Consent Mode v2 for Dental Websites: What Consent Does and Does Not Do
Key takeaway
Before enabling Consent Mode v2, inventory every tag, embedded tool, and sensitive patient-facing workflow, then decide which data collection and visitor choices your practice will honor under applicable requirements. Configure and test the Google layer to reflect those decisions, but review non-Google vendors, notices, contracts, and data flows separately.
Consent Mode v2 is a Google tag configuration: a website passes a visitor’s choices to supported Google tags, which adjust their behavior. It can be useful, but it is only one privacy layer.
For dental practices, consent banners, records, tag settings, vendor reviews, privacy notices, and appointment-data workflows are related—but not substitutes.
Consent Mode receives a decision; it does not create one
Google’s Consent Mode overview says the site is responsible for obtaining a visitor’s choice, communicating it to Google, and making sure Google and third-party tags behave accordingly. Consent Mode handles the middle step for supported Google products. It is not the banner and does not decide who should be shown a choice or what it should say.
Version 2 adds ad_user_data and ad_personalization to ad_storage and analytics_storage. These settings communicate choices about advertising storage, analytics storage, sending user data for online advertising, and personalized advertising. They do not discover every tag or configure a non-Google script.
That distinction matters. A banner never connected to the tag setup is an interface, not a working Consent Mode configuration. A tag configuration with no usable visitor controls is not proof that a meaningful choice was collected. Settings depend on the practice’s actual tools, audiences, and applicable obligations; this is practical guidance, not legal advice.
Basic and advanced mode make different data-transfer choices
Google offers basic and advanced implementations. In basic mode, Google tags are blocked until a visitor interacts with the consent banner. Google says no data, including consent status, is sent to Google before that interaction.
Advanced mode works differently. The Google tag can load with a default state such as denied, then update after the visitor makes a choice. When storage consent is denied, Google describes sending consent-state and cookieless measurement signals that can support modeled reporting. So “denied” in advanced mode does not mean no information is sent at all. That is a material distinction to understand before treating one implementation as automatically more private than the other.
The implementation guide also stresses sequence: defaults need to run before measurement commands, and a later visitor choice needs to update the state. If a visitor later changes their preference, that change should be reflected on subsequent pages. Testing the accept, reject, and change-preference paths is therefore as important as adding a banner to the design.
Where Consent Mode stops
Consent Mode controls behavior for supported Google tags and SDKs. It does not automatically govern every analytics tool, embedded map, video, chat widget, scheduling tool, form handler, or other third-party code that might be present. A tag manager can make a site easier to organize, but it is not an inventory of every service that receives data.
It also does not write a privacy notice, decide whether a disclosure is permitted, or validate a vendor agreement. Those questions depend on the data flow and the terms in place. If a review raises questions about vendor status, business associate agreements, or other contract terms, use the resulting scope and asset list for contract-specific review with qualified privacy or legal professionals rather than relying on a website setting.
For measurement, it helps to set expectations before launch. A privacy-aware reporting plan can identify the decisions a practice needs to support without assuming that every possible event or visitor detail should be collected. Where paid acquisition is in scope, the same review should cover the pages and tags used for search ads, not just the homepage.
Dental page context changes the review
It is not accurate to call every anonymous visit to a dental website PHI. HHS explains that tracking on many general public pages does not have access to PHI. Context can change the analysis, however. HHS notes that tracking on a page where someone schedules care or enters a reason for care may have access to identifying health information; tracking on authenticated patient pages generally has access to PHI. Read the agency’s online tracking guidance for the full distinctions.
That is why Consent Mode is not a HIPAA solution. A consent signal does not turn information from an appointment request, a portal interaction, or another sensitive workflow into non-PHI. It also does not reveal whether a vendor receives information outside the Google tag path. Review those routes separately, based on what the site actually collects and transmits.
Build a scope and asset checklist before turning on a setting
A useful first pass is a concise asset review, not a promise that one configuration covers the whole site. Use it to establish what exists today, what is intentionally measured, and which owners need to sign off on changes.
- List Google tags, non-Google scripts, embedded tools, and the pages where each appears.
- Document the banner’s choices, the default signal state, and how each choice updates the tag setup.
- Flag appointment, login, registration, payment, or chat routes if the site uses them; record fields collected and every recipient.
- Test accept, reject, and changed-preference paths, then retain a dated record of what was checked.
- Review new tools before launch, using the same privacy-aware design approach described in our privacy architecture overview.
Consent Mode v2 can be a sensible part of a dental website’s measurement setup. It is not a compliance badge, a vendor review, or a replacement for careful design around sensitive pages. Start with the assets and data flows, then configure the Google layer to reflect the choices the practice has decided to honor.
Sources
Is AI recommending your practice?
A personalized review of your practice’s AI visibility. Report delivery target: 7 days after we receive the required practice information. Free, no strings.