Consent Mode on more than 100 websites: how to check that consent works

In the first half of 2026 I led the consent management platform (CMP) migration at Ingersoll Rand, covering 60 brands and more than 100 websites. This post is about the part that decides whether the data can be trusted afterwards: checking, region by region, that Consent Mode does what the banner promises.

The situation

I joined Ingersoll Rand in January 2026 as Web Data Analyst in the Customer Data Analytics Center of Excellence. The web estate covered 60 brands and more than 100 websites in every region, China included, spread across 5 Google Tag Manager containers. Part of my role was leading the move to a new CMP, and that included validating Google Consent Mode under GDPR and CCPA.

Those two laws start from opposite defaults. Under GDPR and the EU cookie rules, analytics and advertising storage stay off until the visitor opts in. Under CCPA, measurement can start and the visitor can opt out of the sale or sharing of their data. One banner configuration copied to every site cannot satisfy both.

What I did

I led the project with the development teams who implemented the new CMP on each site. We worked through the regional differences one by one and applied what each privacy regime permits, with no single global setting.

My own focus was validation, because a banner on the page says nothing about what the tags behind it are doing. I validated Consent Mode with Chrome DevTools and Google Tag Assistant. Tag Assistant shows the consent state each Google tag sees when the page loads and after the visitor's choice. DevTools shows the network requests themselves, so I could check what the tags sent before any choice and after an accept or a reject.

What I learned

In the United States, privacy law changes from state to state. There is no general federal law, and around 20 states had a general privacy law in force by January 2026, according to the IAPP tracker. Some of them, California and Colorado among them, require sites to honour the Global Privacy Control (GPC) signal that the browser sends. A single "US" setting in the CMP is too coarse for that.

China has the Great Firewall, and it affects Google tags. In GreatFire's tests the Google Analytics collection endpoint suffers interference from mainland China, while the Tag Manager domain was reachable in its October 2026 test. A container can load and set consent correctly while some of its hits never arrive, and Consent Mode has no control over that.

In Asia, each country has its own legislation, and a single "APAC" region hides large differences. Vietnam has required explicit consent since 1 January 2026 and does not accept implied consent, while Japan allows sending user data to third parties with notice and an opt-out.

What I would do today

If I started the same project now, I would agree these points with legal before the first site went live.

1. A consent matrix with one row per region, using ISO 3166-2 codes in the region parameter of the consent default. Google applies the most specific match, so US-CA overrides US (Google's consent mode guide). Each row records the default for the four Consent Mode v2 signals and who approved it.
2. GPC in the states that require it: the CMP reads the signal and updates ad_user_data and ad_personalization to denied. In September 2025 the California Privacy Protection Agency and the attorneys general of California, Colorado and Connecticut ran a joint sweep on GPC (CPPA), so it is enforced in practice.
3. denied by default where the law is opt-in: China under the PIPL, Vietnam, Thailand and India, whose main DPDP obligations apply from around May 2027.
4. A collection endpoint that works from mainland China, such as a server-side container or a first-party analytics tool hosted there (it needs its own ICP filing). Forwarding that data to Google is still a cross-border transfer under the PIPL.
5. The same test in DevTools and Tag Assistant after every container publish: accept, reject and no interaction, with the gcs and gcd parameters compared against the matrix and the consent default set in the Consent Initialization trigger. Consent Mode only controls Google tags, so other vendors need their own blocking in the CMP or in GTM.

There is also a regulatory reason to keep that matrix up to date. On 21 October 2026 EU member states agreed the Council's negotiating position on the Digital Omnibus (IAPP). It updates the ePrivacy rules on cookies and lists cases where consent would not be needed, audience measurement among them. The Council's draft of 2 October also shortened to four months the wait before a site can ask again after a rejection (PPC Land). The European Parliament has not agreed its own position yet, so negotiations between the institutions cannot start. If a text close to this one passes, CMP set-ups across the EU will need new rows: which measurement qualifies for the exemption, and which still waits for consent.

A question to finish

If your legal team asked you tomorrow which tags fire before consent, on which sites and in which countries, how long would it take you to answer? If the answer involves opening containers one at a time, the consent matrix is where to start.