By Marc Alexander

A common belief on UK sites: Consent Mode v2 is an EU thing, and Brexit took us out of it. It didn't. Google's rule is written around where the visitor is, and the visitor list says the European Economic Area, the UK and Switzerland. Here's what that means in practice.

What Google requires.

Google's EU user consent policy says that any business using Google's advertising and measurement products must get valid consent from visitors in the EEA, the UK and Switzerland for cookies where the law requires it, and for using personal data to personalise ads.

Since March 2024, the way Google checks is the Consent Mode v2 signals: two extra values, ad_user_data and ad_personalization, alongside the original ad_storage and analytics_storage.

Without those signals, Google Ads stops building remarketing audiences from your UK visitors, and conversion measurement loses the modelling that fills in the gaps left by people who said no. The site keeps working; the advertising quietly gets worse.

Why the UK is on the list.

The policy reflects the GDPR and the ePrivacy Directive, and the UK's equivalent laws: UK GDPR and PECR.

PECR is the one that matters for cookies. It requires consent before anything non-essential is stored on or read from a visitor's device, and the Data (Use and Access) Act 2025 narrowed the exceptions rather than removing the rule, as GA4 after the Data (Use and Access) Act sets out.

So "legally required" is true in the UK, and Google's rule follows.

Where the business sits doesn't come into it. A UK business with only UK customers is covered because its visitors are in the UK.

What a UK site needs.

  1. A banner that asks before loading. Nothing non-essential fires until the visitor chooses, and refusing is as easy as accepting. The ICO's 2025 review of the UK's 1,000 busiest websites tested exactly that.
  2. Consent Mode defaults set to denied for all four signals, before any Google tag loads, then updated with the visitor's choice.
  3. A choice between basic and advanced. Basic blocks Google's tags until consent; advanced lets them send cookieless pings for modelling. Basic or advanced for EEA traffic applies word for word to the UK.
  4. The same for the other platforms. Meta, LinkedIn and TikTok have their own rules, and Microsoft Advertising has its own consent mode, covered in Microsoft Ads consent mode.

Where UK sites usually go wrong.

  • A banner installed, but Consent Mode never configured, so Google sees no signal at all and treats the visitor as unconsented.
  • Defaults set to granted "so the reports look right", which is the one setup Google can detect and penalise.
  • A consent manager that only sets the two original signals, from before 2024.
  • Region settings that apply the rules to EU visitors and leave UK visitors on granted.

What to check.

  1. Open the site in a private window from a UK connection and watch the network requests before touching the banner.
  2. In Tag Manager's preview, look at the consent state on the first page load: all four signals should read denied.
  3. Accept, and check they flip to granted; reject, and check they stay denied.
  4. In Google Ads, check the conversion diagnostics page for the Consent Mode status.

The Consent Mode v2 testing guide goes through each step. Marc Alexander sets up Consent Mode v2 for UK businesses, and the free tracking checker shows what a page loads before anyone chooses.