Google consent mode is an API developed in 2020 that can interact with your consent management platform (CMP) or a custom consent implementation. In Google consent mode, the CMP transmits users’ consent status to Google, so it can process it further.

Consent mode adjust how Google products, like Analytics, Tag Manager or Ads operate, depending on the visitor’s decision about advertising and analytics cookies. Google consent mode has been introduced to increase protection of user privacy, but the system is not without flaws.

In consent settings, you will find built-in consent checks – ad_storage and analytics_storage – that are used by the given Google tag and can’t be modified.

With only the default settings of consent mode in place, Google continues to collect data even when a visitor has explicitly said “no” to tracking and transfers data to the US, where it’s subject to US government surveillance. This is a breach of GDPR and most other privacy laws.

You can be privacy-compliant while using consent mode if you apply some modifications to the setup. To do so, you will need to block Google’s hits processed without consent. You’ll do it by forcing every tag to require explicit consent before any data is sent.

Additional reading:
Is Google Analytics GDPR-compliant?
Is Google Analytics illegal in the EU?
6 limitations of Google Analytics