The Legal Framework Behind Consent Mode
Google Consent Mode v2 is a technical response to two European regulations: the General Data Protection Regulation (GDPR) and the ePrivacy Directive (the "Cookie Directive"). Together, these regulations require that website operators obtain explicit, freely-given, specific, and informed consent before:
- Setting non-essential cookies on a user's device
- Processing personal data for advertising purposes
- Tracking users across websites for advertising profiling
Google's tag infrastructure (GA4, Google Ads conversion tags) falls squarely within these requirements when used in the EEA.
What GDPR Requires for Google Tags
For analytics tags (GA4): users must consent to "analytics" or "statistics" cookies before GA4 can set client_id cookies and track sessions.
For advertising tags (Google Ads): users must consent to "marketing" or "advertising" cookies before conversion tracking, remarketing, and personalised ad measurement can occur.
Consent Mode v2's four consent types map to these legal categories: analytics_storage for analytics cookies; ad_storage, ad_user_data, and ad_personalization for advertising-related processing.
What Consent Mode Does NOT Solve
Consent Mode is a technical framework — it does not make you legally compliant by itself. Compliance also requires:
- A valid Privacy Policy disclosing your use of analytics and advertising cookies
- A Cookie Policy or equivalent disclosure
- Consent that meets the GDPR "freely given, specific, informed, unambiguous" standard
- Withdrawal of consent as easy as granting it (a "Reject All" option as prominent as "Accept All")
- Records of consent being kept (consent logging)
A cookie banner that makes rejection difficult, uses dark patterns, or pre-ticks boxes is not GDPR-compliant regardless of whether Consent Mode is implemented.
The Legitimate Interests Question
Some analytics use cases may qualify for "legitimate interests" as a legal basis under GDPR — a basis that does not require explicit consent. However, the European Data Protection Board and many national DPAs have indicated that analytics cookies generally do not meet the "legitimate interests" balancing test for behavioural advertising. For advertising use cases, consent is essentially required.
National DPA Variations
GDPR gives national Data Protection Authorities (DPAs) interpretive latitude. Some DPAs (France's CNIL, Germany's LfDI) have issued specific guidance that is stricter than the baseline GDPR requirements. If you operate in these markets, check the specific DPA guidance for your use case.
Summary
Consent Mode v2 is the technical implementation of GDPR consent requirements for Google tags. It signals user consent choices to Google's infrastructure, restricting data collection for non-consenting users. Compliance also requires valid consent collection (freely given, specific, easy to withdraw), appropriate disclosures, and consent records. Consent Mode alone does not make a site GDPR-compliant if the underlying consent collection fails GDPR standards.
See our Consent Mode v2 Implementation service for compliant setup.
Need GDPR-compliant tracking configured? Contact Adslytics.
Need expert tracking setup?
Our Google Tag Manager experts have delivered 500+ tracking setups with a 98% success rate.
Get a Free Consultation →