Google's EU User Consent Policy (EU UCP) asks every site and app that uses Google products with visitors in the European Economic Area, the United Kingdom or Switzerland to get legally valid consent for cookies and for ads personalisation, to name every party that receives the data, to keep records of consent and to explain how to withdraw it. For advertising and measurement, Google also expects Consent Mode v2 signals, which it has required for EEA traffic since March 2024.
The policy has existed since 2015, but those signals gave it real teeth. Every website using Google Ads, Analytics, AdSense, Ad Manager, Tag Manager, or even reCAPTCHA with visitors from these regions has to meet it, or lose features that drive its advertising and measurement.
What Google's EU User Consent Policy actually requires
Google requires consent for two things on your site: cookies or other local storage where the law requires it, and the use of personal data to personalise ads. The policy text puts the first obligation in one line:
You must obtain end users' legally valid consent to: the use of cookies or other local storage where legally required; and the collection, sharing, and use of personal data for personalization of ads.
In plain English, the banner has to come first and the tags second, for every visitor in those regions.
The policy sits on top of two existing laws: the GDPR and the ePrivacy Directive. Google is not creating new legal obligations. It is enforcing the ones that already exist, but through platform access rather than fines.
The requirements come down to these obligations for any site or app using Google products with EEA, UK, or Swiss users:
| Obligation | What it means in practice |
|---|---|
| Consent for cookies and local storage | No non-essential cookies may be set before the user actively agrees. Pre-ticked boxes, scrolling, or continued browsing do not count as valid consent. |
| Consent for personal data collection and ad personalisation | The user must agree to the collection, sharing, and use of personal data for ads, including remarketing, audience building, and conversion measurement. |
| Transparent disclosure of all parties | Every party that may collect, receive or use visitors' personal data must be clearly identified in the consent notice or linked from it. |
| Records of consent | You keep a record of the consent each visitor gave. |
| Revocation | Visitors get clear instructions for withdrawing their consent. |
The disclosure point is often overlooked. If your site uses Google Ads alongside Meta Pixel, LinkedIn Insight, or any other advertising SDK, each vendor must be named or linked for users to review.
The consent signals Google has required since March 2024
Google introduced Consent Mode v2 in November 2023 with two new parameters: ad_user_data and ad_personalization. Enforcement for EEA traffic followed in March 2024.
The effects are concrete. Google's GA4 consent settings help page warned that from early March 2024, properties that took no action would include only non-EEA users in the audiences their linked advertising products use. Google Ads asks advertisers to share consent signals with Google, and warns that tags which do not load until the visitor interacts with the banner leave Google unable to verify consent choices, which may lead to loss of data. Data that was never collected cannot be backfilled.
As of October 2026, no Google source sets a later, separate cut-off for these signals, so treat any date other than March 2024 with caution.
Consent Mode v2: the technical backbone
Consent Mode adjusts how Google tags behave depending on whether a visitor has accepted or declined tracking. Version 2 requires four parameters to be signalled to Google tags:
| Parameter | Controls | Default |
|---|---|---|
ad_storage | Whether advertising cookies can be read or written | denied |
analytics_storage | Whether analytics cookies can be read or written | denied |
ad_user_data | Whether user data can be sent to Google for advertising | denied |
ad_personalization | Whether data can be used for remarketing and personalised ads | denied |
If these signals are not sent, or are sent incorrectly, Google cannot see the visitor's choice and limits features such as audiences and personalisation for that traffic.
Basic mode vs advanced mode
Basic Consent Mode blocks all Google tags until the user accepts. If the user declines, zero data reaches Google. Advanced Consent Mode loads tags immediately with default denied settings. When users decline, the tags send cookieless pings that feed Google's conversion and behavioural modelling, which estimates part of the data Google does not observe. Google publishes no general recovery rate. Many businesses relying on Google's advertising ecosystem choose advanced mode for the modelling, but whether pings sent before a choice need consent under Article 5(3) of the ePrivacy Directive is debated, and some sites choose basic mode for that reason.
Step by step: setting up your site for the policy
1. Audit your Google product usage
List every Google service active on your site: Google Ads tags, GA4, Google Tag Manager, AdSense, Ad Manager, reCAPTCHA, Google Maps, Firebase. Each falls under the EU UCP. Check your tag setup for any Google scripts loading before consent is granted.
2. Implement a consent management platform
A CMP handles the consent banner, collects user choices, and transmits consent signals to your tags. Google operates a CMP Partner Programme with certified partners tiered into Bronze, Silver, and Gold levels based on IAB TCF compliance and integration quality.
For publishers using AdSense, Ad Manager, or AdMob, a Google-certified CMP integrated with the IAB Transparency and Consent Framework has been required for personalised ads since 16 January 2024 in the EEA and UK, and since 31 July 2024 in Switzerland, according to Google's certified CMP requirement. Advertisers using Google Ads have more flexibility: any CMP supporting Consent Mode v2 works, whether or not it appears on Google's partner list.
Displaying a consent banner is not enough. The banner must transmit consent signals to your Google tags. Many WordPress cookie plugins show banners that look right but do not connect to anything: the user clicks "Accept", but no ad_storage=granted signal reaches Google Tag Manager. This silent failure is a common cause of missing consent signals.
3. Configure Consent Mode v2 signals
If your CMP is a Google-certified partner, it should handle signal transmission automatically once enabled. For custom banners or non-certified CMPs, implement Consent Mode manually through gtag.js or Google Tag Manager by setting default consent states (all denied) before tags load, then updating when the user makes a choice.
4. Verify and disclose
In GA4, go to Admin, then Data collection and modification, then Consent settings. The page shows the share of your traffic and conversions from the EEA, the consent signals each data stream sends for ads personalisation and measurement, and alerts when a signal looks wrong. Test from an EEA location to verify the banner appears before non-essential cookies load, and that clicking "Reject" actually blocks tracking.
The EU UCP also requires clear identification of every ad technology provider that receives user data. Link to Google's Business Data Responsibility site from your consent notice or privacy policy, and list any third-party vendors alongside it.
What happens if you do not meet the policy
On the Google side, non-compliance means suspension of ad-serving features, disabled conversion tracking, and loss of remarketing capabilities. The first step is usually a notification, and persistent non-compliance can lead to account restrictions or full suspension.
On the regulatory side, the underlying laws carry their own penalties. The CNIL (France's data protection authority) imposed 83 sanctions totalling 486,839,500 euros in 2025, according to its 2025 sanctions summary, with 21 entities sanctioned for cookies and trackers. In September 2025 it fined Google 325 million euros over ads inserted between Gmail emails without consent and invalid consent to advertising cookies when users created a Google account. In November 2025 it fined the publisher of vanityfair.fr 750,000 euros for cookies placed without consent, including after visitors refused them.
Common mistakes to avoid
Cookie walls that block content entirely unless the user accepts tracking are problematic under GDPR. Consent must be freely given, and making access conditional on accepting advertising cookies raises serious questions about voluntariness.
Pre-selecting consent options violates both the GDPR and the EU UCP. The GDPR requires a deliberate act: an explicit click or toggle by the user.
Using Google's "Non-personalised ads" option does not eliminate the need for consent. Even non-personalised ads use cookies for frequency capping and fraud prevention. Consent for those cookies is still required under the ePrivacy Directive.
Setting the consent default too late is another frequent fault. A gtag('config') call hard-coded above the default, or a default placed in a Custom HTML tag that fires after Google tags, means the first hits go out with no consent state. Set the default first, on the Consent Initialization trigger in Google Tag Manager or at the top of the page.
Recovering lost data with conversion modelling
Consent rates vary significantly across Europe and between sites. Advanced Consent Mode with modelling is Google's recovery mechanism: its machine learning uses consented data to estimate conversions and behaviour from users who declined.
GA4's behavioural modelling thresholds are two: at least 1,000 events per day with analytics_storage=denied for at least 7 days, and at least 1,000 users per day sending events with analytics_storage=granted on at least 7 of the previous 28 days. Google Ads conversion modelling needs 700 ad clicks over 7 days per country and domain grouping. Smaller sites may not qualify. Enhanced Conversions and server-side tagging through GTM's server container offer additional measurement options for sites with sufficient traffic.
Questions about the EU User Consent Policy
Does the EU User Consent Policy apply if my business is outside the EU?
Yes. The policy applies to any website or app using Google products that has visitors from the EEA, UK, or Switzerland, regardless of where the business is located.
Can I use any CMP or does it have to be Google-certified?
Advertisers using Google Ads can use any CMP that supports Consent Mode v2. Publishers using AdSense, Ad Manager, or AdMob need a Google-certified CMP integrated with the IAB TCF to serve personalised ads.
What is the difference between Consent Mode v1 and v2?
Version 2 added two parameters: ad_user_data (controls whether user data is sent to Google for advertising) and ad_personalization (controls remarketing). Without these signals, Google restricts advertising features for EEA and UK traffic.
Will switching to non-personalised ads avoid the need for consent?
No. Non-personalised ads still use cookies for frequency capping, fraud prevention, and aggregated reporting. Under the ePrivacy Directive, consent is required for those cookies in most EU jurisdictions.
How do I check if my Consent Mode v2 setup is working?
In GA4, go to Admin, then Data collection and modification, then Consent settings, which shows the consent signals each data stream sends and flags problems. You can also inspect the dataLayer in browser developer tools for consent update events.
Can I recover data lost before I fixed my Consent Mode setup?
No. Data from the period without consent signals is permanently lost. Google did not collect it, so there is nothing to backfill or estimate retroactively.
Is Google Consent Mode required by law?
Consent Mode is a Google product requirement, not a legal obligation. The GDPR does not mandate any specific technical standard. But without it, you lose access to Google's advertising and measurement features for EEA and UK traffic.
Check the consent signals your pages send
If your Google Ads conversions dropped unexpectedly or your GA4 reports show gaps in European traffic, missing or late consent signals are a likely cause. The Consent Mode checker loads a page and shows the default and update commands it sends. Kukie.io's banner sends the four Consent Mode v2 signals as visitors choose.
