Opt-out law and opt-in law need different tag defaults

On this page

1. Opt-in starts at no; opt-out starts at yes
2. The region parameter lets one page hold both answers
3. Denied-by-default on US traffic has a price, paid in modelled conversions
4. An opt-out has to switch three things off, not one
5. A browser signal is an opt-out before anyone clicks anything
6. What's settled, and what's argued over
7. Check what your defaults actually do

Short answer: set two default blocks, not one. For visitors from the EEA, the UK and Switzerland, default all four Consent Mode parameters to denied and wait for the banner. For everyone else, including the US, default them to granted, because US state privacy laws give people a right to opt out rather than requiring you to ask first. Then build the opt-out path properly. When a US visitor opts out, whether by clicking your link or through a recognised browser signal, you switch on Google's restricted data processing and deny ad personalisation. That change has to reach your web container, your server container and your list uploads. Copying the European denied-by-default block onto US traffic turns measured conversions into modelled ones and buys you nothing under the state privacy statutes. It may buy something against California wiretap claims, and that part is still argued over. None of this is legal advice.

Opt-in starts at no; opt-out starts at yes

The two regimes differ in which state the law assumes before the visitor has said anything.

In the UK, storing or reading anything on a device needs consent unless an exception applies. The ICO says no advertising purpose meets the "strictly necessary" exception (ICO, storage and access technologies guidance, checked 24 September 2026). Google turns that into a contract term. For users in the EEA, the UK and Switzerland, its EU user consent policy requires you to get consent to cookies where the law requires it, and to the use of personal data for ad personalisation (Google, EU user consent policy, checked 24 September 2026). So the resting state is no, until the visitor says yes.

California works the other way round. The statute gives a consumer the right "to direct a business that sells or shares personal information about the consumer to third parties not to sell or share" it (Cal. Civ. Code § 1798.120(a)(1), checked 24 September 2026). That's a right to say stop, and it applies from the moment someone uses it. Until then, the law doesn't require you to ask first.

That's the whole structural difference, and the configuration follows from it.

The region parameter lets one page hold both answers

Google's consent API accepts a region list on the default command. When two defaults overlap, the more specific region wins. Google's own example sets ad_storage to granted for US and denied for US-CA, and a Californian visitor gets denied (Google for Developers, consent mode set-up, checked 24 September 2026). Regions use ISO 3166-2 codes, and a default with no region applies to everyone not covered by a more specific one.

A default pair shaped for the two regimes looks like this:

// Opt-in regions: denied until the banner reports a choice
gtag('consent', 'default', {
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  analytics_storage: 'denied',
  wait_for_update: 500,
  region: ['AT','BE','BG','HR','CY','CZ','DK','EE','FI','FR','DE','GR',
           'HU','IE','IT','LV','LT','LU','MT','NL','PL','PT','RO','SK',
           'SI','ES','SE','IS','LI','NO','GB','CH']
});

// Everyone else, including every US state: granted until an opt-out
gtag('consent', 'default', {
  ad_storage: 'granted',
  ad_user_data: 'granted',
  ad_personalization: 'granted',
  analytics_storage: 'granted'
});

Three details decide whether this works. First, the defaults have to run before the Google tag or your Tag Manager container. wait_for_update gives an asynchronous banner time to send its update before tags fire, and it belongs on the denied block where there's a choice to wait for (Google for Developers, consent mode set-up, checked 24 September 2026). Second, set all four parameters in both blocks. A block that scopes two parameters by region and leaves the other two global is a common way this breaks, and we covered it in the GA4 set-up that survives consent. Third, most consent platforms write this block for you from their geo rules. Check what they actually emit rather than what the settings screen says.

Denied-by-default on US traffic has a price, paid in modelled conversions

Over-gating is a defect, not a cautious setting. It trades conversions you could have measured for conversions Google has to estimate.

Google describes what happens when consent is denied. In advanced consent mode, tags load and send cookieless pings in place of full measurement. In basic mode, nothing is sent at all, not even the consent state. Ads conversion modelling then falls back to a general model rather than one specific to your account (Google Ads Help, about consent mode, checked 24 September 2026). Either way, a US visitor who never touches your banner stays denied for their whole visit. Their conversion is at best modelled and at worst missing, and Smart Bidding learns from the thinner signal.

You'd accept that cost in an opt-in region, because the law requires it there. In an opt-out region, the state privacy statutes don't ask for it. How much it costs depends on how many US visitors ignore the banner. We don't know of any independent data on US banner interaction rates, so measure yours: compare consented and denied sessions for a fortnight before and after any change to the US default. The trade-offs between the two implementation modes are covered in basic vs advanced consent mode.

An opt-out has to switch three things off, not one

The default is the easy half. The opt-out is where US configurations fail, because recording someone's request and acting on it are separate jobs.

When a visitor in an opt-out state uses your "Do Not Sell or Share" link, this is what has to change:

• Web container. Set Google's restricted_data_processing parameter to true. Google Ads then stops adding the user to remarketing lists and related audiences, while conversion tracking and campaign measurement "continue to function as normal" (Google Ads Help, US states' privacy laws, checked 24 September 2026). Tag Manager's Google Ads tags have an Enable Restricted Data Processing field for this. We'd also send a consent update denying ad_personalization, so any other consent-aware tag sees the change too. Google doesn't require that, and we recommend it only because it's cheap. Leave ad_storage and analytics_storage as they are. The opt-out is from sale and sharing, and measurement carries on.
• Server container. A server container builds its own outgoing requests. Whatever you set in the browser reaches a non-Google tag there only if you pass it through and apply it again in that tag.
• Lists and exports. Google's restricted data processing covers audience lists built with the Google Ads tag and nothing else. Audiences shared into Google Ads from Google Analytics need restricted data processing switched on in Analytics separately. And since 1 July 2023, Google no longer offers restricted data processing for Customer Match at all (Google Ads Help, US states' privacy laws, checked 24 September 2026). An opted-out person stays out of your uploads only if your export job removes them.

We set out all four downstream surfaces, including Meta's per-event flags, in what the Do Not Sell link actually has to switch off. The part people miss is that none of these three surfaces reads the others.

A browser signal is an opt-out before anyone clicks anything

In California, a business that sells or shares personal information "shall process" a qualifying opt-out preference signal as a valid request to opt out (Cal. Code Regs. tit. 11, § 7025(b), checked 24 September 2026). The Attorney General names Global Privacy Control as an acceptable way for consumers to opt out (California Attorney General, GPC page, checked 24 September 2026). So some US visitors arrive already opted out, and your granted-by-default block is wrong for them from the first page view.

Google says it receives GPC signals directly and applies restricted data processing to those ad requests for users in applicable states (Google Ads Help, US states' privacy laws, checked 24 September 2026). That covers Google's side only. Your consent platform still has to read the signal and apply the same opt-out path to every other tag, server event and list. The mechanism and the usual failure are in the setting that quietly disables Global Privacy Control. Which states treat the signal as binding is in the state-by-state position on opt-out signals.

What's settled, and what's argued over

Parts of this are settled by the text of the law. Others are genuinely unresolved, and the honest version keeps the two apart.

Settled:

• California's opt-out right, and the duty to treat a qualifying opt-out preference signal as a valid request, are in the statute and the regulations cited above.
• Opt-in exceptions exist inside opt-out states. California bars selling or sharing the data of consumers under 16, if you have actual knowledge of their age, without their affirmative authorisation, or a parent's for under-13s (Cal. Civ. Code § 1798.120(c), checked 24 September 2026). Virginia requires consent before processing sensitive data (Code of Virginia § 59.1-578(A)(5), checked 24 September 2026). If your site serves children or its funnel reveals health or similar sensitive information, a US-wide granted default isn't the right answer for those pages.

Argued over:

• Private suits over website tracking have been brought under the California Invasion of Privacy Act, a wiretap and pen-register statute rather than a privacy-law opt-out. That litigation risk is the real reason some US businesses gate tags, and the privacy statutes don't answer it. SB 690 in the 2025–26 session would let only the Attorney General bring pen-register claims (Penal Code § 638.51) over conduct on websites and apps, and would apply that retroactively to recent pending claims. It doesn't change the wiretap provision itself. It was presented to the Governor on 4 September 2026 and had not been signed or vetoed when we checked on 24 September (California Legislature, SB 690 status and enrolled text).
• Whether denying ad_storage on opt-out, rather than using restricted data processing alone, is required or just cautious. Google's documentation treats restricted data processing as the mechanism. Some advisers go further. We haven't found a regulator position that settles it.

This describes configuration behaviour, not legal compliance. A US privacy lawyer should sign off the rules you deploy, especially on the argued points.

Check what your defaults actually do

Load your site from a US location and from a European one, each in a fresh private window. In each, read the consent state before touching the banner: all four parameters should be present, granted in the US and denied in Europe. Then turn on GPC in the US window and reload. Restricted data processing should now be set, and your non-Google tags should have gone quiet.

Setting regional defaults, wiring the opt-out through the server container and the list exports, and verifying each step is the Consent Mode v2 work we do.

Sources

1. 1.Google for Developers — Set up consent mode on websites (region parameter, precedence, wait_for_update) · Checked 2026-09-24
2. 2.Google Ads Help — About consent mode (basic vs advanced, cookieless pings, conversion modelling) · Checked 2026-09-24
3. 3.Google Ads Help — Helping advertisers comply with the U.S. states' privacy laws in Google Ads · Checked 2026-09-24
4. 4.Google — EU user consent policy · Checked 2026-09-24
5. 5.ICO — Guidance on storage and access technologies: what are the exceptions? · Checked 2026-09-24
6. 6.Cal. Civ. Code § 1798.120 — Consumers' right to opt out of sale or sharing of personal information · Checked 2026-09-24
7. 7.Cal. Code Regs. Tit. 11, § 7025 — Opt-Out Preference Signals · Checked 2026-09-24
8. 8.California Attorney General — Global Privacy Control (GPC) under the CCPA · Checked 2026-09-24
9. 9.Code of Virginia § 59.1-578 — Data controller responsibilities (consent for sensitive data) · Checked 2026-09-24
10. 10.California Legislature — SB 690 (Caballero), Crimes: invasion of privacy, 2025–26 session, enrolled text and status · Checked 2026-09-24; enrolled and presented to the Governor 2026-09-04