Consent Mode URL passthrough is not a license to fire conversion tags before consent

What url_passthrough actually does

URL passthrough tells Google tags to propagate click-related query parameters on navigations when third-party cookies are unavailable or denied. Google's documentation lists gclid, dclid, gclsrc, _gl, and wbraid as parameters that may appear on links after passthrough is enabled. Requirements include a consent-aware Google tag on the page, passthrough enabled, consent mode implemented, same-registrable-domain outgoing links, and for Google Ads and Floodlight tags a GCLID or DCLID present on the landing URL.

For gtag.js you set url_passthrough before config commands: gtag('set', 'url_passthrough', true). In Tag Manager you can set Fields to Set on Analytics tags or enable linking on all page URLs on a Conversion Linker tag. Google notes you must set passthrough consistently across UA or Google Analytics tags respectively. Mixed containers where only one tag sets passthrough produce the same class of split-brain attribution as mixed pixel and CAPI clocks.

Passthrough is about cross-page continuity on your site, not about granting ad_storage. It helps the next page load carry the click id in the URL so a consent-aware tag can use it if storage becomes available later in the session. It does not flip denied to granted. If your CMP writes granted ad_storage only after marketing accepts, every tag that fires on Container Loaded before that update still runs in denied mode even though the URL shows gclid.

Google also warns that when passthrough is on, query parameters may interfere with site behavior if your CMS treats gclid or _gl as routing keys. That is not a consent bug. It is a redirect and analytics hygiene bug. Exclude those parameters from canonical URLs in Search Console and from internal site search filters before you blame Consent Mode for broken attribution.

ads_data_redaction is the other half

When ad_storage is denied, Google documents that new cookies will not be set for advertising purposes and that third-party cookies previously set on google.com and doubleclick.net will not be used except for spam and fraud. Data sent to Google still includes the full page URL, including ad click information in URL parameters, unless you enable further redaction.

Setting ads_data_redaction to true while ad_storage is denied redacts ad click identifiers sent in network requests by Google Ads and Floodlight tags. Requests can be sent through a domain without third-party cookies, such as pagead2.googlesyndication.com. Google explicitly notes ads_data_redaction has no effect when ad_storage is granted, or when gtag('consent') is not used.

Pairing url_passthrough true with ads_data_redaction true is a legitimate hardened default for denied states: keep ids on your URLs for your own redirects and analytics, redact them on Google ad network requests until consent grants storage. The failure is operational: teams treat passthrough as proof conversions work, while redaction plus denied ad_storage means Google ad tags still will not behave like pre-Consent Mode tracking.

The defaults teams ship together

Passthrough and redaction do not replace the consent update event.

gtag('consent', 'default', {
  ad_storage: 'denied',
  analytics_storage: 'denied',
  wait_for_update: 500
});
gtag('set', 'url_passthrough', true);
gtag('set', 'ads_data_redaction', true);
// Conversion tag on Container Loaded still sees denied ad_storage
// until CMP calls gtag('consent', 'update', { ad_storage: 'granted' })

Where this differs from TCF and GPP

IAB TCF strings and GPP sections describe vendor legal bases on the wire to adapters. Consent Mode is Google's tag-side interpretation for Google tags. You can have a valid TC string and still run Google tags in denied ad_storage until the Google-specific update runs, if your integration maps TC segments to Consent Mode incorrectly.

Pixellint's consent-on-the-wire docs cover TC and GPP field tables. This post is the Google tag behavior news: passthrough and redaction landed as privacy-preserving options, and teams conflate them with permission to fire conversion tags before ad_storage grants.

TCF v2.3 and disclosedVendors changes are a separate deadline. Do not mix them into passthrough setup. Fix Google tag order first: default deny, passthrough and redaction as set calls, CMP update before conversion tags, then verify granted state on the tag that actually sends ad network requests.

Checklist

• Set url_passthrough and ads_data_redaction before config, consistently on every Google tag in the container.
• Fire conversion and Floodlight tags only after CMP consent update grants ad_storage when you need ad attribution.
• Confirm redirects preserve gclid, dclid, gclsrc, _gl, and wbraid when passthrough is on.
• Log gtag consent state at conversion fire time; URL parameters alone are not proof of granted ad_storage.
• Mirror consent fields on server-side Google hits; passthrough is browser navigation only.
• Treat ads_data_redaction as active only while ad_storage is denied; retest after grant.

What to do

Audit trigger order before you tune passthrough. Consent Initialization or an equivalent default must run first, then CMP update, then ad conversion tags. If you use Tag Manager templates, Google's consent-apis template documents url_passthrough via gtagSet for custom templates.

Lint the consent block you ship: defaults, set calls, and update events in one fixture per page type. Pixellint is not affiliated with Google. Passing validation means the artifact matches the published consent guide shapes. It does not mean the CMP wrote granted ad_storage before your conversion tag fired.

If marketing insists passthrough fixed attribution, show two network captures: one with ad_storage denied and redaction true, one after grant. The difference is the lesson. URL parameters on your site are yours. Google ad tag requests follow consent state.

Document the CMP latency budget the same way you document CAPI clock skew. If wait_for_update is shorter than your banner script time-to-interactive, you chose a denied default that outlives the update window you configured. That mismatch is measurable in Tag Assistant and in your own consent log, and it is cheaper to fix than re-auditing a quarter of mis-tagged conversions.

Sources

• Google Tag Platform: Manage consent on websites
• Google Tag Manager: Consent APIs for templates

Contract pages

The dated argument is above. These pages are the field lists.

• Consent on the wire
• Pixel plus CAPI