Google began strengthening enforcement of its EU user consent policy in early 2024, and from March 2024 it required advertisers to send consent signals for users in the European Economic Area (EEA). Google applies the same requirement to users in the UK and Switzerland, so March 2024 became the date many UK businesses rushed to get "Consent Mode" on their websites. Two years on, the question is no longer whether a deadline has passed, but whether your set-up actually works and is still in line with the rules. UK law has also changed since then. This guide explains where things stand in September 2026 for any business that uses Google Analytics or Google Ads.
What Consent Mode is
Consent Mode is a feature of Google's tags and SDKs. In Google's words, it "allows web and app developers to adjust tag and app SDK behavior based on user consent choices". Your cookie banner records what a visitor has agreed to, and Consent Mode passes those choices to Google so that its tags behave accordingly.
It works through a set of consent types. The four that matter most for marketing are:
- ad_storage: whether advertising cookies and identifiers can be stored.
- analytics_storage: whether analytics cookies and identifiers can be stored.
- ad_user_data: whether user data can be sent to Google for advertising purposes.
- ad_personalization: whether data can be used for personalised advertising.
The last two are the parameters Google added to the consent mode API as part of that tightening, which is why you may still hear it called "Consent Mode v2". Google also supports functionality, personalisation and security storage types.
Why it matters
Consent Mode sits alongside Google's EU user consent policy, which applies to end users in the EEA, the UK and Switzerland. Under that policy, businesses using Google's products must get consent for cookies where legally required and for the collection, sharing and use of personal data to personalise adverts. They must also keep records of the consent they collect, tell people how to withdraw it, and clearly identify each party that may collect or use visitors' personal data.
Google says consent is required in the EEA, the UK and Switzerland, and that to keep using its tags for measurement, ad personalisation and remarketing you must collect consent and share those consent signals with Google. If your tags are not passing consent signals correctly, those features may not work for visitors from those regions, and your reports in Google Analytics will be less complete.
It is important to be clear about what this is. Consent Mode and the EU user consent policy are Google's own conditions for using its products, not UK law. The legal requirement to get consent for non-essential cookies in the UK comes from the Privacy and Electronic Communications Regulations (PECR), and where cookies involve personal data, UK GDPR applies too.
Basic or advanced: choose deliberately
There are two ways to implement Consent Mode, and the difference affects how much data you keep.
- Basic implementation blocks Google tags until the visitor interacts with your banner. Google notes that no data is sent before a user consents, not even the default consent status. If the visitor declines, nothing is sent.
- Advanced implementation loads the tags straight away with consent set to "denied" by default. If the visitor declines, the tags send cookieless pings that carry the consent state but do not set cookies.
Google uses those cookieless pings for behavioural and conversion modelling, which fills some of the gaps left by people who decline cookies. Its Analytics help centre warns that if you block Google tags until users consent, "you will not get the full benefits of consent mode".
Advanced implementation recovers more data, but it also means Google receives some information from people who have said no to cookies. Talk to whoever advises you on data protection before you choose, and make sure your privacy information explains what happens.
What has changed in UK law
The Data (Use and Access) Act 2025 amended PECR, UK GDPR and the Data Protection Act 2018, and the ICO confirmed in June 2026 that all of the Act's data protection provisions are now in force. It finalised its guidance on storage and access technologies in April 2026.
The biggest change for website owners is a set of exceptions to the consent rule. As well as the long-standing exception for things that are strictly necessary, there is now an exception for statistical purposes. It lets you use cookies to understand how your own service is used, with a view to improving it, without asking for consent, but only if you:
- give people clear and comprehensive information about the purpose;
- offer a simple and free way to object;
- use it only to improve your service, sharing it with a third party such as an analytics provider only if they are helping you do that;
- make sure the result is aggregate statistical information that cannot be used to identify people.
The ICO is explicit that this exception "does not apply to purposes related to online advertising". Advertising cookies, remarketing and ad measurement still need consent. Whether a particular analytics tool fits within the statistical purposes exception depends on how it is configured and who receives the data, so check the ICO guidance carefully rather than assuming your existing set-up qualifies.
A quick checklist for your website
- Audit your tags. List every tag on your site, including Google Analytics, Google Ads and any other advertising pixels, and what each one does.
- Check your banner. Under PECR and UK GDPR, consent must be freely given, specific and informed, and involve a clear positive action. The ICO says people should be able to enable or disable non-essential cookies, and that this should be easy to do.
- Confirm consent signals reach Google. Make sure all four consent types above are being set, both as defaults and when visitors make a choice, and that defaults apply to the regions you intend.
- Decide between basic and advanced implementation with your data protection adviser, and record why.
- Review your privacy and cookie information so it matches what your site actually does.
- Revisit it regularly. New tags, new plugins and site redesigns are common ways for consent set-ups to break without anyone noticing.
Reaching local customers beyond the browser
Online advertising is only one way to reach customers, and cookie consent does not decide who hears a radio advert. LDC Radio is dance music radio for West Yorkshire, on 97.8 FM, DAB, our app and online. If you want to add radio to your marketing mix, find out about advertising with LDC Radio, or have a listen first to hear what we sound like.