Consent Mode v2: is it mandatory for small businesses in the EU and UK?

TL;DR

• If you run Google Ads or GA4 and any of your traffic comes from the EEA or the UK, Consent Mode v2 is effectively mandatory. Google has required it since March 2024.

• No regulator will fine you for skipping it. Google just stops adding new EEA users to your remarketing and audience lists, and your conversion reporting goes quiet.

• Basic mode holds tags back until someone consents. Advanced mode loads them and sends cookieless pings, and only advanced mode feeds conversion modelling.

• Modelling has a floor. Google Ads Help puts it at 700 ad clicks over 7 days per country and domain grouping, which most small accounts never reach.

• The certified CMP rule everyone quotes is a publisher rule for AdSense, Ad Manager and AdMob. Advertisers need working consent signals, not a certificate.

• Meta changed its EU model in January 2026, so European targeting signal is thinner on that side too.

• The law is moving again. The EU's Digital Omnibus proposes moving cookie consent into the GDPR itself as Article 88a.

Short answer: yes, if any of your traffic comes from Europe and you use Google's ad or analytics tags. It isn't a law, and nobody from a data protection authority is going to knock. Google simply made it a condition of using its own measurement and audience features for European traffic, and it has been that way since March 2024.

The longer answer matters more, because most of the businesses asking this question already have a cookie banner installed and assume that's the job done. It usually isn't. The banner and the consent signal are two different things, and a banner can sit there looking compliant while sending Google nothing at all.

What is Consent Mode v2?

Consent Mode v2 is a Google setting that tells Google's tags, in real time, whether a visitor agreed to cookies for advertising and analytics, so the tags can change their own behaviour instead of firing blindly.

It works through four signals your cookie banner passes to Google: ad_storage, analytics_storage, ad_user_data and ad_personalization. The last two arrived with v2 in late 2023. They cover whether you may send personal data to Google for advertising and whether that data may be used for personalised ads. Without them, Google treats the visit as if you never asked.

That's the whole mechanism. Your consent tool sets four flags, Google's tags read them, and everything downstream (conversion tracking, remarketing lists, Smart Bidding inputs) behaves according to those flags.

Is Consent Mode v2 mandatory for small businesses in the EU and UK?

For Google's products, yes, and business size makes no difference. Any site using Google Ads or Google Analytics 4 with visitors in the EEA or the UK needs it. A five-person plumbing firm in Manchester and a hundred-person retailer in Munich sit under the same requirement, because the requirement attaches to the traffic, not the company.

The trigger came from the Digital Markets Act, which pushed Google to prove it had a lawful basis for the European data flowing into its ad platform. Rather than police every advertiser individually, Google made the consent signal a technical condition of the features that use that data.

Two things follow that people miss.

First, a US company with EU visitors is included. If you're in Texas selling software to buyers in Ireland and Germany, the European share of your traffic falls under the same rule. You don't get an exemption for being small or for being based somewhere else.

Second, the UK counts. Brexit didn't move it out of scope, because this isn't EU law deciding the boundary. Google drew the boundary and put the EEA and the UK on the same side of it.

What actually breaks if you ignore it?

Nothing visible on day one, which is why this gets found late. Over the following weeks, EEA and UK users stop being added to your remarketing and audience lists, conversion counts for European traffic drop below reality, and Smart Bidding starts optimising against a partial picture of what worked.

Here's the order it usually shows up in.

Your audience lists flatten first. Google's own documentation on the EEA changes is blunt about it: without consent mode, new EEA users don't get added to audience lists used for remarketing in Google Ads or for audiences in Analytics. An existing list keeps shrinking as members age out, and nothing replaces them. Six months later your remarketing campaign has almost no one to talk to and you can't work out why the reach collapsed.

Then reporting drifts. Conversions still record for consenting users, so the number isn't zero, and that's the trap. A number that looks plausible while quietly excluding a chunk of your European buyers does more damage than a zero, because you'll believe it and cut campaigns that are working.

Then bidding gets worse. Target CPA and Target ROAS learn from the conversions you feed them. Feed them a filtered subset and they optimise for whatever slice of your audience happens to accept cookies, which is not the same slice as your buyers.

 Should you use basic or advanced Consent Mode?

Advanced, in nearly every case. Basic mode blocks Google's tags from loading at all until consent arrives, so a visitor who ignores the banner is invisible. Advanced mode loads the tags, holds back identifiers, and sends cookieless pings that let Google model the gap. Modelling only works on advanced.

 

Some legal teams prefer basic because nothing leaves the browser before consent. That's a defensible position, and it's your call with your own advisers. Just make the choice knowingly instead of inheriting whatever your consent plugin shipped with, which is where most basic mode setups come from.

Will conversion modelling actually work on a small ad account?

Probably not, and this is the part nobody tells small advertisers. Google Ads Help sets a floor for consent mode modelling: at least 700 ad clicks over a 7 day period, per country and domain grouping. Below that, Google won't model your missing conversions. You get advanced mode's compliance benefit and none of its measurement recovery.

Read that threshold carefully, because per country is doing a lot of work in that sentence.

Say you're a small ecommerce brand selling into Germany and the Netherlands. You spend EUR 1,800 a month at an average CPC of EUR 0.90, so you're buying around 2,000 clicks a month, roughly 500 a week. Split that 60/40 across the two markets and Germany gets about 300 weekly clicks and the Netherlands about 200. Neither market clears 700. Nothing gets modelled, in either country, no matter how correct your setup is.

Now the other end. One Google Ads account we manage ran GBP 46.3K of spend at a GBP 0.57 average CPC, which works out at roughly 81,000 clicks, and produced 2.41K conversions at GBP 19.21 cost per conversion. An account buying clicks at that volume clears 700 a week in a single country with room to spare, even split across a few markets. Modelling has real data to work from there.

The practical read: if you're spending a few hundred a month per country, treat advanced mode as a compliance move that keeps your audiences alive, and expect your reported conversions to stay lower than your actual sales. Track leads and orders in your own CRM or backend as the source of truth, and use Google Ads for direction rather than absolute counts.

How many European visitors actually consent?

Fewer than you'd hope, and it varies sharply by country. Didomi's 2026 data privacy benchmark puts average consent rates across European regions between 75.1% and 89.3%, with Western Europe the lowest at 75.1%. France sits around 71%.

Those headline numbers look generous until you separate them from marketing consent specifically, which runs lower and is the flag that matters for ads. Consent for analytics and consent for ad personalisation are separate switches, and the second one loses more people than the first.

There's also a quality problem sitting underneath all of it. The best known academic study of European banners, Nouwens and colleagues at CHI 2020 ("Dark Patterns after the GDPR"), scraped the five most popular consent platforms across the top UK sites and found that only 11.8% of the banners met the minimal requirements of European law. Most of the rest used implied consent, buried the reject option, or made refusing take more clicks than accepting.

Two things come out of that for a small business owner. Your consent rate is partly a design outcome, so a banner with an equally easy reject button will collect fewer marketing consents than a dark-patterned one, and it will also survive a complaint. And a high consent rate can be bad news, because a banner that nudges hard carries a risk a cleaner banner would remove.

Do you need a Google-certified CMP?

If you're an advertiser, no. The certified CMP requirement applies to publishers and app developers monetising with AdSense, Ad Manager or AdMob, who have needed a certified platform integrated with the IAB's Transparency and Consent Framework since 16 January 2024 for EEA and UK traffic, and since 31 July 2024 for Switzerland.

As an advertiser you need consent signals that reach Google's tags correctly. That's it. A certified CMP will do that, and so will plenty of uncertified tools, including several banner plugins that cost nothing.

This mix-up is common enough that it's worth checking whether you were sold on it. If someone quoted you a monthly consent platform fee on the grounds that Google requires certification for your ads account, they either misread the documentation or hoped you would.

If you also run display ads on your own site, or have an app with AdMob, then the publisher rule does apply to you and certification is genuinely required. Both hats, both rules.

How do you check your own setup in 20 minutes?

Open your site as a stranger would and watch what happens before you touch the banner. You're checking three things: that the banner appears, that Google's tags respond to it, and that all four consent signals are being set rather than two.

1. Open your homepage in a fresh incognito window. Don't click anything on the banner.

2. Open developer tools, go to the Network tab, and filter for "collect" or "googleads". If tags are firing normally with identifiers before any choice, your consent setup isn't wired in.

3. In Google Tag Manager, turn on the consent overview (Container settings, then the Tags list) and confirm every Google tag is listed as consent-aware. Tags that ignore consent will show up here.

4. Run GTM's Preview mode, load your site, and open the Consent tab. You want ad_storage, analytics_storage, ad_user_data and ad_personalization all present. Two out of four means you're still on v1 behaviour and v2 signals are missing.

5. Reject everything, then submit a test enquiry form. On advanced mode a cookieless ping still goes out. On basic mode nothing does. Whichever you see, now you know which mode you're on rather than guessing.

6. In Google Ads, open Audience Manager and look at the size of your EEA remarketing lists over the last 90 days. Flat or falling while traffic holds steady is the signature of missing consent signals.

Twenty minutes of this tells you more than any vendor sales call. If step 4 shows two signals instead of four, that's your whole problem, and it's usually a settings toggle in the consent tool rather than a rebuild.

What do people get wrong here, and what does it cost them?

The expensive mistakes are all versions of the same thing: assuming installed means working. A banner that renders is not a consent signal that arrives, and the gap between the two is invisible until you go looking.

Installing a banner and stopping there. Most consent tools ship with Google consent mode as an option you have to switch on. Leave it off and you have a legal notice on your site and no signals reaching Google, which is the worst of both positions.

Staying on basic mode by accident. The tool defaulted to it, nobody changed it, and conversions for European traffic quietly sit at half of reality for a year. The cost isn't the reporting. It's every budget decision made on that reporting.

Reading a GA4 to Google Ads mismatch as a tracking bug. The two use different attribution and different modelling, so they were never going to agree. Chasing that difference burns weeks. Pick one system as the number you manage against and let the other one be directional.

Deleting the banner to "fix" tracking. This does restore your numbers and it also removes your lawful basis for the tracking, which is a trade nobody should take. It is also the version that turns a measurement problem into a regulatory one.

Assuming the agency handled it. Ask for two specifics in writing: which mode you're running, and confirmation that all four consent signals appear in GTM Preview. If the answer is vague, the setup is usually vague too.

Does any of this apply to Meta ads?

Yes, separately. Meta doesn't read Google's consent signals, so your setup there is its own job, and the European picture changed in January 2026. Meta now offers EU users a choice between full personalisation and a more limited, less personalised experience, after the European Commission fined it EUR 200 million in April 2025 over the earlier pay or consent model.

For advertisers, the effect is less behavioural signal available for EU targeting. A growing share of European impressions comes from people on the limited setting, which thins out audience precision and remarketing reach. You'll feel it as narrow audiences performing worse than they used to and lookalikes getting less reliable.

The response is boring and it works: send Meta better server-side signal through the Conversions API with consent handled properly, then stop trying to slice small audiences. Broad targeting with strong creative holds up when the platform's signal weakens, because the algorithm still has your conversion feedback to work with even if it has less profile data.

We see that pattern in the numbers. One lead campaign we run brought in 2,631 leads at GBP 2.68 each, with the best ad set down at GBP 0.77, across 205,579 reach. That came from creative that filtered the wrong people out before the click, not from clever audience stacking.

Also check your Meta pixel against your consent tool. A pixel that fires before consent in the EEA is the same category of problem as a Google tag that does, and it usually gets caught later because fewer people think to look.

Is the EU about to change the rules again?

Probably, and in a direction that should make life simpler. The Commission's Digital Omnibus, published in November 2025, proposes moving cookie consent rules out of the ePrivacy Directive and into the GDPR as new Article 88a, with Article 88b making browser-level consent signals legally binding on websites.

Timing, as it stands: the proposal is in trilogue negotiations through 2026, Article 88a would apply six months after the package enters into force, and Article 88b within 24 months. The separate ePrivacy Regulation proposal was withdrawn in the Commission's 2025 work programme after years of deadlock, so the existing ePrivacy Directive and its national versions still govern cookies until the Omnibus lands.

Germany has already gone further on its own. The Consent Management Ordinance (Einwilligungsverwaltungsverordnung) came into force in April 2025 and sets up recognised consent management services that store a user's preferences centrally, so participating sites can read them instead of showing another banner. Taking part is voluntary, and existing tools that satisfy Section 25 of the TDDDG and the GDPR are still fine.

None of this changes what you should do this quarter. Browser-level signals will eventually reduce the number of banners people see, and they won't remove the need for your tags to respect a consent decision. If anything, a legally binding browser signal makes a correct consent mode setup more important, because the signal will arrive whether your site is ready to read it or not.

FAQ

Q) 1 Is Consent Mode v2 a legal requirement?

No. It's Google's requirement for using its measurement and audience features with EEA and UK traffic. Your legal obligation comes from the GDPR and the ePrivacy Directive, which require consent before setting non-essential cookies. Consent mode is how you tell Google what that consent was.

Q) 2 What happens if I just don't implement it?

Your ads keep running. New EEA and UK users stop being added to remarketing and audience lists, conversion reporting for that traffic understates reality, and Smart Bidding optimises on the incomplete data. The damage compounds over months rather than appearing at once.

Q) 3 I'm a US business with a bit of European traffic. Do I need it?

For that European traffic, yes. The requirement follows the visitor's location, not your company's. If Ireland and Germany send you 8% of your leads, that 8% falls under the rule.

Q) 4 Does the UK still count after Brexit?

Yes. Google applied the requirement to the EEA and the UK together, so UK traffic is in scope regardless of what UK law says separately.

Q) 5 Will advanced mode make my conversion numbers look normal again?

Partly, and only if you're above the modelling floor of 700 ad clicks over 7 days per country and domain grouping. Small accounts get compliance and audience continuity from advanced mode, but should expect reported conversions to stay under actual sales.

Q) 6 Can I use any cookie banner, or does it have to be a specific one?

Any tool that correctly sets the four consent signals works. Certification matters for publishers running AdSense, Ad Manager or AdMob, not for advertisers. Free plugins can be perfectly adequate if the Google consent mode integration is switched on and tested.

Q) 7 Does consent mode affect my SEO or organic rankings?

No. It changes measurement and ad audiences. Rankings aren't touched. Your organic traffic reporting in GA4 will be affected by consent, though, so organic numbers can look lower than reality for the same reason paid ones do.

Q) 8 Do I need a separate consent setup for Meta ads?

Yes. Meta reads its own consent configuration, not Google's. Check that your Meta pixel and Conversions API respect the same banner decision your Google tags do.

Conclusion

Consent Mode v2 is mandatory for practical purposes, cheap to get right, and quietly expensive to get wrong. The failure mode isn't a fine. It's twelve months of decisions made on conversion numbers that were missing a chunk of Europe, and a remarketing audience that emptied out while nobody was watching. Twenty minutes in incognito with developer tools open tells you which side of that line you're on.

So when did you last actually check that all four consent signals reach your tags, rather than trusting that the banner on your site means they do?

Get a free 15-minute consent and tracking check

Want someone else to look at it for you? Get a free 15-minute consent and tracking check at  https://cal.id/mavixmarketing/strategy-call 

 and we'll tell you which mode you're on, whether all four signals are firing, and what it's costing you in lost conversions.