{"id":8101,"date":"2026-08-10T10:23:00","date_gmt":"2026-08-10T08:23:00","guid":{"rendered":"https:\/\/www.lukaswojcik.com\/blog\/?p=8101"},"modified":"2026-10-24T03:01:38","modified_gmt":"2026-10-24T01:01:38","slug":"ga4-consent-mode-v2-the-gcd-parameter-cmp-race-conditions-and-server-side","status":"publish","type":"post","link":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-analytics\/ga4-consent-mode-v2-the-gcd-parameter-cmp-race-conditions-and-server-side\/","title":{"rendered":"GA4 Consent Mode v2: The gcd Parameter, CMP Race Conditions and Server-Side Debugging"},"content":{"rendered":"

gcd<\/code> is a diagnostic clue in Google requests. The parameter does not replace consent verification or inspection of outgoing data. With an asynchronously loaded consent management platform (CMP), the sequence matters: defaults, stored choice, update, measurement event and actual transmission.<\/p>\n

Four signals with different purposes<\/h2>\n\n\n\n\n\n\n\n\n
Signal<\/th>\nMeaning<\/th>\n<\/tr>\n<\/thead>\n
ad_storage<\/code><\/td>\nStorage for advertising, such as cookies.<\/td>\n<\/tr>\n
analytics_storage<\/code><\/td>\nStorage for analytics.<\/td>\n<\/tr>\n
ad_user_data<\/code><\/td>\nSending user data to Google for online advertising.<\/td>\n<\/tr>\n
ad_personalization<\/code><\/td>\nPersonalized advertising.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Analytics permission is not a general marketing permission. In particular, ad_user_data<\/code> does not automatically authorize Meta CAPI. Other recipients and purposes need an explicit mapping to the choice actually collected.<\/p>\n

\"Four
Four stages of consent debugging: defaults, CMP update, browser request and destination-specific server output.<\/figcaption><\/figure>\n

What gcs and gcd reveal<\/h2>\n

Google describes gcs<\/code> as carrying the states of ad_storage<\/code> and analytics_storage<\/code>. gcd<\/code> carries more detailed consent information and is also sent without an active Consent Mode implementation. Its presence therefore does not establish correct configuration.<\/p>\n

Google explicitly warns that encoded HTTP fields can change. Observed letter tables and fixed character positions are not a permanent documented interface. A check such as gcd.charAt(6)<\/code> should not control permission to forward data. An apparently matching value proves neither valid consent nor a complete history of every decision.<\/p>\n

Investigating a CMP race condition<\/h2>\n

An early request with a different consent pattern from later requests can indicate a delayed update. A normal later acceptance, regional differences or a partial update can also explain the change. Comparing requests alone does not establish the cause.<\/p>\n

    \n
  1. A fresh Tag Assistant session establishes the earliest consent event and all four defaults.<\/li>\n
  2. The record includes CMP initialization and any stored choice. The choice must match the current purposes and vendor configuration.<\/li>\n
  3. All four update values are compared with the timing of the first measurement event.<\/li>\n
  4. The affected tag’s consent checks and firing reason are linked to the corresponding browser request.<\/li>\n
  5. The test matrix covers a new session, stored denial, stored acceptance, partial consent, withdrawal and a slow CMP, plus separate regional variants.<\/li>\n<\/ol>\n

    A defensible finding would be: a relevant stored acceptance existed, but the consent update was processed after the measurement event under investigation. That timeline distinguishes an ordering problem from a normal later decision.<\/p>\n

    Fixing order and bounding the wait<\/h2>\n

    In GTM, suitable consent templates should set defaults on Consent Initialization \u2013 All Pages<\/code>. Templates use setDefaultConsentState<\/code> and updateConsentState<\/code>. Calling gtag('consent', ...)<\/code> inside a template can introduce queueing delays. Starting a template early still does not guarantee that an asynchronously loaded CMP has finished.<\/p>\n

    For direct gtag.js integration, defaults must precede measurement-producing config<\/code> or event<\/code> commands. wait_for_update<\/code> provides a bounded waiting period for an update. The frequently shown 500 milliseconds is an example, not a reliable maximum CMP loading time. After expiry, the consent state available at that point applies.<\/p>\n

    A documented CMP event can support an appropriate firing strategy. An invented event name or an additional pageview on every consent change can instead lose or duplicate measurements. Firing, repeat events and navigation need joint testing.<\/p>\n

    Distinguishing Basic and Advanced<\/h2>\n

    Basic Consent Mode blocks the relevant Google tags until the required consent. In Advanced Consent Mode, loaded Google tags can send limited pings without the relevant cookies following denial. Therefore, denied<\/code> does not automatically mean no network traffic. A design requiring no corresponding transmission before consent needs verified blocking across every involved path.<\/p>\n

    Following server traffic to each destination<\/h2>\n

    In Google’s documented setup, a GA4 client processes the incoming request in the server container, and consent-aware Google tags use the transported signals. Behavior varies by destination and tag. A GA4 request is not a mandatory carrier for every other server client or vendor.<\/p>\n

    Server preview should connect the incoming request, responsible client, generated event, fired tags and outgoing requests. Third-party templates need explicitly verified rules for each recipient and purpose. An externally supplied consent field is also not cryptographic proof of consent.<\/p>\n

    Missing or unintelligible signals should remain visible as a separate error condition and must not imply permission. A minimized test record can include the case, event time, tag version, firing decision and destination. Full URLs or user data should not enter diagnostic logs without checking the contents and need.<\/p>\n

    Questions and answers<\/h2>\n

    Does missing gcd establish denial?<\/h3>\n

    No. A different transport path may omit the parameter. The origin, client and expected format need investigation. Unknown and explicitly denied are different diagnostic states.<\/p>\n

    Does gcs prove that no cookies were written?<\/h3>\n

    No. The parameter reports transported states. Actual cookie access and requests require additional browser and, where relevant, server inspection.<\/p>\n

    Does Consent Mode guarantee legal compliance?<\/h3>\n

    No. Technical signals do not replace assessment of consent, purposes, recipients, payloads and retention. A successful test suite establishes only the tested flows and versions.<\/p>\n

    Sources<\/h2>\n