Consent Mode v2: A Practical Guide for UK Websites

If you run a UK business website that uses Google Analytics, Google Ads, or any Google marketing service, Consent Mode v2 is not optional — it is the mechanism that keeps your tracking legal under UK GDPR while preserving as much marketing data as possible. The Information Commissioner's Office (ICO) has made it clear that analytics and advertising cookies require explicit, affirmative user consent. Consent Mode v2 is Google's answer: a framework that respects user choices while sending anonymised, modelled data when consent is denied. Here is what UK businesses need to know, how to implement it, and where UK requirements differ from the EU.

What Consent Mode v2 Actually Does

Consent Mode v2 adds a communication layer between your consent management platform (CMP) and Google's tags. When a user lands on your site, the consent state is sent to Google before any tags fire. Google tags then behave differently depending on the consent state:

• Consent granted: Tags fire normally. Full cookies are set. All data flows to GA4 and Google Ads.
• Consent denied: Tags fire in a cookieless mode. Google sends anonymised, non-identifiable pings that do not store identifiers. GA4 uses behavioural modelling to fill gaps in your reports, while Google Ads uses conversion modelling for bidding.

The key insight: Consent Mode v2 means you are never completely blind, even when users say no. Modelled data fills the gap — and Google's machine learning models have become remarkably accurate for properties with healthy traffic volume.

The Two Implementation Levels: Basic vs Advanced

Basic Consent Mode

Tags are blocked entirely until the user interacts with the consent banner. If they accept, tags load and fire. If they reject or ignore the banner, no tags fire at all — zero data flows to Google. This is simpler to implement but gives you no modelled data. For a UK e-commerce site, this can mean 30–40% of your traffic generates zero analytics or ads data.

Advanced Consent Mode

Tags load immediately on page load with consent defaulted to "denied." Google receives cookieless pings from the first pageview — even before the user sees the consent banner. When the user grants consent, tags transition to full mode. When they deny, cookieless pings continue. This is the version Google recommends and the version that preserves the most marketing data.

UK vs EU: Key Regulatory Differences

While UK GDPR and EU GDPR share common ancestry, practical regulatory enforcement differs:

• Enforcement Body: In the UK, the ICO oversees data protection. In the EU, individual national DPAs (such as CNIL in France, BfDI in Germany, or DPC in Ireland) enforce decisions.
• Cookie Banner Enforcement: The ICO strictly requires that "Reject All" buttons carry equal visual prominence to "Accept All" buttons on the first layer of the banner. Dark patterns (such as hiding reject buttons behind settings sub-menus) are active enforcement targets.
• International Data Transfers: The UK has its own adequacy regulations and International Data Transfer Agreement (IDTA), distinct from EU Standard Contractual Clauses (SCCs).

Recommended CMPs for UK Websites