Why consent matters for advertisers

Europe's privacy rules, led by the General Data Protection Regulation (GDPR), mean you generally need a person's permission before placing advertising cookies or passing their personal data to ad platforms. Regulators enforce this against big names. On September 1, 2025, France's data protection authority, the CNIL, fined Google 325 million euros, partly because cookie consent gathered when people created Google accounts was not valid. The CNIL wrote: "Their consent obtained in this context was therefore not valid."

For a small business, the practical lesson is simpler. If you advertise to people in Europe, your cookie banner is not decoration. It decides what your ad tags may collect, and therefore what your ad reports can see. It also helps to know who is covered. Google's consent rules focus on the European Economic Area (EEA), which is the 27 EU countries plus Iceland, Liechtenstein and Norway. Running your ads from the US does not take you outside the rules when the people you reach are there.

What is Google Consent Mode?

Google describes Consent Mode as a way to communicate your users' cookie or app identifier consent status to Google. It doesn't show a banner itself. Your banner, usually from a consent management platform (CMP), collects the choice, and Consent Mode tells Google's tags how to behave. There are two setups:

  • Basic Consent Mode: Google tags don't load until the visitor interacts with the banner. If they decline, nothing is sent to Google, not even the fact that they declined.
  • Advanced Consent Mode: Google tags load when the page opens. If consent is denied, they send cookieless pings, small signals without identifiers, and send full measurement data only after consent is granted.
  • Advanced mode gives Google more signals to model from. Basic mode shares less. Which one fits is a legal and business choice, so involve whoever handles your privacy compliance.
How EU internet users controlled their personal data in 2023
  • Refused use of personal data for advertising54%
  • Restricted or refused access to location51%
  • Limited access to social profile or shared content41%
  • Read privacy policies before giving data36%
  • Checked the website was secure35%

Each bar is the share of EU internet users who took that step in 2023; the top bar shows how often advertising use is refused.

Source: Eurostat

What did Consent Mode v2 change?

Google's Tag Manager help explains that in November 2023 it added two consent signals: ad_user_data, which sets consent for sending user data to Google for advertising, and ad_personalization, which sets consent for personalized ads. From March 2024, for EEA customers still on the older version, Google began copying the ad_storage value into ad_user_data automatically.

Google is direct about the stakes: advertisers must follow its EU user consent policy to use ad personalization, and to keep using measurement, ad personalization and remarketing features, you must collect consent. In practice, that means your banner should send all four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization.

How many people say no, and what modeling recovers

Plenty of people decline. Eurostat reported that in 2023, 54% of EU internet users refused to allow the use of personal data for advertising. In a separate release, it found 36% had changed browser settings to prevent or limit cookies.

To fill the gap, Google models the conversions it can't observe. When it launched conversion modeling through Consent Mode in 2021, Google reported early results showing that, on average, it recovered more than 70% of ad-click-to-conversion journeys lost to cookie consent choices. Google also cautioned that results vary widely by consent rate and setup. Modeled conversions are estimates, not counted sales.

A consent checklist for advertisers

A few checks prevent most problems:

  • Use a consent platform that supports Consent Mode v2 and sends all four signals.
  • Open your site in a private window, decline everything, and confirm ad tags really wait or switch to cookieless pings.
  • Decide on basic or advanced mode deliberately, with your privacy advisor, not by default.
  • Lean on records customers give you directly, covered in first-party data, and see third-party cookies in 2026 for the browser side. US visitors fall under different rules, explained in US state privacy laws.
  • Compare modeled conversions with verified sales. Matrix ROI, which Smith App Studio builds, lines up platform claims beside Stripe payments or store exports, day by day.