions diagnostics appear after about 72 hours. Consent Mode modelling needs at least seven full days and the click threshold to be met. The effect on bidding is assessed after the learning period, usually a couple of weeks.

Does Google tag gateway replace the cookie banner?

No. It changes the technical route the data takes, through your domain, but the consent rules stay the same and Consent Mode signals still have to be passed on.