Marketing measurement in Europe after consent: Consent Mode v2, GDPR and self-hosted fonts
How to measure ads to UK and EU audiences legally: cookie consent, Google Consent Mode v2, server-side tagging, self-hosted fonts and the European Accessibility Act.
The short answer
For EU and UK visitors, analytics and advertising cookies need prior, informed consent. Google has required Consent Mode v2 since March 2024 for advertisers using EEA data in personalised ads and remarketing. Start every tag in a denied state, update it only after the visitor chooses, and fill the gaps with modelled conversions and geo-based tests rather than fingerprinting.
Key takeaways
- Consent first: non-essential cookies (analytics and ads) need opt-in consent from EU visitors under the ePrivacy rules and GDPR, and the UK applies similar rules.
- Consent Mode v2 has been required since March 2024 for advertisers who want to use EEA user data for ad personalisation and remarketing in Google’s products.
- Default to denied, update on choice, and make rejecting as easy as accepting.
- Self-host fonts. A German court fined a site in 2022 for loading Google Fonts in a way that sent visitors’ IP addresses to Google without consent.
- Accessibility is now law in the EU for many consumer-facing digital services, under the European Accessibility Act from 28 June 2025.
What consent has to look like
- Prior: no analytics or ad tags fire before the visitor chooses.
- Granular: separate choices for analytics and advertising.
- Equal: “Reject” must be as easy as “Accept”. Burying it two clicks deep has been penalised by regulators.
- Recorded and reversible: store the choice, and offer a persistent “cookie settings” link.
The UK’s Data (Use and Access) Act 2025 introduces exemptions for some low-risk analytics cookies as its provisions commence. Check the ICO’s current guidance before relying on them.
Google Consent Mode v2
Consent Mode passes the visitor’s choice to Google tags through four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization.
“Consent mode allows web and app developers to adjust tag and app SDK behavior based on user consent choices.”
Google Tag Platform documentation, Consent mode overview
- Set defaults to denied in the page head, before any Google tag loads.
- Update the signals when the visitor makes a choice in your consent banner.
- Basic or advanced: in basic mode, tags don’t load until consent is given. In advanced mode, tags send cookieless pings that Google uses for modelling. Choose with your privacy adviser.
This site uses that pattern: everything starts denied, and analytics loads only after you accept. See the cookie policy.
Filling the measurement gap
With consent rates well below 100%, platform-reported conversions undercount. Ways to see clearly without tracking people who said no:
- Modelled conversions in Google Ads and GA4, based on consented data.
- Server-side tagging gives you control over what is sent to vendors. It’s not a way around consent.
- Geo holdout tests measure lift from aggregate sales, with no individual tracking. See incrementality testing.
- CRM-based reporting: count sales where they happen.
Fonts, embeds and other leaks
In January 2022 the Regional Court of Munich ordered a website operator to pay damages for transmitting a visitor’s IP address to Google by loading Google Fonts from Google’s servers without consent. The easy fix is to self-host fonts, as this site does. Apply the same thinking to embedded maps, videos and chat widgets: load them on click, or after consent.
Accessibility: the other European requirement
The European Accessibility Act has applied since 28 June 2025 to a range of products and services, including e-commerce. Microenterprises providing services are largely exempt, but accessible design (keyboard navigation, contrast, alt text, captions) widens your market wherever you sell. See this site’s accessibility statement.
AI in your marketing
If you use chatbots or AI-generated content aimed at EU audiences, the EU AI Act’s transparency rules start on 2 August 2026. See the EU AI Act guide for marketers.
Frequently asked questions
Is Consent Mode v2 mandatory?
Google requires it for advertisers who want to keep using data from users in the EEA for ad personalisation, remarketing and measurement features in its products. It’s not a law in itself; the legal requirement is valid consent under EU and UK rules.
Can I use Google Analytics legally in the EU?
Yes, with valid prior consent, a lawful data transfer basis, and settings that limit data collection. Load it only after the visitor accepts analytics cookies.
Why should I self-host web fonts?
Loading fonts from a third-party server sends each visitor’s IP address to that provider. A German court treated this as a GDPR violation in 2022. Self-hosting avoids the transfer and usually loads faster.
Sources
Related guides.
Incrementality testing: how to prove what your ads really add
Platforms take credit for sales that would have happened anyway. How geo holdouts, branded-search pause tests and conversion lift studies show what your ads really add.
The EU AI Act for marketers: what applies from 2 August 2026, and what the Omnibus delayed
Chatbot disclosure and AI-content labelling apply from 2 August 2026; high-risk rules moved to December 2027. What marketers and agencies must do now.
SEO for AI search in 2026: how to get cited by ChatGPT, Gemini and Google AI Mode
AI answers now sit above the blue links. What the 2026 evidence says about clicks, which AI crawlers to allow, and how to structure pages so AI engines cite you.