Skip to main content
Get Started
Open menu Close menu

EEA, UK & Switzerland

Google product policy

Google’s EU User Consent Policy: What your website needs to do

Using Google advertising or measurement products? Your consent setup needs to cover what visitors are told, the choices they make and what your tags actually do. Google’s EU User Consent Policy sets requirements for products that incorporate it. A visible cookie banner is only one part of that setup.

At a glance

Who it can apply to
Relevant Google products used with visitors in the EEA, the UK and Switzerland, including when your business is based elsewhere.
What it is
A Google product policy, separate from privacy legislation.
Choices to offer
Legally valid consent for cookies or other local storage where the law requires it and for ads personalisation, with an easy way to withdraw it.
Website actions
  • Review disclosures: purposes, Google and other recipients.
  • Collect the required consent.
  • Communicate choices to Google.
  • Retain evidence of consent.
  • Make withdrawal accessible.
Primary sources
Google’s EU user consent policy, Google’s help with the policy and the implementation guidance linked in this guide.
Last reviewed

What does the policy require?

You must obtain legally valid consent for cookies or other local storage where the law requires it, and for collecting, sharing and using personal data to personalise ads. Explain which parties receive or use that data, retain records of consent and tell visitors how to withdraw it.

The policy also covers properties you manage for clients. Where your integration shares data from a third-party property with Google, it requires commercially reasonable efforts to ensure that operator meets the relevant duties. Check the terms of each Google product you use.

Describe the actual purposes of your setup and identify Google and other relevant recipients. Where you use ads personalisation, name that purpose in the first layer of your notice. Give visitors a clear way to actively indicate their decision.

Link to Google’s Business Data Responsibility site so visitors can understand Google’s use of their information. Google permits a direct banner link or specified accessible routes through a privacy policy or a “More info” link. A direct link is a straightforward implementation choice.

Make consent withdrawal as easy as giving consent. A persistent cookie-settings link should reopen the controls and let visitors change their choices.

Consent Mode communicates consent choices and adjusts supported Google tags. It does not collect valid consent by itself. Check the four main signals: ad_storage, analytics_storage, ad_user_data and ad_personalization.

Basic Consent Mode blocks Google tags until consent is granted. Advanced Consent Mode can load tags with denied defaults and send measurements without cookies before consent. That difference matters when deciding what data your site sends.

Set defaults before the relevant measurement commands and update them when a visitor makes a choice. A tag firing too early can undermine the setup. Read our Google Consent Mode guide for implementation details and the Basic vs Advanced guide for the trade-offs.

Do advertisers and publishers have the same requirements?

Advertisers using Google tags or SDKs for EEA measurement and relevant advertising features need to communicate users’ consent choices to Google. Check the requirements for the features you use. Google recommends its CMP Partner Program, but does not require advertisers to choose a provider from that programme.

Publishers using AdSense, Ad Manager or AdMob to serve personalised ads to users in the EEA, the UK or Switzerland must use a Google-certified CMP integrated with the IAB TCF. Check Google’s current list and the supported platform. Other ad-serving options have their own conditions.

Consent Mode support, TCF support and Google CMP certification are different things. Certification also does not guarantee compliance with every privacy law.

Check the live website

Use a fresh browser session and test the journey on desktop and mobile:

  • Check that the notice appears for the intended regions and on all relevant domains and entry pages.
  • Test accepting, rejecting, selecting individual purposes and withdrawing consent later.
  • Inspect cookies, network requests and Google consent signals for each choice. Confirm that consent-dependent storage stays blocked when permission is absent.
  • Confirm that the displayed disclosures match the tools and recipients actually in use.
  • Keep a record of the tested configuration and repeat the checks after changes to tags, plugins or the banner.

What if Google flags a problem?

Google audits live websites and apps and generally contacts partners to resolve issues. If problems remain unaddressed, advertiser audience features or conversion measurement may be suspended; publisher ad serving can be restricted.

Read the specific findings, assign an owner and correct both the notice and the technical behaviour where needed. Retest the affected journeys, retain evidence of the changes and use Google’s stated process to request a review. Follow the deadline in your notice rather than assuming a universal grace period.

Sources

FAQ

Is this the same as GDPR compliance?

No. Google’s policy reflects certain privacy requirements and forms part of relevant product terms. Meeting it does not settle every obligation under GDPR, ePrivacy or national rules.

Can non-personalised ads still require consent?

Yes. Google explains that non-personalised ads can still use cookies or mobile identifiers. Where consent is legally required for that storage or access, removing personalisation does not remove the requirement.

Does a denied Consent Mode signal mean no data is sent?

No. Advanced Consent Mode can send measurements without cookies while consent is denied. “Cookieless” should not be treated as proof that no data is transmitted or that your legal assessment is complete.

Put the checks into practice with Passiro

Use Passiro’s cookie banner, scanning, script blocking and Google Consent Mode integration to build and check your website’s consent setup. Configure the disclosures for your actual tools, then verify the result on the live site. Your implementation and the choices you offer still matter.

Get Started