How to Hold the Google Ads Tag Until Consent

The Google Ads tag sends remarketing and page view requests to Google as soon as its code runs, and Google's consent mode treats a visitor as consenting unless the site says otherwise. Website tracking complaints under the California Invasion of Privacy Act, CIPA, name it in 158 verified complaints in the 12 months to September 29, 2026. The hold that sends nothing is loading the tag only after accept.

What the Google Ads tag sends before a visitor chooses

The Google Ads tag is the Google tag set up with a conversion ID that starts with AW-. It records sales, calls and form leads from ads, and builds remarketing lists so past visitors see the business's ads again. Google's help center explains that when someone clicks an ad, the click carries an identifier, the GCLID, and the tag stores it in cookies on the site's own domain so a later conversion can be credited to the click.

In Suitcast's test on September 29, 2026, on a local page in Chrome with a placeholder conversion ID and a test click ID in the address, the tag as Google publishes it, with no consent setting, did this before anything was clicked:

1. Downloaded gtag.js from www.googletagmanager.com.
2. Sent a remarketing request to www.google.com/rmkt/collect carrying the page address, the page title and the click ID.
3. Sent a page view with the same details to www.google.com/ccm/collect, and requests to googleads.g.doubleclick.net, ad.doubleclick.net and www.googleadservices.com. The first request to Google's ad servers left 0.4 seconds after the page opened.
4. Wrote the _gcl_au and _gcl_aw cookies on the site's own domain, and set cookies on doubleclick.net, googleadservices.com and google.com.

The result was the same in five runs in Chromium and five in Chrome. Nothing about it is a malfunction: it is what the tag is built to do. What a complaint describes is the order, a request to Google's ad servers leaving the browser before the visitor answered the banner. Suitcast's free scan records that sequence page by page, with the second each request fired.

Why website tracking complaints name the Google Ads tag

Website tracking complaints rest on two sections of the California Penal Code. Section 631(a) reaches anyone who, "willfully and without the consent of all parties to the communication", reads or attempts to learn the contents of a communication in transit. Section 638.51 bars installing or using a pen register without a court order, and section 638.50 defines one as a device or process that records routing and addressing information, "but not the contents of a communication". Section 637.2 allows the greater of five thousand dollars per violation or three times actual damages.

On Suitcast's tracker catalog, in the 12 months to September 29, 2026, the Google Ads tag page counts 158 verified complaints naming it, second among the 43 scripts the scan checks, behind Google Analytics 4 with 163 and ahead of the Meta Pixel with 138 and the TikTok Pixel with 116. The catalog rates it high risk. Medical and health providers account for 11 of the 158, more than any other industry. Suitcast's dataset page counts 406 verified website tracking filings in the same window.

Senate Bill 690, approved by the Governor on September 30, 2026, lets only the Attorney General sue a private actor over section 638.51 claims arising from a website or app, from January 1, 2027, including pending claims in actions commenced within the two years before that date. It leaves section 631 claims, and the $5,000 per violation in section 637.2, as they are. The SB 690 guide sets out what changed and what did not. If a letter has already arrived, the CIPA demand letter guide covers the first week.

Advanced consent mode still sends a page view

Google offers two ways to connect the tag to a banner, and they differ in what reaches Google before a choice. Google's consent mode page says basic consent mode prevents Google tags "from loading until a user interacts with a consent banner" and "transmits no data to Google prior to user interaction". Advanced consent mode loads the tags when the page opens, and "while consent is denied, the Google tags send cookieless pings".

The same page says the system "defaults to a consented state unless a specific choice has been made", with regional differences for the EEA, Switzerland and the UK. A US site that never sets a default has told the tag its visitors agreed, which is why the test above shows the full set of requests.

Suitcast ran the test again with Google's consent default set to denied for all four consent types, the advanced setup. In three runs the tag wrote no cookies and still sent one page view to pagead2.googlesyndication.com, carrying the full page address and the ad click ID. Google's consent mode reference says as much: with ad_storage denied, the "full page URL is collected" and may include ad click information. Accept then released the remarketing and conversion requests within a second.

The third setup loaded the tag's code only when accept was clicked. It made no request to Google in eight seconds of waiting, then downloaded the tag and sent its requests the moment accept was clicked. For a site that wants nothing sent before a choice, that is the setup that matches.

Enhanced conversions sends hashed form data

Enhanced conversions is the Google Ads setting that adds customer details to a conversion. Google's setup page says it sends "hashed first-party conversion data", such as an email address, name, home address or phone number, hashed with SHA256 before it leaves the browser, then "matched with signed-in Google accounts" to credit the ad click.

Three details matter to a small business owner:

• Automatic detection reads the page. The simplest method, "Automatically detect user-provided data", "inspects the page for strings matching configured data types". A booking form or a quote request is where those strings are.
• It can be on without anyone adding code. Google's account-level page says that when enhanced conversions is turned on for the account, existing conversion actions get it "unless the conversion action was previously explicitly opted out", and new ones inherit it. Google's 2026 update combines the web and leads versions into one on and off setting, and migrates existing users to it.
• It uses consent signals only where they exist. Google says the tag collects this data only if the account accepted the customer data terms and, "where applicable", the consent parameters are granted. Its consent reference calls ad_user_data "required for measurement use cases, such as enhanced conversions". A site that never sets ad_user_data gives the tag nothing to wait for.

Google also documents a "form interactions" switch in the Google tag settings that turns off the ads cookie these methods use, and a conversion_linker setting that stops first-party cookies, which Google does not recommend. Google presents neither as a way to stop the tag's requests. In Suitcast's test, conversion_linker set to false stopped the _gcl_ cookies on the site's domain, and the remarketing and page view requests still went to Google with the page address.

Where your Google Ads tag lives decides how to hold it

Most small business sites got the tag from one of four places, and each has its own switch. The table follows each vendor's documentation as read on September 29, 2026.

Read the table by the first column. In Tag Manager, Google's Ads tags carry built-in consent checks, but a check only waits when a default says denied, so the Tag Manager consent guide sets the default, the requirement and the trigger in that order. Google's Shopify consent page says that with the Google & YouTube app "consent mode should work automatically" once a banner is set up, and the Shopify banner guide shows why a US store has to add the United States to it. On WordPress, the WordPress cookie banner guide covers what Site Kit and a consent plugin each hold.

Google Analytics 4 usually rides on the same Google tag, and the Google Analytics 4 guide covers its side. A business that no longer runs Google Ads has a simpler fix: remove the conversion ID from the tag.

How to check whether your Google Ads tag waits

Test the page an ad sends people to, in this order, which is the same five-minute test the cookie banner guide walks through for every script:

1. Open the page in a private window with the network panel recording, and add ?gclid=test to the address so the tag behaves as it would after an ad click.
2. Do not touch the banner. Type doubleclick into the filter box. A request to googleads.g.doubleclick.net or ad.doubleclick.net is a request already sent.
3. Type collect into the filter as well. A request to google.com/rmkt/collect, google.com/ccm/collect or pagead2.googlesyndication.com carries the page address.
4. Click reject, reload, and look again. A request that still appears ignores the choice.
5. Fix it where the tag lives, using the table above, and repeat steps 1 to 4.

A scan does the same across several pages. The card below comes from a Suitcast report on a reserved example address: a plumbing company running Google Ads for water heater jobs, whose tag fired on three pages before any choice and kept firing after reject on the contact page, where the quote form is.

The scan logs every request from the moment a page starts loading until the network goes quiet or 8 seconds pass, without clicking anything, and matches each one against the 43 scripts in its catalog. A request to googleads.g.doubleclick.net, www.googleadservices.com, doubleclick.net or pagead2.googlesyndication.com is listed as the Google Ads tag. The scan then presses reject when a banner offers it, never accept, and watches 3 more seconds. The methodology page sets out the rules.

Keeping the tag held after the next campaign

A Google Ads tag rarely stays the way it was fixed. A new campaign adds a conversion action that inherits enhanced conversions, an agency installs a second tag through Tag Manager, or a theme update puts the old gtag snippet back in the header. Each of those puts a request to Google in front of the banner again, and nobody opens the network panel afterwards.

A free scan is one dated snapshot of 5 pages. Suitcast's Monitor plan scans up to 100 pages every week, keeps every report with its PDF, and sends a weekly email naming the scripts that are new, the fixes that did not hold, and the new filings that match the site by state, industry or script. It costs $39 a month or $390 a year, less than one hour of a privacy lawyer's time. A dental practice buying Google Ads for new patient bookings, or a plumbing company tracking calls and quote forms, gets the same check every week without asking anyone. An agency that manages Google Ads for its clients covers five sites on Pro for $79 a month or $790 a year, with its own name on each PDF, which the agency guide describes. The pricing page compares the plans.

Limitations

This guide quotes California Penal Code sections 631, 637.2, 638.50 and 638.51 and the enrolled text of Senate Bill 690 as published on leginfo.legislature.ca.gov, and Google Ads help center pages on consent mode, enhanced conversions and Shopify, all read on September 29, 2026; the bill's status, approved by the Governor on September 30, 2026, was read on October 1. The test used a placeholder conversion ID and a test click ID on a local page; a live account with conversion actions, enhanced conversions or remarketing lists may make more requests, and Google changes its tag without notice. Whether a given setup breaks CIPA is a question for a lawyer and a court, not a scan. Nothing here is legal advice; the not legal advice page says what a score and a count mean.

A scan sees only what leaves a visitor's browser. Conversions uploaded from a server or through Google's Data Manager are invisible to it. The complaint counts are verified federal filings plus state filings with a public source, and a case is linked to a script only when its complaint text names it, so 158 is a floor; the dataset explains how cases are counted.