Consent Mode has a reputation for being complicated. It is really two commands and one rule.
The default command
It must run before any tag fires — ideally in a Consent Initialization trigger.
The update command
Fire it when the visitor makes a choice in your banner, and again on every page load for returning visitors.
Checking your work
Tag Assistant shows the consent state for every event. All four signals should be present.