Consent Mode default states by region: the setting that decides data before the banner

Consent Mode works in two beats: a default state set as early as possible in the page, then an update when the visitor interacts with the banner. Everything a tag does between page load and banner click obeys the default. If that default grants analytics or ad storage in a region where consent must come first, the collection that happens in those seconds is the violation, regardless of how beautifully the banner behaves afterwards.

Region splitting is built for this. The default command accepts region parameters, so a site can set denied defaults for EEA and UK country codes and different defaults elsewhere in the same implementation. The common failure is not malice. It is a single default copied from a tutorial written for the site's home market and shipped worldwide.

The default is the decision

Tags should wait briefly for the consent update before firing in full, using the wait for update setting, so a fast consent click is not beaten by tags that already fired on the default. Test the race deliberately: load a page in a denied region, consent within a second, and watch the network calls. Then load and reject, and confirm nothing upgrades itself later in the session. Both directions fail in the wild, and neither shows up in a screenshot review of the banner.

Also test the second visit. The stored choice should set the default correctly from the returning visitor's saved consent, in both directions. A site that remembers a yes faithfully and forgets a no is not experiencing a bug pattern anyone should accept at face value.

Waiting for update, and the race nobody tests

For each region where any storage defaults to granted, write down the legal basis you are relying on, in the consent record next to the banner text versions. If the honest answer is that the tutorial said so, that region's default should be denied until someone can write a better sentence. That one page of documentation is what turns a Consent Mode implementation from a copied snippet into a position you can defend.

Document the basis for every granted default

Keep reading: Consent Records Retention: How Long to Keep Proof of a Yes, Alternatives to Cookiebot.

Frequently asked questions

What is the Consent Mode default state?

It is the consent status tags obey from page load until the visitor interacts with the banner and an update fires. Because collection between load and click follows the default, it is the legally decisive setting, especially in regions requiring consent before storage.

Should the default be denied everywhere?

In the EEA and UK, denied for ad and analytics storage until consent is the defensible position. Elsewhere it depends on local law, which is why defaults accept region parameters. Any granted default should have a written legal basis, not just a tutorial behind it.

What does wait for update do?

It gives the consent update a brief window to arrive before tags act fully on the default state, so a visitor who consents quickly is not undercounted and tags do not fire prematurely. Test it by consenting fast and watching network behaviour in a denied region.

How do I test Consent Mode beyond looking at the banner?

Load pages in denied and granted regions, consent and reject in turn, watch which storage and network calls fire in each state, then return as a second visit in both states. The stored choice must be honoured in both directions, not only for yes.