Consent Mode v2 for UK advertisers: what actually changed in 2026
by Harry Watts · · updated · 8 min read
Two things happened this year, in opposite directions. UK cookie law got looser in February. Google's advertising requirements got stricter in June. Most UK advertisers have noticed neither.
The confusion underneath all of this is that people treat cookie consent as one obligation. It's two, they come from different places, and they have different consequences.
- The law (PECR and UK GDPR, policed by the ICO) decides what you must ask permission for. Breaking it risks a fine.
- Google's policy (Consent Mode v2) decides what you must tell Google in order to keep using personalised advertising. Breaking it costs you remarketing and measurement, immediately, with no hearing.
You can satisfy one and fail the other in either direction. Most of the accounts I see are legally fine and commercially bleeding.
What changed in the law, 5 February 2026
The Data (Use and Access) Act 2025 amended PECR, and for the first time since 2011 the rule is not "consent for everything non-essential". A new Schedule A1 exempts three low-risk categories:
- First-party analytics used only for statistics, provided you tell visitors clearly and give them a straightforward opt-out
- Appearance and display preferences: dark mode, language, layout
- Security and emergency storage
The ICO updated its guidance on 29 April 2026 to match. The same Act also raised the maximum PECR fine from £500,000 to £17.5 million or 4% of global turnover, a hundredfold increase that got far less attention than the relaxation did.
What this does not do: it doesn't touch advertising. Remarketing, conversion tracking, anything that feeds Google Ads or Meta: all still require consent. If you run ads, you still need a banner. What's changed is that a purely analytics-only site might not.
Worth knowing alongside that: the ICO has moved from reviewing sites by hand to automated detection across the top 1,000 UK websites. The enforcement so far has been reprimands and compliance letters rather than fines, but the ceiling on those fines is now a serious number.
What changed at Google, 15 June 2026
This one is quieter and, for advertisers, more dangerous.
Until June, two things jointly controlled whether advertising data reached Google Ads: the Google Signals toggle in GA4, and the ad_storage parameter in Consent Mode. If your consent setup was misconfigured, Signals often caught it. There was a safety net.
Since 15 June 2026, ad_storage governs it alone. Google Signals still enriches reporting inside Analytics, but it no longer has any say in what reaches Google Ads.
The practical consequence: a consent banner that sets ad_storage wrongly now takes conversions, remarketing audiences and Smart Bidding signals dark, and nothing catches it. Accounts that limped along on a misconfigured setup for two years stopped limping in June, and because the failure is silent, plenty of advertisers are reading it as a bad summer.
So is Consent Mode v2 actually required in the UK?
Not by law. UK law doesn't mention it: PECR requires consent, and is indifferent to how you signal that consent to a vendor.
But Google requires it, and the UK is explicitly in scope alongside the EEA. It has been mandatory under Google's own policy since March 2024, with enforcement from July 2025. Without it, you lose remarketing audiences, personalised advertising and full conversion measurement for UK visitors.
So: a commercial requirement, not a legal one. The distinction matters when someone tells you it's "a GDPR thing": it isn't, and treating it as a legal box-tick is how it gets implemented badly.
Basic or advanced: the choice that decides how much you lose
| Basic mode | Advanced mode | |
|---|---|---|
| When tags load | Only after the visitor chooses | Immediately, all signals defaulted to denied |
| If consent is refused | Nothing is sent at all | Cookieless pings (no identifiers) |
| Conversion modelling | Limited | Yes |
| Behavioural modelling in GA4 | No | Yes |
| Needs | Little consented traffic | Enough consented traffic to model from |
Advanced recovers an estimate of the conversions that refusals would otherwise erase entirely. For most advertisers that's the point of doing this at all, and it's why the default recommendation is advanced, unless your traffic is too thin for the modelling to mean anything or your legal position demands the stricter reading.
Both are legitimate. Anyone who tells you advanced mode is non-compliant is overstating it; anyone who tells you basic mode costs nothing is too.
The implementation detail that quietly breaks it
Order of execution. The consent defaults must be declared before your tag manager loads. Google Tag Manager reads the consent state as it initialises: a default declared afterwards arrives too late to hold back a tag that has already fired.
This is the single most common fault I find, and it's invisible from the outside: the banner looks right, the settings look right, and tags fire before anyone has agreed to anything. You're then non-compliant and your data is inconsistent.
This site's own head is a working example: view source on this page. The defaults sit directly above the GTM snippet, everything denied except security_storage, with wait_for_update giving the banner a moment to respond. The comments explain the reasoning, including why one setting is deliberately absent.
How to check yours in ten minutes
- Plot conversions against the date your banner went live. A step change with no matching fall in clicks or real enquiries means consent is eating your data.
- Check the same against 15 June 2026. A drop there points at the Google Signals change and an
ad_storagemisconfiguration that used to be covered. - View source and find the consent defaults. If they appear below the tag manager snippet, or aren't there at all, that's your fault found.
- Open Google Tag Assistant and check the consent state on page load, before you touch the banner. Everything except security storage should read denied.
- In Google Ads, look for modelled conversions. If Consent Mode is working in advanced mode, you'll see them. If you see none and you're running a banner, it isn't working.
- Re-read your banner as a visitor. Reject must be as easy as accept: equal prominence, one click. That's where ICO attention has actually landed.
Quick answers
Is Consent Mode v2 required in the UK?
Not by law, but Google requires it, and the UK is in scope alongside the EEA. Skip it and you lose remarketing, personalised ads and full conversion measurement. Commercial requirement, not a legal one.
Did UK cookie rules change in 2026?
Yes: from 5 February 2026 the Data (Use and Access) Act exempted first-party statistics-only analytics, appearance preferences and security storage from consent. The ICO updated guidance on 29 April. Maximum fines rose from £500,000 to £17.5m or 4% of turnover.
Do I still need a cookie banner?
If you advertise, yes. The exemptions don't cover advertising or remarketing cookies. A purely analytics-only site may now be able to drop the banner; an advertiser cannot.
Basic or advanced mode?
Advanced for most advertisers: it sends cookieless pings and models the conversions refusals would otherwise erase. Basic blocks tags entirely until the visitor chooses, which is simpler and loses more. Advanced needs enough consented traffic to model from.
Why did conversions drop after my banner went live?
The banner is blocking Google tags with no Consent Mode behind it, so refusals go unrecorded. Look for a step change on the go-live date with no matching fall in clicks or real enquiries. The sales didn't stop — the measurement did.
What happened on 15 June 2026?
Google decoupled Google Signals from advertising data. ad_storage alone now controls what reaches Google Ads, so a misconfigured banner takes conversions and audiences dark with no fallback.
If your numbers changed and nobody can say why
Consent problems and ordinary tracking faults produce the same symptom (reporting that disagrees with your bank) and they need completely different fixes. Getting a bidding strategy right on top of either is wasted effort.
Cookie consent and Consent Mode v2 setup is one of the add-ons for exactly that reason: it's slow specialist work, and it sits underneath everything else. A free intro call is usually enough to tell which of the two you've got.