Google Consent Mode is active, but the default signal sets an incorrect value for ad_user_data. This parameter controls users'data processing for ad personalization. If the value is anything other than "denied", Google may begin tracking before consent is obtained, which defeats the purpose of Consent Mode.
Possible causes
If your CMP is not integrated via Google Tag Manager: