Consent Mode v2
Measure Google Ads without tracking before consent.
If you use Google Ads or Google Analytics for visitors from the EEA, Google has required consent signals since March 2024, otherwise measurement and remarketing drop out. At the same time, Austrian and German law prohibit storing or reading anything on the device before consent unless it is strictly necessary. We bring both together.
- Austria and Germany
- Rejecting as easy as accepting
- Reply within 24 hours
In short
Consent Mode v2 is Google’s interface through which your website passes the cookie banner decision to Google tags. Since March 2024, Google has required the additional signals ad_user_data and ad_personalization for users in the EEA; without them, features such as conversion measurement, remarketing and personalised advertising are not available for these users. Legally, § 165 (3) TKG 2021 applies in Austria and § 25 TDDDG in Germany: non-essential cookies and similar access to the device only after consent.
Key facts
- Two new signals since March 2024
- In addition to ad_storage and analytics_storage there are ad_user_data (user data sent to Google for advertising) and ad_personalization (personalised advertising, remarketing).
- No signals, fewer features
- Google requires consent signals for users in the EEA to keep using measurement, remarketing and personalisation. If ad_personalization is denied, remarketing is off for that person.
- Basic and advanced implementation
- Basic: Google tags only load after consent. Advanced: tags load beforehand and, without consent, send cookieless pings that Google uses for modelling.
- Austria: § 165 (3) TKG 2021
- Storing and reading on the device only with consent, unless strictly necessary for the service explicitly requested. The Austrian data protection authority interprets this exception narrowly.
- Germany: § 25 TDDDG
- The same rule, technology-neutral: it covers cookies, pixels and any other technique, whether or not personal data is involved.
- Rejecting must be equal
- Pre-ticked boxes, continued browsing or scrolling are not consent. Rejecting must be as easy as accepting on the first layer.
As of 26 October 2026 · General information, not legal advice.
Who this affects
- Companies running Google Ads that use conversions or remarketing for visitors from Austria, Germany or the rest of the EEA.
- Websites with Google Analytics 4 linked to Google Ads.
- Websites whose banner offers “reject” but where Google tags, pixels or embedded content already load before the decision.
- Websites with a custom or older banner that does not yet send v2 signals.
Which implementation is legally right for your website, in particular whether the advanced variant with pings before consent is permissible, is a legal question. We implement the technology properly and recommend a lawyer for the assessment.
What we do for you
- 1
Check what loads before consent
We open your website without consent and document every cookie, every storage access and every request to third parties before anyone has clicked.
- 2
Set up the banner
A consent management platform or a lean custom banner: accept and reject on equal terms, clear categories, withdrawal possible at any time.
- 3
Consent Mode v2 in Tag Manager
Defaults set to “denied”, all four signals, tags only after matching consent. Server-side tagging if wanted.
- 4
Conversion tracking that respects the choice
Google Ads conversions, enhanced conversions and GA4 events configured to send only what consent was given for. Then we check in Google Ads that the signals arrive.
- 5
Update the privacy policy
A paragraph describing exactly the services, cookies, purposes and durations in use, as a draft for your legal adviser.
We do not give legal advice. Fewer measured conversions after the switch are normal: people who reject are no longer counted. How much that is for you only shows in your own data.
Free checklist
Consent checklist: 12 points for GDPR-compliant tracking with Google
Consent checklist: 12 points for GDPR-compliant tracking with Google
For websites with Google Analytics, Google Ads or other ad tags and visitors from the EEA. Not legal advice; if in doubt, a lawyer reviews the legal texts.
What loads before consent, banner, Consent Mode v2, conversion tracking and privacy policy: the 12 points as a printable PDF.
Frequently asked questions
What happens if I do not set up Consent Mode v2?
According to Google, features such as conversion measurement, remarketing and personalised advertising are then not or only partly available for users in the EEA, and Google Analytics audiences used in linked advertising products no longer include EEA users.
Does Consent Mode replace the cookie banner?
No. Consent Mode only passes on the decision your banner collects. You still need a banner that obtains consent lawfully and a matching privacy policy.
Basic or advanced implementation?
With the basic implementation, Google tags only load after consent; without consent nothing goes to Google. The advanced one loads tags beforehand and sends cookieless pings. According to Google this allows more accurate modelling; whether these pings are permissible before consent is something to have checked legally. We discuss the options with you; you decide together with your legal adviser.
Do I need server-side tagging?
Not necessarily. It gives you more control over which data goes to Google and other providers, but it does not replace consent and adds running costs for the server.
Do you give legal advice?
No. We implement banner, tags and tracking and document what loads. A lawyer confirms whether your setup is legally sound.
Sources
- Google Ads-Hilfe: Updates to consent mode for traffic in the EEA
- Google Ads-Hilfe: Consent mode reference
- Google for Developers: Set up consent mode on websites
- Google for Developers: Consent mode overview
- Datenschutzbehörde: FAQ Datenschutz und Cookies
- TDDDG (§ 25), gesetze-im-internet.de
- Datenschutzkonferenz: Orientierungshilfe für Anbieter digitaler Dienste
Related services
- NIS2 compliance →Austria’s NISG 2026 applies since 1 Oct 2026, registration due by 31 Dec 2026.
- Cyber Resilience Act →CRA reporting applies since 11 Sep 2026 for software, apps and devices sold in the EU.
- Accessibility (European Accessibility Act) →Online shops and bookings in the EU must be accessible since 28 June 2025.
- E-mail security →Gmail, Yahoo and Outlook require SPF, DKIM and DMARC.
- E-invoicing →E-invoicing in Germany: receiving since 2025, issuing from 2027/2028.