Microsoft UET Consent Mode: How to Make Bing Ads GDPR Compliant

Key Takeaways

• Microsoft UET Consent Mode became mandatory on 5 May 2025 for any website receiving visitors from the EEA, UK, or Switzerland.

• The ad_storage parameter controls whether UET sets advertising cookies - it must default to denied before consent is collected.

• In denied mode, UET sends cookieless pings (marked asc=D) that do not store personal data on the visitor's device.

• Microsoft's Advanced Consent Mode uses aggregate modelling to estimate conversions from non-consenting visitors, similar in concept to Google Consent Mode v2.

• A consent management platform can automate the entire flow - setting the default state, updating it on consent, and managing script blocking.

What Is Universal Event Tracking (UET)?

Universal Event Tracking is Microsoft Advertising's conversion tracking system. A small JavaScript tag placed on your website records visitor actions - page views, purchases, form submissions, sign-ups - and reports them back to your Microsoft Advertising account.

UET powers three core features: conversion tracking, remarketing audience building, and automated bidding optimisation. Without it, Microsoft Advertising campaigns run blind, unable to measure return on ad spend or target past visitors.

The tag loads from bat.bing.com and sets several cookies on the visitor's browser.

Cookies Set by the UET Tag

The UET tag creates both first-party and third-party cookies. Understanding what each one does is the first step toward GDPR-compliant cookie management.

All of these cookies fall into the advertising or marketing category. Under Article 5(3) of the ePrivacy Directive and Article 6(1)(a) of the GDPR, storing them requires prior informed consent from the visitor.

That legal requirement is why Microsoft built Consent Mode into UET.

Why UET Needs Consent Management

Since 5 May 2025, Microsoft requires all advertisers whose campaigns reach EEA, UK, or Swiss visitors to send valid consent signals through UET. The requirement applies regardless of where the advertiser's business is registered.

Without consent signals, Microsoft suspends conversion tracking and remarketing for those visitors. The practical impact is significant: campaigns lose optimisation data, automated bidding becomes unreliable, and remarketing audiences stop growing for a substantial share of traffic.

The obligation aligns with what European data protection authorities have enforced for years. The CNIL, for instance, has issued several six-figure fines for websites that loaded tracking scripts before obtaining consent. Microsoft's enforcement simply brings the ad platform's technical requirements in line with the legal ones.

How UET Consent Mode Works

UET Consent Mode uses a single parameter called ad_storage. This parameter accepts two values: granted or denied.

The implementation relies on the window.uetq command queue. Two commands control it:

Setting the default state (before consent is collected):

window.uetq.push('consent', 'default', { 'ad_storage': 'denied' });

Updating after the visitor grants consent:

window.uetq.push('consent', 'update', { 'ad_storage': 'granted' });

The UET tag must load before the cookie banner appears. This is the single most important technical requirement. Loading UET first allows it to read the default denied state and begin sending cookieless pings from the first page view.

If UET loads after the banner, the tag misses the initial page view entirely and cannot track the visitor's journey even after consent is granted.

Cookieless Pings in Denied Mode

When ad_storage is set to denied, UET does not set or read any cookies. It does, however, send anonymised pings to Microsoft's servers. These pings carry an asc=D parameter indicating that the visitor has not consented.

The pings contain no personal identifiers. Microsoft strips any data that could identify an individual and does not use these signals for user profiling or interest-based advertising.

Microsoft's Advanced Consent Mode - announced in February 2026 - applies aggregate modelling to these anonymised signals to estimate conversions that would otherwise be lost. The concept mirrors Google's approach to conversion modelling, though the two systems are entirely separate implementations.

Once the visitor grants consent, UET switches to full tracking. The asc parameter changes to G, cookies are set, and all subsequent events carry full attribution data.

How Kukie.io Handles UET Consent Automatically

Kukie.io includes a dedicated Microsoft UET Consent Mode integration that requires no custom code. Enabling it is a single toggle in the dashboard.

When activated, the integration automatically sets ad_storage to denied on page load, then updates it to granted the moment a visitor accepts marketing cookies. The timing is handled correctly - the consent default fires before the banner renders.

If your site also runs Microsoft Clarity, a separate Clarity integration manages the analytics_storage parameter independently.

Interaction with Script Blocking

Kukie.io's auto-block feature scans your site for third-party scripts and blocks them until the visitor consents. The UET Consent Mode integration changes this behaviour for bat.bing.com specifically.

With UET Consent Mode enabled, the bat.bing.com script is whitelisted so it can load early and send cookieless pings. The consent parameter prevents it from setting cookies, so privacy is maintained without blocking the script entirely.

If you disable the UET Consent Mode toggle, the auto-blocker treats bat.bing.com like any other marketing script - fully blocked until the visitor accepts cookies.

How to Verify Your Implementation

Checking that UET Consent Mode works correctly takes a few minutes using browser developer tools or the UET Tag Helper extension.

Using the UET Tag Helper Extension

Install the UET Tag Helper extension for Microsoft Edge or Chrome. Visit your website, open the extension, and look for two things:

• Before interacting with the cookie banner, the consent status should show Denied.

• After accepting cookies, the status should update to Granted.

Using the Browser Network Tab

Open DevTools, switch to the Network tab, and filter requests by bat.bing.com. Before consent, look for the asc=D parameter in the request URL. After granting consent, new requests should carry asc=G. If you see cookies being set before consent, the default state is not configured correctly.

UET Consent Mode vs Google Consent Mode v2

Both systems solve the same problem - tracking conversions while respecting consent - but they are independent of each other. Running one does not satisfy the other.

If your website runs both Microsoft Advertising and Google Ads, both consent modes must be configured. A consent management platform that supports both integrations simplifies this considerably - a single visitor consent action updates all platforms at once.

Kukie.io supports both Google Consent Mode v2 and Microsoft UET Consent Mode. Each has its own toggle, and both respond to the same consent signal from the cookie banner.

Common Mistakes to Avoid

Loading UET after the consent banner is the most frequent error. The tag must execute first so it can read the default denied state. If it loads late, the first page view goes unrecorded.

Forgetting to set a default ad_storage value is equally problematic. Without an explicit default, UET assumes granted, meaning cookies are set before the visitor makes a choice. That violates the ePrivacy Directive and the GDPR.

Assuming Google Consent Mode covers Microsoft is another trap. The two are completely separate systems with different command queues and different server endpoints. Configuring one does nothing for the other.

Frequently Asked Questions

Take Control of Your Cookie Compliance

If you are not sure whether your Microsoft Advertising tracking complies with GDPR, start with a free cookie scan. Kukie.io detects UET cookies, configures consent mode automatically, and keeps your Bing Ads data flowing - without putting visitor privacy at risk.

Start Free - Scan Your Website