Cookies & Consent Mode v2: Ask first. Then measure what they allow.

The rule sits in Article 5(3) of Directive 2002/58/EC and, in Greece, in Article 4(5) of law 3471/2006: storing information on a user’s device, or reading what is already there, is allowed only with their consent, after clear information. The only exception is what is strictly necessary for the service they asked for.

It covers every technology, not only cookies: local storage, pixels, device fingerprinting, mobile identifiers. And it applies even if you process no personal data.

The Hellenic Data Protection Authority (HDPA) spelled the rule out in February 2020. Third-party analytics, such as Google Analytics, and advertising need consent. Visitors must be able to accept or reject with the same number of clicks and from the same level, and to withdraw just as easily. The Authority recommends buttons of the same size, emphasis and colour, and refusing cannot lock the content.

In May 2022 the Authority announced an audit of 30 news and information websites whose banners had no “Reject” on the first layer and highlighted “I agree”. It gave them 15 days, and every site that received its letter complied, with one exception. In 2023 the European Data Protection Board (EDPB) listed the same practices as problematic: a missing reject option, pre-ticked boxes, colours that make refusal hard to read, cookies labelled “essential” when they are not.

Consent Mode is how your banner tells Google’s tags what the visitor decided. Version 2 adds two signals to ad_storage and analytics_storage: ad_user_data, for whether user data may be sent to Google for advertising, and ad_personalization, for whether personalised advertising is allowed.

Since early March 2024, Google has required anyone using its tools for visitors from the European Economic Area to collect consent and send it these signals, to keep measurement, personalisation and remarketing. Without them, EEA visitors are left out of advertising audiences.

It can be installed in two ways. In basic mode, Google’s tags do not load before the choice, and if the visitor declines, nothing is sent. In advanced mode, they load with refusal as the default and send signals without cookies, from which Google makes more detailed estimates for your account. Because advanced mode sends data before the choice, and because the EDPB considers that Article 5(3) also covers techniques without cookies, the choice between the two is best made with your lawyer.

Consent Mode is not a banner. If you show Google ads on your own site, through AdSense, Ad Manager or AdMob, Google has required a certified consent management platform (CMP) using the IAB’s TCF since 16 January 2024. If you only advertise, you can use one of Google’s partners or your own banner, and it is your responsibility that it follows the law.

When a visitor declines, there is no cookie and no remarketing for them. What you see about their visits is, at best, an estimate.

In advanced mode, Google estimates conversions and behaviour from the cookieless signals, with models that learn from those who consented. To do so, GA4 needs at least 1,000 events a day from visitors who declined, for seven days, and 1,000 visitors a day who consented, on seven of the last 28 days. Many small e-shops never reach those thresholds. And estimates appear in reports, not in audiences or data exports.

That is why we also measure from your side. Orders are always recorded in your e-shop, whatever the cookies, and they are the steady yardstick against which to check what the platforms report. Server-side measurement, with a container in a space you control, gives you control over what leaves for each platform.

It does not bypass consent, though. Google’s tags on the server read the consent state and adjust to it, and wherever the rule requires consent in the browser, it requires it there too.