Consent Mode v2 in 2026: what businesses advertising in the EU must check

What Consent Mode is, in plain words

When someone visits your website from the EU, you must ask before you place advertising or analytics cookies. That is the cookie banner. Consent Mode is the way your banner tells Google's tags (GA4, Google Ads, Floodlight) what the visitor said, so the tags behave accordingly.

Google's developer guide says Consent Mode was updated in November 2023 with two extra signals. That update is what people call "v2". There are now four signals that matter for marketing:

• ad_storage: can the site store advertising cookies?
• analytics_storage: can the site store analytics cookies?
• ad_user_data: can user data be sent to Google for advertising?
• ad_personalization: can the data be used for personalised ads, such as remarketing?

Consent Mode does not give you a banner. You still need one, often from a Consent Management Platform (CMP), a tool that shows the banner, stores the choices and usually sends them to Google for you.

Basic or advanced: the choice that affects your data

Google's About consent mode page describes two set-ups:

• Basic: Google tags do not load at all until the visitor clicks the banner. If they refuse, nothing is sent to Google, not even the fact that they refused.
• Advanced: tags load straight away with consent set to denied. If the visitor refuses, the tags send cookieless pings, small signals with no cookies, which Google uses to model the missing conversions.

Google says advanced mode gives an advertiser-specific model, while basic mode only gets a general one. To see modelled conversions in Google Ads, Google's modelling requirements also ask for about 700 ad clicks over 7 days, per country and domain grouping. Many small Cypriot accounts will not reach that, which is worth knowing before you expect miracles from modelling.

What changed in 2026

Google explained the changes in its help page Updates to Google Analytics Data Controls.

15 June 2026: ad_storage is the single gate

Before, two things controlled whether GA4 collected Google Ads cookies and IDs: the Google Signals setting in GA4 and your Consent Mode ads settings. From 15 June 2026, Google says Consent Mode is the single control. Your visitors' choices, sent through Consent Mode, "exclusively govern" how this data is collected and used.

The Google Ads help page now says it directly: ad_storage controls how Google Ads uses ads cookies and IDs from the GA4 tag. If you do not want that, set the default for ad_storage to denied.

The Google Signals switch in GA4 still exists, but now only controls whether GA4 links data to signed-in Google users for its own behaviour reports. Some businesses turned Signals off thinking it stopped ads data reaching Google Ads. That is no longer how it works.

Later in 2026: ad_personalization takes over personalisation

Google says that later in 2026, for linked GA4 and Ads accounts, the Consent Mode ad_personalization signal will be the only control on whether GA4 data is used for personalisation in Google Ads. Today that is managed by several settings inside GA4. Merkle's summary notes that no exact date has been given yet. Google also says IP addresses collected by its tags will be encrypted and passed to linked Google Ads accounts, with dates to follow.

What to check on your site

1. Your banner shows to EU, UK and Swiss visitors. Google's EU user consent policy covers all three.
2. All four signals are sent. In Google Tag Assistant, load your site, refuse cookies and check that ad_storage, analytics_storage, ad_user_data and ad_personalization all show as denied. Then accept and check they change to granted.
3. No ads cookies before consent. In your browser's developer tools, open the cookies list before you click the banner. Google advertising cookies should not be there yet.
4. The defaults are right. For EEA visitors, defaults should be denied until the person chooses.
5. The first layer of your banner says "ads personalisation" and links to Google's Business Data Responsibility site, directly or through your privacy policy.
6. Stop relying on the Google Signals switch to control what goes to Google Ads. Your banner and ad_storage now do that job.

Why audits matter

Google's consent audit help page says it reviews sites that use its advertising services. If a site does not comply and the owner does not engage, Google can suspend features such as ads personalisation, remarketing and conversion measurement. The most common issues listed include a missing banner, no clear "ads personalization" wording, no real accept button, and cookies set before consent.

What this means for businesses in Cyprus and Greece

Cyprus and Greece are both in the EU, so every business running Google Ads here falls under these rules. In my experience, the problem is rarely a missing banner. It is a banner that looks fine but does not send the right signals, or that was installed by a web developer years ago and never updated.

Small e-shops are the most exposed. They often have a free banner plugin, Google Ads conversion tracking added by hand, and nobody who has checked how they connect. If your conversions dropped for no clear reason, or Google Ads warns about consent, start with the checklist above.

If you sell mostly to tourists or to customers in the UK, remember the policy covers the UK and Switzerland too.

Questions people ask

Want help with this? Book a free 30-minute call.

Sources

1. Updates to Google Analytics Data Controls, Google Analytics Help
2. About consent mode, Google Ads Help
3. Set up consent mode on websites, Google for Developers
4. About consent mode modeling, Google Ads Help
5. Fix issues with your EU User Consent Policy consent audit, Google Ads Help
6. Updates to Google Analytics Data Controls, Merkle, April 2026