4 Feb 2026 · GTM · medium severity · fix verified 9 Sept 2026
Google Ads automatically collects a broader range of website event data
'Advertisers may notice additional network requests to Google domains when these events are transmitted.'
What it breaks
Consent gating and Content Security Policies written for the old request set can block or leak the new requests; privacy reviews that inventoried requests are stale.
Who it hits: Every site with the Google Ads tag; anyone with a strict CSP or a consent audit on file.
The fix
Confirm the consent default fires before the tag and that ad_user_data / ad_personalization are set by your CMP; re-inventory requests.
fix artifact · #A-002
Consent Mode v2 default snippet
The default-denied block with all four signals (ad_storage, ad_user_data, ad_personalization, analytics_storage), placed before the Google tag, plus the update call your CMP should make.
- verified_on
- 2026-09-09
- next re-check
- 2026-12-01
- status
- current
Sources linked on every entry · artifacts stamped and re-verified · ← all changes