The short answer: Google Consent Mode is a setting in your Google tags that tells Google Ads and Google Analytics whether each visitor accepted or rejected cookies on your banner. Version 2 adds two signals about advertising data. If you use Google Ads or GA4 with visitors from the UK or EEA, Google's EU user consent policy requires you to get valid consent and pass it on. Without it, you lose remarketing audiences and conversion data for those visitors. Consent Mode does not replace a cookie banner. You need both.
What is Google Consent Mode?
Your cookie banner asks visitors a question. Consent Mode passes their answer to Google's tags. In Google's words, it "lets you communicate your users' cookie or app identifier consent status to Google" (Google Ads Help). Google is clear that Consent Mode "doesn't provide a consent banner or widget". That job belongs to your banner.
Consent Mode v2 uses four main signals, each set to "granted" or "denied" (Google for Developers):
- ad_storage: can Google set advertising cookies?
- analytics_storage: can Google Analytics set its cookies?
- ad_user_data: can you send this person's data to Google for advertising? (new in v2)
- ad_personalization: can Google use it for personalised ads and remarketing? (new in v2)
- UK and EEA visitors can drop out of remarketing and other audiences you use in Google Ads.
- Conversions from those visitors may go unmeasured, so Smart Bidding learns from less data.
- You miss out on Google's modelling, which estimates the behaviour of people who said no.
- If your banner sets Google cookies before anyone clicks "accept", you're breaking UK law as well as Google's policy.
- Ask first. Non-essential cookies must only be set "when valid consent is gathered, or when they meet an exception". If a visitor ignores the banner, you must not set them (ICO).
- Make "reject" as easy as "accept". A banner with "Accept all" and "More options" but no reject button is the ICO's example of bad practice.
- No pre-ticked boxes or implied consent. "Silence or inactivity doesn't qualify", and neither does "by using this site you agree".
- Let people change their mind. Withdrawing consent must be as easy as giving it, usually through a cookie settings link in your footer.
- Advertising always needs consent. Tracking, cross-site tracking and online advertising can't rely on the "strictly necessary" exception (ICO).
The two v2 signals are the ones most older setups are missing. If your banner was installed before 2024 and hasn't been touched, check it.
Why does Google require it for UK and EEA visitors?
Google's EU user consent policy covers end users in the European Economic Area, the UK and Switzerland. If you use Google products that include the policy, you must get "legally valid consent" for cookies where the law requires it, and for using personal data to personalise ads. You must also keep records of consent and tell people how to withdraw it (Google EU user consent policy).
Google started enforcing this more strictly in March 2024. Consent Mode is how you prove to Google, page by page, that you've asked. Google Analytics warned that properties sending no consent signals would only include users outside the EEA in audiences used by linked advertising products from early March 2024 (Google Analytics Help).
What happens to your data without it?
Nothing breaks visibly. That's the problem. Your ads keep running and GA4 keeps showing numbers, but:
Thinner conversion data means Google's bidding makes worse decisions with your money.
What is the difference between basic and advanced Consent Mode?
Google offers two ways to implement it (Google for Developers).
Basic Consent Mode
Google tags don't load at all until the visitor makes a choice. If they reject, Google gets nothing, "not even the default consent status". Modelling uses a general model rather than one built from your own site.
Advanced Consent Mode
Tags load straight away with consent set to "denied". Until someone accepts, they send cookieless pings: a timestamp, browser details, referrer and a random number, with no cookies set. Google uses these to build a model specific to your site that fills gaps in your reports.
Which should you choose?
Advanced gives you better data. Basic is the more cautious option, because nothing goes to Google until a visitor says yes. Some privacy advisers prefer basic for that reason. If you handle sensitive data, such as health or finance, take advice. For most small businesses, the bigger risk is having no Consent Mode at all.
Modelling also has thresholds. GA4 behavioural modelling needs at least 1,000 events a day with analytics_storage denied for at least 7 days, plus at least 1,000 daily users with it granted for at least 7 of the previous 28 days (Google Analytics Help). Many small sites won't reach that, so don't count on modelled data to fill the gaps.
What do UK cookie laws (PECR and UK GDPR) say?
In the UK, cookies are governed by the Privacy and Electronic Communications Regulations (PECR). Where cookies collect personal data, UK GDPR applies too. The Information Commissioner's Office (ICO) finalised its updated guidance on storage and access technologies on 29 April 2026, following changes made by the Data (Use and Access) Act 2025.
The main points for a small business website:
Do analytics cookies still need consent in the UK?
Sometimes not, but probably yes if you use Google Analytics with Google Ads. The new "statistical purposes" exception lets you skip consent for analytics used only to improve your own site, provided the output is aggregated, you tell visitors and give them a simple, free way to object. A third-party provider must act as your processor and can't use the data for its own purposes (ICO). Once analytics data feeds your advertising, for example GA4 linked to Google Ads, you're outside the exception and need consent.
The Act also raises maximum PECR fines in line with UK GDPR. The ICO says it will update its enforcement guidance when the new regime is in force, and that it reserves fines for the most serious breaches (ICO).
How do you set up Google Consent Mode v2?
There are three common routes. Pick the one that matches how your Google tags are installed now.
1. Use a certified cookie banner platform
This is the easiest route for most small businesses. A consent management platform (CMP) shows the banner, stores consent records and sends Consent Mode signals for you. Google keeps a list of certified partners on its CMP Partner Program site. Popular options include Cookiebot, CookieYes, Usercentrics and OneTrust. Check the current list before you pay for one, and make sure Consent Mode v2 is switched on in its settings, as it isn't always on by default.
2. Google Tag Manager
If your tags run through Google Tag Manager (GTM), add your CMP's template from the Community Template Gallery and fire it on the "Consent Initialization – All Pages" trigger. It sets the default (denied) state before any other tag runs, then updates it when the visitor clicks. Google tags such as GA4 and Google Ads have consent checks built in. Other tags, like the Meta Pixel, need "additional consent" settings so they only fire after acceptance.
3. gtag.js on the page
If you paste Google's tag straight into your site, set the default before the tag loads, then update it when the visitor accepts (Google for Developers). The default looks like this:
gtag('consent', 'default', {
'ad_storage': 'denied',
'ad_user_data': 'denied',
'ad_personalization': 'denied',
'analytics_storage': 'denied'
});When someone accepts, your banner calls gtag('consent', 'update', {...}) with the choices they made set to "granted". A CMP saves you building the banner and consent records yourself.
How do you check Consent Mode is working?
Google's own test uses Tag Assistant (Google for Developers):
- Open Tag Assistant, enter your website address and connect.
- Click the earliest "Consent" event. Check all four signals are set, and set to "denied", before anything else runs.
- Accept cookies on your banner. Click the latest Consent event and check the signals changed to "granted".
- Open the Tags tab and check each tag behaved as it should.
- Repeat in a private window, this time clicking "reject", and check that nothing switched to granted.
If the Consent tab is empty, Consent Mode isn't running on that page. In GA4, go to Admin and then Consent settings to see whether Google is receiving signals. Google says it can take 48 to 72 hours for the status to update after a fix (Google Analytics Help).
Frequently asked questions
What does accepting cookies mean?
Accepting cookies lets the website store small files in your browser beyond what it needs to work. These are usually for analytics, advertising and remembering your preferences. On a site with Consent Mode, it also tells Google it can use your visit for measurement and ads.
What happens if you don't accept cookies?
The site should still work. Essential cookies, such as your basket or login, don't need consent. You'll still see ads, but they'll be less personalised. With advanced Consent Mode, Google may receive cookieless pings that don't identify you.
Should you accept or reject cookies?
It's your choice, and a well-built site makes rejecting as easy as accepting. Rejecting limits tracking and personalised ads. Accepting helps the business understand how people use its site. Either way, you can change your mind later through the site's cookie settings.
Is Google Consent Mode the same as a cookie banner?
No. The banner asks the question and records the answer. Consent Mode passes that answer to Google's tags. You need both.
Do I need Consent Mode if I only use GA4 and no ads?
You still need valid consent for GA4 cookies unless your setup fits the ICO's statistical purposes exception. Consent Mode is the simplest way to make GA4 respect a visitor's choice, and it keeps your options open if you start advertising later.
Want this sorted for you?
Most of the small business sites we audit either set Google cookies before anyone clicks or are missing the two v2 signals. Both are quick to fix. Northern can set up a compliant cookie banner, Consent Mode v2 and GA4 tracking as part of our PPC management, SEO or web design work. Or start with a free website audit and we'll tell you where you stand.
This guide explains the rules in plain English. It isn't legal advice. If your business handles sensitive data, check your setup with a data protection specialist.
