Consent Mode v2 Lint for GA4 & Google Ads

Eighteen findings in a twenty-two-line file. That is what this checker returns for a developer shipping GA4 and Google Ads tags to visitors in the EEA or the UK, run against a test file built from consent-mode mistakes that really ship.

None of those eighteen lines throws an error. That is the whole problem. Write adStorage instead of ad_storage, or true instead of the string 'granted', or region: ['EU'] when the region parameter accepts ISO 3166-2 codes only, and the browser accepts it, the page loads, the tag fires — and Google sets no consent state at all. There is no red line in the console and no warning in the network tab. The only symptom is a number going down somewhere else, weeks later.

That symptom got more expensive on 15 June 2026. Until then, two things jointly decided whether advertising data reached Google Ads: the Google Signals toggle in the GA4 property, and the ad_storage consent signal. Since that date they are separate. Google Signals now only governs behavioural reporting inside GA4, and ad_storage alone decides what reaches Google Ads. A loose consent implementation that was quietly carried by the old fallback now simply loses advertising data, on the day of the switch, with no notification.

The obvious tools do not catch this. Google Tag Assistant and the browser console inspect a page that is already deployed and already loading tags. They cannot read a consent block sitting in a feature branch, a component that only renders on one route, or a landing page nobody has opened in months. By the time a deployed-page checker can see the mistake, the mistake has already been live.

So the check belongs in the editor. Consent Mode v2 Lint carries 20 rules: 18 that read hand-written gtag(), HTML and JS — misspelled and camelCase consent keys, boolean, numeric and unquoted values where Google requires 'granted' or 'denied', invalid region shorthands, a wait_for_update under 500 ms or passed as a string, url_passthrough and ads_data_redaction switched off, dataLayer.push(['consent', ...]), 'defaults' and 'updates' command typos, a consent default that grants an advertising signal, allow_google_signals after the June 2026 change, leftover placeholder tag IDs, and anonymize_ip, which does nothing in GA4. Two more rules read a GTM container export: tags carrying no consent settings at all, and Google Ads conversion tags marked *No additional consent required*.

Every finding names the line and the correct value. Checking the file you have open is free and finished — all 20 rules, nothing withheld, no watermark and no trial clock — and it will also list every rule it carries, so you can see what was not tested. What the licence adds is scope: every file in the repository in one pass, an exportable CSV, JSON or HTML report to hand a client or a DPO, and machine-readable output so CI fails the build instead of production. A freelancer's consent-mode audit is commonly quoted at $400–$1,200.