Cookies, banners and consent
Cookies
When users visit a page, from server perspective all page views and other actions are equal. Server can read some basic, general information on where a specific page view is coming from, like IP address or browser details. But this is not enough to precisely identify an individual person.
Without identification users wouldn't be able to log in to their accounts or even have their own cart. Server could serve wrong data to wrong people. That's why cookies were introduced in the early days of the internet. They are small text files that can be created by the server, stored by user's browser and then added to each future request to the server.
Because cookies are so powerful there are multiple safeguards enforced by browsers and servers to prevent cookies being stolen or leaked. Knowing someones cookie value could allow a malicious actor to use somebody's else account.
Since cookies are designed to precisely and reliably identify individual users they become core technology for analytical and advertising purposes.
3rd party Cookies
In addition to the main cookie value such as an identifier, each cookie contains an information about specific domain. That domain becomes the only place where a cookie can be accessed. This means a login cookie on one website cannot be read or used on another website. There is an exception to this rule, browsers allows websites to load parts of other websites using iframes or loading images from external sources, when this happens the embedded website can create their own cookies. These are the 3rd party cookie and that's why they are created:
user visits website a.com
a.com website embeds iframe or image from b.com
b.com sets a cookie readable only by b.com server
user visits website c.com
c.com embeds iframe or image from b.com exactly like a.com
b.com server can read and use the same cookie across a.com and c.com
That's why iframes or pixels used to be so powerful, they allow for reliably track the same person across multiple websites as long as all websites embedded the same iframe or pixel.
Interestingly, the embedding website cannot access those 3rd party cookies as they only belong to the server that originally created them.
Since 3rd party cookies haven't had use cases beyond tracking and analytics in recent years, they have come under scrutiny and are being gradually phased out due to privacy concerns.
Cookie banners
As explained above cookies are both essential and powerful components of modern internet. At the same time most end-users don't realise how exactly they work. That's why laws like GDPR force using cookie banner that explain what cookies are and how they are used by given website.
Additionally, those banners allow users to make a decision which cookies they accept and which they don't. As a result some cookies can be blocked impacting website features or tracking performance.
Cookie banners are to cookies what tracking pixels are to analytics, they are generic and need to work on virtually any website on the internet. And this is not an easy task when you think about how extensively cookies are used by various systems and platforms. That's why consent mode was introduced.
Consent Mode
Consent mode is similar technology to dataLayer. It is very technical protocol that provides standard information to all systems on the user consent status. In fact, the Google Consent Mode is a dataLayer extension. It is a set of commands that allow tag to adjust their behavior based on wether user accepted certain cookies or not.
For instance, Google Tags will read consent mode information from dataLayer and if consent wasn't granted then they will operate in privacy mode. Privacy mode means that no cookies will be created nor read and no personal information will be send to Google servers.