What we check
In the deep scan: the browser hooks dataLayer.push before the first script and then clicks "Accept all". If a gtag('consent', 'update', {…}) appears afterwards, the line is "ok"; if it does not, the line reads "to review", because Consent Mode V2 may then never learn about the opt-in. No Google tag, no line. Without GA4 or Google Ads there is nothing that would need an update.
What the scan cannot see: updates a CMP implements through a different dataLayer name or by reading the cookie directly in the tag manager, and updates that fire only after the time limit. The content of the update, meaning which of the four parameters are granted, is checked by the Consent Mode V2 finding.
Why it matters
Consent Mode is a two-stroke engine. The default says "denied" before any tag loads. The update says "granted" when someone agrees. Without the second stroke, Google stays on the first, for everyone: the consent is logged in the CMP and never reached Google. Campaigns then run on modelled conversions, remarketing lists do not fill, and in the report the consent rate looks like a banner problem although the banner does its job. What the integration looks like in the common CMPs is covered in the hands-on guide to Consent Mode V2.
Common causes
- The CMP's Consent Mode integration is disabled, the banner only stores the decision internally.
- A custom banner replaced the standard CMP UI and simply never calls
gtag("consent","update",…). - The update fires into the void: a custom dataLayer name, or gtag is never defined on the page.
- The CMP SDK loads after GTM, the update arrives too late and the first hits of the session go out with the default.