Cookie consent and Google Consent Mode for UK sites

What UK law actually asks for

The rule is older than most of the tools that sell against it. Regulation 6 of PECR has required consent before storing or reading information on a user’s device since 2003, and UK GDPR sets the standard that consent must meet: a freely given, specific, informed and unambiguous opt-in. This is the compliance half of our UK engineering and compliance work, and it sits next to the same evidence discipline we describe for overseas teams handling UK personal data.

These cookies are the usual strictly necessary set that does not need consent. Everything else does.

Two rulebooks, one banner

Most teams only ever think about one of these. In our own delivery records the word “PECR” barely appears; everything is framed as “the Consent Mode deadline” or “a Google consent-policy violation”. That is backwards. PECR is the law that now carries the £17.5m fine, up from a £500,000 cap. Google’s requirement is a commercial gate on your ad features. A banner tuned to keep Google happy can still break the law, and a banner that is legally clean can still switch your ads off if the Consent Mode signals never reach Google.

Google has two distinct requirements, often confused. Advertisers using Google Ads or GA4 must send Consent Mode v2 signals for EEA and UK users, in force since March 2024. Publishers serving ads through AdSense, Ad Manager or AdMob must additionally use a Google-certified CMP integrated with the IAB Transparency and Consent Framework, in force since 16 January 2024. Fail the first and measurement degrades. Fail the second and personalised ads stop serving.

Consent Mode v2 and what you actually lose

Consent Mode v2 is four signals. Two of them, ad_storage and analytics_storage, change how the tags behave on your page by controlling whether cookies are written. The two added in v2, ad_user_data and ad_personalization, are signals sent to Google that carry no on-page effect but decide whether Google may use the data for advertising and remarketing.

You then choose how the tags load, and the choice is a real trade-off.

For most UK sites that spend on Google or Meta, use advanced mode: the modelled conversions are worth the extra care, and the default-denied block is the same line PECR wants anyway. Wiring this into a WordPress theme and its tag manager is exactly the kind of work a CMP wired correctly into a WordPress build needs, rather than a plugin dropped in and left on defaults. The minimum, provider-agnostic pattern is a default-denied block before any tag, then an update on consent.

<!-- Load the consent platform before any Google or marketing tag. -->
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){ dataLayer.push(arguments); }

  // Deny everything until the visitor chooses. This is the line most sites miss.
  gtag('consent', 'default', {
    ad_storage: 'denied',
    ad_user_data: 'denied',
    ad_personalization: 'denied',
    analytics_storage: 'denied',
    functionality_storage: 'granted',
    security_storage: 'granted',
    wait_for_update: 500,
  });
</script>

<!-- The consent platform calls this when the visitor accepts a category. -->
<script>
  function onConsentChange(choice) {
    gtag('consent', 'update', {
      ad_storage: choice.marketing ? 'granted' : 'denied',
      ad_user_data: choice.marketing ? 'granted' : 'denied',
      ad_personalization: choice.marketing ? 'granted' : 'denied',
      analytics_storage: choice.analytics ? 'granted' : 'denied',
    });
  }
</script>

What breaks in production

For this guide we went back through our own UK delivery records. Client names are withheld. These are the failures that actually cost money, and the rule each one taught.

1. Load the CMP before any tag and default to denied. Blocking first is what the law wants and also the technical default that keeps Google’s signals honest. The same line solves both.
2. Monitor for the absence of data. Broken consent rarely throws an error; it just goes quiet. Alert on a drop in events and conversions, not only on exceptions.
3. One property is not one site. A WordPress plugin does not reach a separate booking portal or storefront on another stack. Each surface needs its own consent layer.

The Consent Debt Score

The Consent Debt Score is our triage model for an existing site. It does not decide whether you are lawful. It tells you how much revenue and regulatory exposure your current consent setup is carrying, and how urgently to act.

A brochure site with a working certified CMP and no advertising scores one or two. An ad-spending store firing Meta and Google pixels on page load, with an Accept-only banner and a second tag container the scan never sees, scores nine or more. Same banner on the surface, very different exposure underneath.

A real boundary: one CMP, two platforms

The hardest consent problem we hit is not the banner. It is coverage. Take a UK clinic whose website and store we build and run: the marketing site is WordPress, with a certified CMP that bundles Consent Mode v2, and the booking and commerce flow lives on a separate stack on its own subdomain. A WordPress consent plugin cannot reach that second surface. Any tracking on the portal is unconsented until it gets its own consent layer, either a second certified CMP or a hand-coded default-denied block like the one above. Getting identical, cross-domain consent on both surfaces, so a visitor’s choice on one is honoured on the other, is the real engineering work.

What our production record shows is worth stating plainly. On WordPress and Shopify we run Complianz, a Google-certified CMP that bundles Consent Mode v2, standardised across a partner agency’s UK portfolio under one agency licence; CookieYes is our default where a WordPress plugin is not the right fit; and a plugin-free CMP covers a separate portal that no plugin can reach. On a custom build we gate analytics behind a consent state in the application itself, send the four Consent Mode signals and add a withdraw link, which is the same consent behaviour a SaaS site’s measurement setup depends on. We have never shipped a bespoke consent platform where a certified one already exists, because Google’s ad rules require the certification, not our code.

Recommendations by business type

Primary sources

• ICO guidance on cookies and similar technologies
• ICO: the Data (Use and Access) Act 2025
• Data (Use and Access) Act 2025, legislation.gov.uk
• Google: consent mode overview
• Google: about consent mode
• Google: certified CMP requirement for the EEA and UK
• Google: consent management requirements for serving ads

Technical and operational guidance, not legal advice.