Cookies Banner and Consent Mode v2: Are You Doing It Right?

Since 6 March 2024, Google requires Consent Mode v2 from every website targeting ads to users in the European Economic Area (EEA). If your cookies banner does not send four mandatory consent signals - analytics_storage, ad_storage, ad_user_data and ad_personalization - you lose access to remarketing campaigns and conversion data in Google Ads. Regardless of how good the banner looks. Most websites have the visual layer in order - the technical layer is where they fall short.

Why Consent Mode v2 and why now?

In 2023, the European Union designated Google as a so-called gatekeeper under the Digital Markets Act (DMA). A gatekeeper is a dominant digital platform subject to stricter rules on data collection and processing - including the obligation to respect user consent signals. In response to DMA obligations, Google updated Consent Mode to version 2 and set a binding deadline: 6 March 2024.

From that date, every website targeting ads to the EEA must comply: without Consent Mode v2, personalised advertising, remarketing and conversion measurement in Google Ads are unavailable. This is not a recommendation - it is a technical access condition for the platforms. More context on how these changes relate to the evolution of search is covered in our article Google AI Mode replaces classic search: what it means for your website.

In parallel, GDPR and national electronic communications laws apply: any website that stores non-essential cookies on a visitor's device must first obtain free, specific and informed consent. Consent Mode is not a substitute for GDPR consent - it is a technical protocol that signals to Google what you have obtained from the user. Both must work correctly at the same time.

The four consent parameters Google requires

Consent Mode v2 works with four signals. The first two existed since version 1; v2 added two more as mandatory from March 2024. Data as of July 2026.

Parameter	What it controls	New in v2?
analytics_storage	Analytics data - GA4 sessions and events	no
ad_storage	Identifiers for advertising systems	no
ad_user_data	Sending user data for Google advertising	yes
ad_personalization	Remarketing and ad personalisation	yes

If your website implements only analytics_storage and ad_storage from the original version 1, Google evaluates the setup as incomplete and conversion measurement will not work correctly for EEA users. Technical implementation is managed through Google Tag Manager - Consent tab. Official documentation: Google Tag Manager - Consent Mode settings.

Basic or Advanced - what actually differs?

Consent Mode v2 offers two implementation approaches. The key difference is what happens to Google tags before the user makes a choice in the banner.

	Basic mode	Advanced mode
Google tags before consent	blocked	load without cookies
On rejection	no data at all	anonymous cookieless pings
Conversion modelling	no	yes (statistical estimate)
Setup complexity	simpler	more complex
Suited for	sites without active campaigns	sites with Google Ads remarketing

For small websites without active remarketing campaigns, Basic mode is functional and simpler to set up. If you invest in Google Ads, Advanced mode preserves more conversion data even from users who reject consent - Google models these statistically from cookieless signals. Both approaches are configured in Google Tag Manager via the Consent tab.

Five mistakes that make your banner fail

In practice, we see the same problems in website audits over and over:

1. Cookies load before the banner appears. Analytics scripts fire immediately on page load, before the visitor sees any prompt. This is a GDPR violation regardless of how the banner looks.
2. The banner has no Reject button in the first layer. The Accept button is large and prominent, rejection is hidden behind a Settings link. GDPR requires: rejection must be as easy as consent - one click, not three.
3. The wording "I acknowledge" or "I understand". Passive formulations are not valid consent under GDPR. An active unambiguous action is required: "I agree" or "Accept".
4. No granularity. Users must be able to consent separately to analytics and marketing cookies. A blanket Accept all without an alternative does not fulfil the requirement for specific consent under GDPR.
5. The consent signal is not technically sent to GTM. Many websites have the banner visually set up, but Google Tag Manager fires scripts regardless of the user's choice. The consent state is not transferred to the tags - verify this in GTM Preview mode.

These mistakes have real consequences. On 1 September 2025, the French Commission Nationale de l'Informatique et des Libertés (CNIL) issued a record fine of €325 million against Google for cookies in Gmail and during account creation without valid consent. On the same day, SHEIN was fined €150 million for placing cookies immediately on arrival at the website, before any interaction with the banner. Both cases are recorded by the European Data Protection Board (EDPB): Google case (EDPB) and SHEIN case (EDPB).

The maximum penalty under GDPR Art. 83(5) is €20 million or 4 % of global turnover, whichever is higher. For small businesses, the more realistic threat is a corrective measure from the supervisory authority requiring a technical fix within a set deadline.

What the supervisory authority says

Enforcement of cookies rules falls to national supervisory authorities - in Slovakia, the Office for Personal Data Protection of the Slovak Republic (UOOU SR); in the Czech Republic, the Office for Personal Data Protection (UOOU). The Slovak UOOU SR has issued updated guidance on obtaining consent for cookies, emphasising:

• Consent must be free, specific, informed and unambiguous.
• Rejection must be as easy as giving consent - unequal prominence of buttons is a violation.
• The wording "I acknowledge" is not valid consent - an active action is required.
• The burden of proof lies with the website operator: you must be able to demonstrate when and how consent was obtained.
• Withdrawal of consent must be as easy as giving it.

A specific issue for small business websites: cookie banners are often a plugin added after launch without proper integration to scripts - the visual layer looks correct, but the technical setup does not match. Proper analytics is the foundation for every SEO decision. If GA4 is not receiving data because of a misconfigured banner, you lose visibility into what actually works on your site. We covered the impact of the technical side of a website in our articles on Core Web Vitals and website speed. In the context of AI search, it is also important to understand what is changing for web content - we cover that in our article on Google AI Overviews and SEO in 2026.

Practical checklist - verify your banner in 10 minutes

Open your website in a private browser window and check each point:

Visual layer:

• The banner appears on the first visit without delay.
• The first layer has a Reject all button - not hidden behind a Settings link.
• The Accept and Reject buttons are visually comparable - same size or at least equal visibility.
• The wording is "I agree" or "Accept" - not "I acknowledge" or "Continue".
• You offer categories separately: necessary, analytics, marketing.

Technical layer (Chrome DevTools - Network tab):

• Before clicking the banner: GA4 and Google Ads scripts send no data.
• After rejection: GA4 sends no session or event data.
• In Google Tag Manager (Preview mode): consent state is denied for ad_storage, ad_user_data and ad_personalization after rejection.

Documentation:

• The cookies policy describes each category and the reason for processing.
• The list of third parties to whom you transfer data is up to date and accessible in the banner or cookies policy.

If any point fails, this is not an aesthetic problem. A technically wrong banner is simultaneously a GDPR risk and corrupted analytics data - a double problem from a single configuration error.

Conclusion

Cookies banners and Consent Mode v2 are part of ongoing technical website maintenance, not a one-time setup at launch. GDPR and Google DMA rules are actively enforced - as proven by the September 2025 fines. If you are unsure whether your banner works correctly technically and legally, Website Support and Care includes regular checks of this type. Or ask directly: Free consultation - we reply within 24 hours.

FAQ

Frequently asked questions.

Do I need to implement Consent Mode v2 even if I do not run Google Ads?

Consent Mode v2 is mandatory for websites using Google Ads with remarketing or personalised advertising for the EEA. If you only have Google Analytics 4 without advertising, Consent Mode is not directly required by law - but correct cookie-blocking logic before consent is still a GDPR requirement.

What happens if a website does not have a valid cookies banner?

GDPR allows fines of up to 20 million euros or 4% of global turnover. The more realistic consequence for a small website is a corrective measure from the supervisory authority with a deadline to fix it - along with missing or corrupted data in GA4.

What is the difference between Basic and Advanced Consent Mode?

In Basic mode, Google tags do not load before consent - if rejected, you lose all data. In Advanced mode, tags load without cookies and send anonymous cookieless pings, from which Google models conversions statistically. Advanced preserves more data but is more complex to set up.

Is the wording I acknowledge or I understand valid consent under law?

No. Passive formulations are not valid consent under GDPR. Valid consent requires an active unambiguous action - for example, clicking I agree or Accept.

How do I check whether my cookies banner works correctly from a technical standpoint?

Open the site in an incognito window and in Chrome DevTools (Network tab) check whether GA4 or Google Ads scripts send data before the banner is clicked. Another method: Google Tag Manager Preview mode shows the consent state of each tag - after rejection, ad_storage and ad_personalization must be set to denied.