Cookie Consent sends Google Consent Mode signals: all denied before a visitor answers, then updated to match the answer the moment it is given. It is on by default, under Settings → What it does → Tell Google's own tags what they may do.

Before an answer. At the very top of the page's head, ahead of any Google tag, the plugin sets the defaults and asks Google's tags to wait half a second for an answer (wait_for_update: 500):

ad_storage, ad_user_data and ad_personalization: denied
analytics_storage: denied
functionality_storage and personalization_storage: denied
security_storage: granted

After an answer. One update follows. Advertising grants the three ad_ signals, Measurement grants analytics_storage, and Preferences grants functionality_storage and personalization_storage. The update is sent before anything held back is put back, so a Google tag released by the answer already knows it. A returning visitor's answer is sent the same way on every page, and a browser sending Global Privacy Control or Do Not Track gets everything denied.

This is a second layer rather than the main one: the blocker stops Google's tag loading at all until the visitor agrees. Consent Mode matters for a Google tag you have deliberately let through, and for Google's own modelling.

Checking it. Open your site in a private window, open the browser's developer tools and type dataLayer in the console. The first entry is the default above; press a button on the banner and the update appears after it.

What it does not do. It does not set up the tags inside Google Tag Manager (the Google Tag Manager section of these docs gives two ways), and whether a tag needs consent, and for which kind, is for you and your advisers to decide.