Consent Mode v2 For UK Advertisers: What You Actually Have To Do

A prospect sent me a note from their web agency last month with one line highlighted: “we’re fully Consent Mode v2 compliant.” Their Google Ads account said otherwise. No modelled conversions anywhere in the reporting, remarketing lists that had not grown in months, and a Search campaign bidding on maybe two thirds of the data it should have had. The banner looked fine. The signals behind it were never wired up.

So here is the short answer. Consent Mode v2 is not a law and there is no certificate to earn. It is a technical requirement inside Google’s own EU user consent policy: your site has to tell Google what each UK and EEA visitor chose, using four named signals, whether they accept or decline. Do that and Google models back a chunk of the conversions you lose to refusals. Skip it and the data is simply gone. Below: what the four signals control, the basic versus advanced decision that quietly costs you conversions, what UK law changed in February and April 2026, and the order I would set it all up in.

Consent Mode v2 is Google’s rule, not the ICO’s

You are dealing with two separate obligations and most people collapse them into one.

The first is UK law. PECR and UK GDPR require consent before you store or read non-essential information on someone’s device, and the ICO enforces that. The second is contractual. Google’s EU user consent policy binds anyone using Google products that collect or process personal data in the EEA, the UK and Switzerland. Consent Mode v2 is how you satisfy the second one.

It has been mandatory for EEA and UK traffic since March 2024, and for Switzerland since 31 July 2024. The deadline came from the EU’s Digital Markets Act rather than GDPR, which is why it landed so abruptly. The UK was folded in because Google’s consent policy has always covered it.

One point of confusion worth clearing up. The rule requiring a Google-certified CMP integrated with the IAB TCF applies to publishers serving ads through AdSense, Ad Manager and AdMob. Advertisers running Google Ads on their own site are not bound by it. You do need a consent tool that passes the four signals correctly, and one that supports consent mode out of the box saves a fortnight of developer time.

The four signals, and what each one switches off

This is the table I put in front of clients, because “we have a cookie banner” tells me nothing about which of these are actually moving.

Signal	What it governs	What breaks when it is denied
ad_storage	Advertising cookies and IDs on the device	Click IDs are not stored, so conversions cannot be tied back to a click
analytics_storage	Analytics cookies, including the GA4 client ID	Sessions stop stitching together and user counts fall apart
ad_user_data	Sending user data to Google for advertising purposes	Enhanced conversions stop working and offline uploads have nothing to match on
ad_personalization	Personalised advertising	Remarketing and Customer Match audiences stop growing

The first two came with the original consent mode. The two Google added for v2 are the ones implementations get wrong, because they are usually bolted onto a banner that was built years earlier for cookies alone.

ad_user_data is the dependency people miss. Enhanced conversions can be configured perfectly and still send nothing useful if that signal never arrives granted. If you have been through a correct conversion tracking setup and the numbers still look thin, check this before you blame the tags.

ad_personalization is the one with the slowest, most expensive failure mode. Audiences do not error. They just stay small, and nobody connects a shrinking remarketing list to a consent setting made eight months ago.

Basic or advanced: the choice that costs you data

Google gives you two ways to run consent mode and the gap between them is real money.

Basic consent mode holds the Google tags back until someone interacts with your banner. No data reaches Google before that interaction. If they decline, nothing is sent at all, and any modelling you get comes from a general model built across advertisers.

Advanced consent mode loads the tags on page open with consent defaulted to denied. When someone declines, the tags still send cookieless pings: a consent state ping carrying the default and updated states, a key event ping saying an event happened, and Analytics pings on page load. These carry no identifiers. They carry timestamp, user agent, referrer and coarse booleans about consent state and whether ad click parameters were in the URL.

That difference earns you an advertiser-specific conversion model instead of a generic one, built on your own traffic and your own conversion patterns.

Run advanced unless your legal counsel has looked at it and told you no. I have yet to see a UK advertiser materially better off on basic, and I have seen several lose a visible share of their reported conversions by defaulting to it without deciding.

Give it time before you judge it. Google needs at least seven full days of implementation before uplift reporting appears, and it only shows a figure once a given slice clears a minimum data threshold. A small account looking for modelled conversions on day three will find nothing and assume the setup is broken.

What changed in UK law in 2026

Two dates from this year change the calculation, and both landed after most consent banners on UK sites were last touched.

The Data (Use and Access) Act 2025 amended the PECR cookie regime with effect from 5 February 2026. It introduced five exemptions from the consent requirement, covering transmission of a communication, providing a service the user asked for, collecting statistical information to improve the service, adapting appearance to a user’s preference, and identifying a user needing emergency assistance. It also removed the old £500,000 PECR penalty cap. Breaches now sit at UK GDPR levels: up to £17.5 million or 4% of annual worldwide turnover, whichever is higher.

Then on 29 April 2026 the ICO finalised its guidance on storage and access technologies, replacing the old cookies guidance. The scope is wider than cookies: it expressly covers tracking pixels, device fingerprinting, web storage, scripts, tags and link decoration.

Here is where I have watched people talk themselves into trouble. The statistical exemption reads like a licence to drop the analytics half of your banner, and it is not. The ICO applies strict purpose limitation. Analytics that also feeds advertising targeting, remarketing audiences or conversion modelling does not qualify. If your GA4 property is linked to Google Ads, your analytics is advertising, and consent stays mandatory.

Google moved in the same direction. From 15 June 2026 the Google Signals setting in the Analytics admin only governs whether your Analytics data is tied to signed-in user information for behavioural reporting. Your Ads consent mode settings, ad_storage above all, now decide on their own whether Analytics-sourced advertising data reaches Google Ads.

The order I would set it up in

1. Pick a CMP that supports Consent Mode v2 natively. Not one you have to bend into shape with custom code that breaks at the next release.
2. Set defaults to denied for UK and EEA traffic across all four signals, before any Google tag fires.
3. Fire the consent update on interaction, and make sure the update carries all four signals rather than the two legacy ones.
4. Choose advanced mode deliberately and record who signed it off.
5. Test in Google Tag Assistant and GA4 DebugView. Accept, decline, and close the banner without choosing. Watch the consent state change in each case. This is the step that gets skipped and it is the only one that proves anything.
6. Wait seven full days, then check for modelled conversions in Google Ads and the behavioural modelling note in GA4.
7. Check your audience sizes a month later. Growing lists mean ad_personalization is reaching Google.

How often to check it

Consent setups break silently, usually when someone else touches the site.

• After any banner or CMP change: rerun the accept, decline and dismiss tests the same day.
• Monthly: confirm remarketing lists are still growing and modelled conversions are still reporting.
• Quarterly: review which technologies your banner covers now, given the ICO’s wider scope.

Track your consent rate as a metric, not a compliance box. A banner redesign that drops acceptance from 70% to 45% surfaces as a performance problem weeks before anyone connects it to the design change, which is exactly what proper monthly reporting is for.

Find out what your setup is actually sending

Almost every account I audit has a banner that looks compliant and signals that are not doing their job. It takes about twenty minutes to find out which one you have, and the cost of not knowing compounds every week your bidding runs on partial data. If you want a straight answer on what your site is sending Google, take the free Google Ads audit. We check the consent signals and the tracking before we look at a single campaign, because there is no point optimising paid search against numbers that are missing a third of the picture. Where the setup needs rebuilding, that work sits inside how we run Google Ads management.

FAQ

Is Consent Mode v2 a legal requirement in the UK? No. It is a requirement of Google’s EU user consent policy, which is contractual and covers the EEA, the UK and Switzerland. Your legal obligations come from PECR and UK GDPR, enforced by the ICO. You need to meet both, and meeting one does not satisfy the other.

What happens if I do not implement Consent Mode v2? Google cannot verify what your visitors chose, so it discards the affected data rather than modelling it back. In practice you lose conversion data on UK and EEA traffic, remarketing and Customer Match audiences stop building, and Smart Bidding optimises against an incomplete picture.

Should I use basic or advanced consent mode? Advanced, in almost every case. It sends cookieless pings that carry no identifiers when consent is denied, which earns you an advertiser-specific conversion model rather than a general one. Basic sends nothing before interaction, so the modelling is weaker. Confirm the choice with whoever owns privacy at your business.

Does the DUAA analytics exemption mean I can drop my cookie banner? Not if you run ads. The exemption is limited to collecting statistical information solely to improve your service. The ICO applies that strictly, and analytics feeding ad targeting, remarketing or conversion modelling falls outside it. A GA4 property linked to Google Ads still needs consent.

How do I check Consent Mode v2 is working? Use Google Tag Assistant and GA4 DebugView, then run three tests: accept, decline, and dismiss the banner without choosing. Watch all four signals update correctly in each case. After seven full days, look for modelled conversions in Google Ads as confirmation the data is reaching Google.