Amazon Consent Signal (ACS) is Amazon's own format for telling Amazon Ads what a visitor chose on your cookie banner: two values, amznAdStorage and amznUserData, each GRANTED or DENIED, stored in a first-party amzn_consent cookie. It is one of three signals Amazon accepts for UK and EEA users. The other two are the IAB Transparency and Consent Framework (TCF) string and the Global Privacy Platform (GPP) string, and when a TCF string is present Amazon uses it and ignores ACS. Google Consent Mode does the same job for Google's tags only.
As of October 2026, Amazon requires one of those signals for personal data from UK and EEA users sent through the Amazon Ad Tag, the Conversions API and the Events API, with an enforcement deadline of 30 June 2026.
What Amazon Consent Signal is
ACS is a consent-sharing format developed by Amazon that lets advertisers and their consent tools pass visitor privacy choices to Amazon Ads. It works in a similar way to Google Consent Mode, but it is built for the Amazon advertising ecosystem, which includes Amazon DSP, Sponsored Display, Streaming TV and Amazon Marketing Cloud (AMC).
The requirement applies whether you collect data through tags, server-to-server conversions or data uploads. According to PPC Land's summary of Amazon's consent documentation, which sits behind an Amazon Ads login, Amazon set 30 June 2026 as the enforcement deadline for consent signals sent with the Amazon Ad Tag, the Conversions API and the Events API. Without a valid signal, data about those users cannot be used for measurement and attribution.
The alternatives to ACS are the IAB Transparency and Consent Framework (TCF) and GPP. ACS is narrower: it maps directly to Amazon's two consent values instead of TCF's vendor and purpose model.
How ACS communicates consent
ACS uses two values to signal a visitor's consent status to Amazon. Both accept GRANTED or DENIED.
| Value | What it controls | Accepted values |
|---|---|---|
amznUserData | Whether Amazon may process the visitor's personal data, such as advertising identifiers, for advertising | GRANTED / DENIED |
amznAdStorage | Whether Amazon may read or write advertising cookies or similar technologies on the visitor's device | GRANTED / DENIED |
Both values are usually mapped to the Marketing consent category. When a visitor accepts marketing cookies, both are set to GRANTED. When they decline, both are set to DENIED, and the Amazon Ad Tag restricts the events and first-party data it collects for that visitor.
The amzn_consent cookie
A consent tool that supports ACS stores the consent state as a first-party cookie called amzn_consent. The cookie contains a JSON payload with the visitor's country, the two consent values, a timestamp and a version number. A typical value looks like this:
amzn_consent={"geo":{"countryCode":"DE"},"amazonConsentFormat":{"amznAdStorage":"GRANTED","amznUserData":"GRANTED"},"timestamp":"2026-10-16T09:00:00.000Z","version":"1"}What each part of amzn_consent tells Amazon
The country code follows the ISO 3166-1 alpha-2 standard and tells Amazon which jurisdiction's rules apply. The GDPR is the same law in Germany, France and Ireland, but enforcement and national cookie rules differ between them.
The cookie alone is not enough on a page where the visitor changes their mind. Amazon's Ad Tag reads amzn_consent when it starts, so a choice made later on the same page reaches it through a browser event called amznConsentChange, which the consent tool has to dispatch. Amazon's own consent script (amzn-consent.js) does both. A consent tool that only writes the cookie leaves the tag working from the old state until the next page load.
One technical detail: the JSON structure of this cookie can trigger web application firewalls (WAFs) on some server configurations. If you notice the amzn_consent cookie being stripped or blocked, check your WAF rules and add an exception for this cookie format.
Who needs to implement ACS
Amazon requires a valid consent signal from any advertiser that transmits personal information to Amazon Ads for users located in the UK or the EEA. This applies across several scenarios:
- Running Amazon DSP campaigns that target UK or EEA audiences
- Using the Amazon Ad Tag on your website for conversion tracking
- Sending conversions server to server through the Conversions API or the Events API
- Uploading customer data to Amazon Marketing Cloud or Ads Data Manager for measurement or audience building
The server-side paths carry the signal differently. The Events API takes a consent object in each event, which can hold a TCF string, a GPP string or the two ACS values.
If you only run Amazon Sponsored Products ads within the Amazon marketplace itself, not on external websites, you do not need ACS on your own site. ACS applies when your website sends data to Amazon Ads.
ACS, Google Consent Mode and IAB TCF side by side
Three consent signal frameworks compete for attention on a website running ads on several platforms. Each serves a different ecosystem, and many sites need more than one.
| Feature | Amazon Consent Signal | Google Consent Mode v2 | IAB TCF v2.3 |
|---|---|---|---|
| Scope | Amazon Ads only | Google Ads, GA4, Floodlight | Many vendors (over 1,200 on the Global Vendor List in October 2026) |
| Signals | amznAdStorage, amznUserData | ad_storage, ad_user_data, ad_personalization, analytics_storage | Purposes, special features and vendor consents |
| Required for | Amazon Ads with UK and EEA data (enforced from 30 June 2026) | Google Ads and measurement in the EEA and UK (since March 2024) | Optional for advertisers, widely used by publishers |
| When denied | The Amazon Ad Tag restricts events and first-party data | Cookieless pings and conversion modelling in advanced mode | Depends on each vendor |
| Where it is stored | amzn_consent (first-party cookie) | No dedicated cookie, set through the consent API | A TC string stored by the consent tool |
| Priority at Amazon | Used when no TCF string is sent | Not read by Amazon | Used first if present |
The key difference between ACS and the TCF is scope. If you use the IAB TCF and Amazon is included as a vendor in your consent string, you do not also need ACS: Amazon uses the TCF signal and ignores ACS. But if your consent management platform does not generate a TCF string, ACS is the signal Amazon reads.
For websites running both Google and Amazon advertising, you need Google Consent Mode for Google's tags and either ACS or TCF for Amazon's, running side by side from the same banner choice.
How to set up Amazon Consent Signal
The implementation path depends on your consent tool. Kukie.io supports ACS natively: switch on Amazon Consent Signal in Banner Editor > Integrations, on plans that include it. The banner then writes amzn_consent from the visitor's marketing choice and country, starts it at DENIED in regions where your rules ask for opt-in, and dispatches amznConsentChange on every change so the Amazon Ad Tag learns of it without a reload. Kukie.io does not generate TCF strings, so on a Kukie.io site ACS is the signal Amazon receives.
General setup steps
The typical workflow involves three actions. First, map Amazon advertising to the Marketing consent category. Second, enable ACS in your consent tool's integrations settings. Third, check that the amzn_consent cookie is set correctly after a visitor interacts with your cookie banner. The Amazon Consent Signal setup guide walks through this for Kukie.io, and the ACS guide for advertisers covers the campaign side.
To check it, open your site in an incognito browser window. Accept marketing cookies through the banner, then look in your browser's cookie storage for amzn_consent. The JSON payload should show amznAdStorage and amznUserData set to GRANTED, along with a valid country code and timestamp. Reject and check again: both should read DENIED.
Without a consent tool
You can implement ACS without a consent tool by setting the amzn_consent cookie yourself, dispatching amznConsentChange and managing the consent logic in your own code. It is error-prone: you have to keep accurate records, handle withdrawals, respect regional rules and keep the signal in step with your actual banner state, and the GDPR expects you to be able to show the consent you rely on.
Amazon's own terms sit on top of the signal
Passing the consent signal correctly is only part of the picture. The law already asks the following of any website that shares visitor data with an ad platform:
- A clear privacy policy that names Amazon's role in data processing
- Affirmative opt-in consent that meets GDPR Article 7 standards
- A way to withdraw consent at any time
- Records of consent and refusals that you can produce on request
Amazon's advertising policies add rules of their own, for example on sensitive data and on sites directed at children. The current text is in the Amazon Ads Support Center, behind an advertiser login, so check it there rather than relying on a summary. These obligations sit alongside the ePrivacy Directive and GDPR requirements that already apply to your website.
What happens without a valid signal
Missing or invalid consent signals restrict conversion tracking and break attribution and measurement for UK and EEA users. Your Amazon ads will still run, but you lose visibility and performance data for those audiences.
From a regulatory perspective, the risk sits with you as the advertiser, not with Amazon. If a data protection authority such as the CNIL or the ICO investigates your cookie practices and finds that Amazon advertising cookies were set without valid consent, the fine falls on your organisation. GDPR Article 83 penalties can reach 4% of annual global turnover or EUR 20 million, whichever is higher.
Questions about Amazon Consent Signal
Is Amazon Consent Signal mandatory for all advertisers?
A consent signal (ACS, an IAB TCF string or a GPP string) is required only if you send personal data from UK or EEA users to Amazon Ads. As of October 2026, advertisers targeting only other markets are not required to send one.
Can I use IAB TCF instead of Amazon Consent Signal?
Yes. Amazon accepts the IAB TCF consent string, GPP or ACS. If your consent tool already generates a TCF string with Amazon as a vendor, Amazon uses the TCF signal and ignores ACS, so you should not send both.
What is the amzn_consent cookie and how long does it last?
The amzn_consent cookie is a first-party cookie set by the ACS integration. It stores a JSON payload with the visitor's consent status, country code and a timestamp. Its lifetime depends on the consent tool: Kukie.io sets it for one year.
Does ACS work with server-side data sent to Amazon?
Yes. Amazon's Events API takes a consent object in each event, which can carry a TCF string, a GPP string or the two ACS values, amznAdStorage and amznUserData.
Will enabling ACS affect my website performance?
The impact is minimal. ACS adds a small first-party cookie and a browser event. Kukie.io writes the cookie and dispatches the amznConsentChange event from its own banner script, so no extra Amazon script is needed for the signal.
What happens to my Amazon ad campaigns if a user denies consent?
Amazon does not use that user's personal data for advertising, and the Amazon Ad Tag restricts the events and first-party data it collects. Your campaigns continue to run for users who granted consent and for audiences outside the UK and EEA.
How does Amazon Consent Signal differ from Google Consent Mode?
Both tell an ad platform what the visitor chose, but for different ecosystems. Google Consent Mode controls Google Ads, Analytics and Floodlight tags, and in advanced mode sends cookieless pings for conversion modelling when consent is denied. ACS controls Amazon's advertising services.
Send Amazon the choice your banner records
If your website runs Amazon advertising for UK or EEA audiences, the signal should come from the same banner choice that controls every other tag. Kukie.io writes amzn_consent and notifies Amazon's tag from that choice, alongside Google Consent Mode, and logs each choice as proof.
