The Digital Markets Act (DMA) binds gatekeepers, not publishers. It stops designated platforms such as Google and Meta from combining personal data across their services without the user's consent, and the gatekeepers pass that requirement on to the websites that use their tags through their own terms. As a publisher, your duties still come from the GDPR and the ePrivacy Directive: collect valid consent, then pass the visitor's choice to each vendor in the format it reads, such as Google Consent Mode signals.
European lawmakers designed this legislation to curb the market power of the largest technology platforms, known as gatekeepers. Article 5(2) of the DMA says these companies can no longer combine personal data across their core platform services without the user's consent. To meet this requirement, they now ask third-party websites using their advertising and analytics tools to collect that consent and send it with the data.
Platforms like Google or Meta expect a consent signal before they use your audience data for advertising. Failing to send one reduces what their advertising and measurement tools can do for your visitors.
The European Commission designated Alphabet, Amazon, Apple, ByteDance, Meta, and Microsoft as the original gatekeepers on 6 September 2023, and Booking followed on 13 May 2024, according to the Commission's list of gatekeepers. As of October 2026 that makes 7 gatekeepers and 23 core platform services. If your website loads scripts from any of these companies, their consent terms apply to your data collection setup.
How gatekeepers pass consent duties to publishers
Gatekeepers operate large advertising networks that rely on third-party websites to feed them behavioural data. Under the DMA, these networks face fines if they combine personal data across services without consent from European users.
Alphabet and Meta do not interact directly with your website visitors. They provide you with tags and scripts, such as the Meta Pixel or Google tag, which you embed in your HTML. Because they cannot show a consent prompt to your users, they require you to do it and transmit the result to their servers.
If you send no signal, the gatekeeper treats the visitor as not having consented to the uses that need it.
A visitor clicking "Accept" on your website must reach the vendor in a form it reads. For Google, that is a Consent Mode update. Meta's pixel has its own consent calls, fbq('consent', 'revoke') before a choice and fbq('consent', 'grant') after an accept. A choice that stays only in your own consent cookie is invisible to them.
Google Consent Mode and what Google asks of publishers
Google built a specific framework for this. Since March 2024, Google has required Google Consent Mode v2 signals for ads personalisation and measurement on traffic from the European Economic Area (EEA), and Google Ads' consent guidance asks advertisers to share consent signals with Google.
Version 2 added two parameters to the original ad_storage and analytics_storage. These parameters tell Google how it may use the data it receives.
The ad_user_data parameter confirms whether the user agreed to share their data with Google for advertising purposes. The ad_personalization parameter decides whether that data can be used for remarketing and targeted advertising. Configure your consent management system to update both parameters based on the user's interaction with your banner.
When you implement this correctly, a consent default reaches the Google tag before it fires. The tag reads the parameters and adjusts its behaviour accordingly, setting marketing cookies only when permitted.
If you use Google Ads or Google Analytics 4, ignoring this integration means your audience lists will slowly empty as older cookies expire and no new EEA users are added.
Requirements for passing valid signals
A consent signal is only as good as the consent behind it. Gatekeepers require you to collect GDPR consent before sending a positive signal.
Your collection mechanism must provide a clear, unambiguous choice. Pre-ticked boxes, misleading button colours, and lack of granular control invalidate the consent. If you send a granted ad_user_data signal based on an invalid banner design, you breach both the gatekeeper's terms and European privacy law.
Separate your trackers into clear categories. Keep analytics cookies apart from advertising trackers, because a visitor might agree to statistical measurement but refuse cross-site tracking. Your system has to capture this distinction and transmit the exact choice to each vendor.
For example, a user might accept the _ga cookie but reject the _fbp tracker. Your signals must reflect this mixed state.
Relying on implied consent by continuing to navigate the website fails this test completely.
Two valid ways to load Google tags
Google documents two implementations of Consent Mode, and both are valid. In basic consent mode, Google tags do not load until the visitor consents, and the consent state reaches Google with the first hit after that. In advanced consent mode, tags load at once with denied defaults and send cookieless pings that feed Google's modelling. Advanced mode recovers more data, but whether those pre-consent pings themselves need consent under Article 5(3) of the ePrivacy Directive is debated.
| Feature | Basic consent mode | Advanced consent mode |
|---|---|---|
| Tag execution | Blocked until consent | Loads at once in a denied state |
| Before a choice | Nothing sent to Google | Cookieless pings without identifiers |
| Audience building | Only after consent | Only after an ad_user_data=granted and ad_personalization=granted update |
| Modelling | General model only | Site-specific model, above Google's thresholds |
Pre-ticked or assumed consent was never a valid starting point: the CJEU ruled it out in the Planet49 judgment of 2019, years before the DMA.
Handling different tracker types
Not all scripts need these signals. Purely functional cookies that remember cart contents or language preferences can fall under the strictly necessary exemption and do not depend on gatekeeper consent signals.
Audit your tag manager container to map which scripts belong to gatekeepers and which belong to smaller, independent vendors. Different vendors read consent in different ways, so your consent tool has to support several of them at once.
What happens if you ignore the requirements
The consequences of ignoring these requirements show up first in your marketing metrics rather than in legal fines. Gatekeepers apply their terms automatically.
If you fail to transmit the required signals, advertising platforms assume you lack consent. Google stops adding those EEA visitors to your remarketing audiences and limits personalisation. Conversion reporting loses those visitors, which can make cost-per-acquisition figures look worse and give automated bidding less to work with.
Regulatory action is a separate risk. The DMA is enforced by the European Commission against gatekeepers, but your own cookie consent is enforced by national data protection authorities under the GDPR and the ePrivacy Directive. Google's EU user consent policy also allows it to restrict or suspend accounts that do not meet the policy.
Getting the signals right protects your measurement and keeps your setup in line with what you tell visitors.
DMA and consent signals: short answers
Does the Digital Markets Act apply to US publishers?
The DMA applies to gatekeepers, not publishers. But the gatekeepers' consent terms apply based on where your visitors are, so if your website receives traffic from the European Economic Area and you use gatekeeper services, you must pass valid consent signals for those visitors.
Are small businesses exempt from these requirements?
No. The regulation targets the largest tech companies, but those companies require all third-party sites using their tools to send consent signals, regardless of the publisher's size or traffic volume.
What happens if a user ignores the banner entirely?
If a user navigates your site without interacting with the banner, the default state must remain denied. Gatekeeper tags then run in their denied state or not at all, and no advertising profile is built from that visit.
Can I just block Google tags completely until consent is given?
Yes. That is basic consent mode, one of the two implementations Google documents. You lose the cookieless pings that feed site-specific modelling, but you do not miss any signal Google requires.
Do I need to update my privacy policy for this?
Yes. Your privacy policy should name the advertising and analytics vendors that receive data, explain that visitors' choices are passed to them, and say how this affects data sharing with advertising networks.
Check what your site sends to gatekeepers
If you rely on Google Ads or Meta, start by finding out which of their trackers load before a visitor chooses. Run the Cookie scanner to list active cookies, then set up consent signals for each vendor. Kukie.io sends Google Consent Mode v2 signals from its banner as visitors choose.
