Toni MaxxToni Maxx

Notes

Consent Mode v2 Without Your Own Cookies

This note describes how analytics works on tonimaxx.com. It is the setup I use, explained so you can judge it or copy the idea. It is not legal advice. Privacy law depends on where your visitors are and what you collect, so ask a lawyer before you rely on any of it.

The goal was simple. I wanted page-view numbers, no ads, and no cookies set by my own code. I also wanted nothing to load from Google until the rules allow it.

The rules the site follows

  1. Everything starts denied. Before any Google script exists, the page declares all four consent signals as denied: analytics storage, ad storage, ad user data and ad personalization.
  2. A saved choice wins. If you chose before, the page uses that choice and does nothing else.
  3. Browser privacy signals count as opting out. If your browser sends Global Privacy Control or Do Not Track, nothing from Google loads and no bar is shown.
  4. Otherwise the region decides. Visitors in the United States get analytics on by default, with an opt-out. Visitors elsewhere, or anyone whose country cannot be determined, are asked first.
  5. Only analytics is ever allowed. Advertising storage, ad user data and ad personalization stay denied, and Google signals are switched off. No ads run here.

The live wording is in the privacy notice. The script follows it.

Consent Mode v2 in short

Consent Mode lets a page tell Google tags what the visitor has agreed to. The page sets a default state first, then updates it when the visitor chooses. In v2 there are two extra signals for advertising, ad_user_data and ad_personalization. I keep both denied, since I run no ads.

The default is one call before the tag loads. This is the shape of it:

gtag('consent', 'default', {
  analytics_storage: 'denied',
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied'
});

When analytics is allowed, only one value changes:

gtag('consent', 'update', { analytics_storage: 'granted' });
gtag('config', ID, { allow_google_signals: false,
                     allow_ad_personalization_signals: false });

The Google tag script is added to the page only after that point. Before it, the browser fetches nothing from Google.

No cookies of my own

The site sets no cookies. Two small values live in the browser's localStorage on your device: your analytics choice and your light or dark theme. They are never sent to a server. When analytics is on, Google Analytics sets its own _ga cookies. When you opt out, the script removes them.

I chose localStorage over a cookie for the choice because the server never needs to read it. The page reads it, and that is enough.

The country lookup

To know whether to ask first, the page makes one request per page load to a small function I run. It uses your IP address to find the country class and answers either "United States" or "ask first". It does not store or log your IP address or the answer. The call is skipped when you already chose, or when your browser sends a privacy signal.

If the call fails or takes more than three seconds, the page treats you as someone who must be asked. The safe failure is the bar, not tracking.

The bar and the opt-out control

The bar has two buttons, "Accept analytics" and "No thanks", and a close button. Closing it means no analytics for now. It appears only after the page has been open for about two seconds, and it stays away while you type in a form or look at an image viewer. That keeps it from interrupting a task.

Every page has a footer link. It reads "Opt out of analytics" while analytics is on, and "Change analytics choice" when it is off. Opting out sets the saved choice to denied, turns off the Google tag and removes the analytics cookies. If you then accept on your own, that explicit choice is respected, even with a browser signal on.

What I would check on your site

  • Load the page with a clean browser profile and watch the network panel. Nothing from Google should load before consent where consent is needed.
  • Test with Global Privacy Control on.
  • Test the opt-out, then reload. The choice should hold.
  • Test a failed region lookup. The bar should appear.
  • Confirm your written notice matches what the code does. If you change one, change the other.

I keep these checks as automated tests for this site, so a change to the script cannot quietly break them.

Book the free consult

Related

What I checked / where this comes from

  • The public script on this site, consent.js, read in full on 11 November 2026. The excerpts above are short and trimmed.
  • The live privacy notice at /privacy/, last updated 10 November 2026.
  • Project facts: a consent test is part of the site's test set (site construction notes).
  • General practice: Consent Mode has a default call followed by an update call, and v2 adds ad_user_data and ad_personalization. Whether this setup satisfies a given law is a question for a lawyer.