GDPR cookie consent banner: what's actually required (and Google Consent Mode v2)

A cookie banner in the EU has one job: get a free, informed, active choice before any non-essential cookie or tracker runs, and make "no" as easy as "yes". If you run Google Ads or Analytics, you also need to pass that choice to Google through Consent Mode v2, or you lose remarketing audiences and part of your conversion data for European visitors. Everything else (the colours, the wording, the plugin you pick) is detail around those two rules.

Below is what the law and the regulators actually require, the myths that waste time, and a set-up order that keeps both the lawyers and the ad account happy.

Where the rule comes from

Two texts work together.

The ePrivacy Directive, Article 5(3), is the "cookie law". It requires consent before you store or read information on a visitor's device, whether that information is personal data or not. There is an exemption for what is strictly necessary to deliver the service the visitor asked for: a shopping cart, a login session, a load balancer, the cookie that remembers the visitor's consent choice.

The GDPR defines what valid consent is. Recital 32 says consent needs "a clear affirmative act" and that "silence, pre-ticked boxes or inactivity should not therefore constitute consent." Article 7 adds two practical duties: you must be able to prove consent was given, and "it shall be as easy to withdraw as to give consent."

The Court of Justice confirmed the pre-ticked box point in the 2019 Planet49 case. Each EU country enforces through its own authority (the CNIL in France, the Hellenic Data Protection Authority in Greece, and so on), and they coordinate through the European Data Protection Board (EDPB).

What a compliant banner must do

Here is the short list, based on the GDPR, the EDPB's consent guidelines and the EDPB cookie banner taskforce report of January 2023.

• Nothing non-essential fires before the choice. Analytics, ad pixels, heatmaps and embedded videos that set cookies all wait. The taskforce report puts it plainly: "by default, no cookies which require consent can be set without a consent."
• Accept and reject sit on the same layer. A vast majority of authorities in the taskforce treated a first screen with "Accept" and "Settings" but no "Reject" as an infringement.
• No pre-ticked boxes in the settings panel, for any category except strictly necessary.
• No visual tricks. The taskforce looked at reject links buried in a paragraph and at buttons whose colour or contrast makes "Reject" nearly invisible. Each case is judged individually, but an accept button that shouts next to a reject option that whispers invites a complaint.
• Scrolling is not consent. The EDPB guidelines say scrolling or swiping "will not under any circumstances satisfy the requirement of a clear and affirmative action."
• Plain information. Say what each category does, who the third parties are (Google, Meta, your chat vendor) and how long cookies last.
• Withdrawal stays one click away. A small, permanent icon or a footer link that reopens the settings is the usual answer. The taskforce does not mandate an icon, but withdrawal must be as easy as giving consent.
• A record of consent. Your consent tool should log what each visitor chose and when.

Myths that cost time or money

"Legitimate interest covers analytics." Not for the cookie itself. The taskforce confirmed that placing or reading cookies under Article 5(3) cannot rely on the legitimate interests of the site owner.

"Our cookies are essential." Only if the service breaks without them. Labelling analytics or advertising cookies as "essential" was one of the practices the taskforce called out.

"A cookie wall is always illegal." It depends where you are. The EDPB's 2020 consent guidelines say access must not be made conditional on accepting cookies. The CNIL, in its September 2025 announcement, said cookie walls are not illegal in themselves as long as the choice is free and informed. For a small business the safe course is simple: let people use the site whether they accept or not.

"Small sites don't get fined." Large fines make the news. On 3 September 2025 the CNIL announced €325 million against Google and €150 million against Shein, with Shein's case centred on placing trackers without consent. Small businesses more often face complaints, warnings and orders to fix the banner, which still cost time and legal fees.

"The rules are about to disappear." The European Commission's Digital Omnibus proposal (November 2025) suggested moving cookie consent into the GDPR and adding browser-level consent signals. As of early October 2026, the Council's draft keeps the rules in Article 5(3), adds some exemptions such as first-party audience measurement, and nothing has been adopted. Build for today's rules and watch for a final text.

What Google Consent Mode does

Consent Mode is how your banner tells Google tags what the visitor chose. Version 2 uses four signals:

The last two were added in late 2023. Google's EU user consent policy requires you to obtain consent for ad personalization and for cookies where the law requires it, keep records, and name the third parties involved. Google's help pages say that if you don't send consent signals for EEA users, you lose ad personalization capabilities, which in practice means remarketing audiences. From March 2024, Google also started requiring consent status on Customer Match lists used in the EEA.

Basic or advanced mode

Basic mode blocks Google tags until the visitor makes a choice. If they refuse, Google says "no data is transferred to Google at all, not even the consent status." Conversion modelling then relies on a general model.

Advanced mode loads the tags with consent set to "denied" by default. While consent is denied, the tags send cookieless pings (consent state, conversion signals, timestamp, referrer). Google uses these pings to model the conversions it can't observe directly, with a model specific to your account, provided you meet Google's data volume threshold.

Which one to pick depends on your risk tolerance and your national authority's view. Advanced mode sends Google a ping without cookies before consent, and some privacy teams prefer basic mode for that reason. For a small advertiser with modest traffic, the modelling thresholds may not be met anyway, so basic mode often costs little.

What ad data you keep and what you lose

When a visitor refuses:

• You keep the click and spend data in Google Ads, aggregated reporting, and, with Consent Mode, modelled conversions if your volume is high enough.
• You lose that visitor in remarketing lists, user-level journeys in GA4, and observed conversions tied to their click.
• Smart Bidding gets fewer signals, so a campaign with few conversions learns more slowly.

Expect your reported conversions from EU traffic to drop after a correct banner goes live. That drop is real data you were never entitled to, not a broken set-up. Plan budgets with that in mind rather than rewriting the banner to push acceptance up.

A set-up order that works

1. Audit what fires today. Open your site in a private window, refuse everything and check the browser's developer tools for cookies and network calls. Most sites find a pixel or a video embed nobody remembered.
2. Choose a consent tool (CMP). Google suggests either a Google-certified CMP or a manual Consent Mode v2 set-up; a certified CMP is the simpler route. Prices in October 2026: Cookiebot has a free plan for up to 50 subpages and paid plans from €7 a month; CookieYes is free up to 5,000 pageviews a month and starts at €9 a month for 100,000. Free tiers often limit languages and scans, which matters for a site in Greek and English, for example.
3. Classify every cookie honestly into necessary, analytics, marketing and preferences.
4. Design the first layer with "Accept all", "Reject all" and "Settings" at equal weight, a one-sentence explanation and a link to the full policy.
5. Connect Consent Mode v2 through the CMP's Google Tag Manager template, with all four signals defaulting to "denied" for EEA visitors.
6. Gate other vendors (Meta pixel, LinkedIn, chat widgets, YouTube embeds) through the same tool. Consent Mode only governs Google tags.
7. Test both paths. Refuse and confirm nothing marketing-related fires; accept and confirm conversions appear in Google Ads and GA4.
8. Add the withdrawal link in the footer and update the privacy policy to match.
9. Re-check every quarter, and after any new plugin, pixel or embed.

When not to over-engineer it

If your site uses no analytics, no ads and no third-party embeds, you may not need a consent banner at all, only a clear privacy notice. Cookie-free analytics tools that store nothing on the device can also reduce what needs consent, but check the vendor's documentation and your national authority's position before assuming an exemption.

How PNE handles it

Consent is where analytics projects quietly break: the banner goes up, conversions vanish, and nobody knows whether the drop is real. Our analytics service sets up the consent tool, Consent Mode v2, GA4 and Google Ads conversion tracking together and tests both the accept and refuse paths, so the numbers you see reflect what is actually happening.

This article is general information, not legal advice. For a site with sensitive data or large audiences, have your privacy counsel review the final banner.

Sources

• Recital 32: Conditions for consent — gdpr-info.eu
• Art. 7 GDPR: Conditions for consent — gdpr-info.eu
• Guidelines 05/2020 on consent under Regulation 2016/679 — European Data Protection Board
• Report of the work undertaken by the Cookie Banner Taskforce — European Data Protection Board
• Régulation des cookies : deux amendes à l'encontre de Google et Shein — CNIL
• About consent mode — Google Ads Help
• Consent mode v2 for EEA traffic — Google Tag Manager Help
• EU user consent policy — Google