— Guide

Cookie banners and Google Consent Mode v2: what the law requires in 2026

Which websites need a banner, what a valid one looks like, what the largest fines were for, and what Consent Mode v2 does, which is not the same thing as a banner.

By Level UI9 min read

A cookie banner exists for one reason: in the EU, a website may only store something on a visitor’s device, or read something from it, with the visitor’s consent, unless it is strictly necessary for what the visitor asked for. Google Consent Mode v2 is a separate thing: it passes the visitor’s answer to Google’s tags, and since March 2024 Google has needed it for advertising and measurement on European traffic. This guide explains when you need a banner and when you do not, what regulators have fined companies for, how to set up Consent Mode, and why our own site has no banner at all. It describes the rules as of October 2026 and is not legal advice.

What on a typical website needs consent first

On the siteConsent first?Why
Login session, shopping cart, language choiceNoStrictly necessary for something the visitor asked for
Remembering the visitor’s cookie choiceNoNeeded to respect the choice itself
Google Analytics 4 with cookiesYesAnalytics cookies are not strictly necessary
Google Ads tag, Meta Pixel, LinkedIn Insight TagYesAdvertising cookies and identifiers
Embedded YouTube video or Google MapYes, or load it on clickThe embed sets or reads third-party storage as soon as it loads
Chat widget from a third partyUsually yesMany store an identifier before anyone opens the chat
Analytics on your own server, with no cookie or stored IDNo consent for storageNothing is stored on or read from the device; the GDPR still applies to the data
Fonts loaded from Google’s serversNot a cookie questionNo cookie is set, but each visit sends the visitor’s IP address to Google; host the fonts yourself

A general guide to the rules in October 2026, not legal advice. What a specific tool stores depends on how it is configured; check it in the browser, as described below.

The rule behind every banner

The cookie rule is not, at its core, the GDPR. It is Article 5(3) of the ePrivacy Directive: storing information on a user’s device, or accessing information already there, needs the user’s consent after clear information, except when it is only for transmitting a communication or strictly necessary for a service the user explicitly asked for. It covers cookies, local storage, device identifiers and similar techniques, whether or not the data is personal. Each country writes it into its own law: in Germany it is § 25 of the TDDDG, in Romania Article 4(5) of Law 506/2004. The GDPR comes in through the definition of consent: freely given, specific, informed, unambiguous, and as easy to withdraw as to give.

Do you need one? Not necessarily

If nothing on your site needs consent, you need no banner, and building a site that way is a legitimate choice, not a loophole. Our own site is an example: levelui.com, levelui.de and levelui.ro set no cookies for visitors and load no third-party scripts, so there is nothing to ask about. We count visits with our own analytics on our own server, which stores no cookie and keeps no identifier longer than a day. We do advertise on Google, but we report an enquiry to Google Ads from our server, only after it reaches us and only if the visitor ticked an unticked box on the form to allow it.

Most sites need a banner because of one or two tools, not because of the website itself: analytics with cookies, an advertising pixel, an embedded video. Each of those is a decision. Cookie-free analytics can replace Google Analytics when you do not run ads, and we compare the options in Google Analytics alternatives. Videos and maps can load only when someone clicks them. Fonts can be served from your own server, which is also faster, as our web font guide measured. A privacy notice is still required either way; what goes away is the question.

What a valid banner looks like

Refusing has to take exactly as much effort as accepting: one click, on the first screen. That is the point regulators have enforced hardest. A banner with a bright “Accept all” and refusal hidden behind “Settings” is the classic dark pattern, and the EU data-protection authorities’ cookie banner taskforce agreed in January 2023 that a missing reject option on the first layer is a problem.

The other rules follow from what consent means. Nothing that needs consent may load before the visitor answers, so the tags wait, not just the cookies. Boxes may not be pre-ticked: the EU Court of Justice ruled in the Planet49 case, on 1 October 2019, that a pre-ticked box is not consent. Scrolling or carrying on browsing is not consent either. Each purpose, such as statistics or marketing, needs its own choice. The visitor has to be told who receives what and why, must be able to change their mind as easily as they agreed, usually through a small link or icon that reopens the banner, and you have to be able to show later that consent was given.

What the fines were for

The largest cookie fines are about banners that did not do what they said. On 1 September 2025 France’s CNIL fined Shein €150 million: advertising cookies were placed as soon as a visitor arrived, before any choice, and more were placed and read after visitors clicked to refuse. The same day it fined Google €325 million, partly because refusing advertising cookies when creating a Google account was harder than accepting them until October 2023. In December 2021 it had already fined Google €150 million and Facebook €60 million because refusing cookies took several clicks and accepting took one.

Smaller sites are fined too, at smaller scale. In Germany a breach of § 25 TDDDG can cost up to €300,000, and in Romania the data-protection authority, ANSPDCP, enforces Law 506/2004 against ordinary company websites. A banner bought and installed is not compliance; a banner that actually blocks what it says it blocks is.

Google Consent Mode v2, explained

Consent Mode is not a banner. It is the way your banner tells Google’s tags what the visitor chose, so that Google Analytics and Google Ads behave accordingly. It works with four signals: ad_storage for advertising cookies, analytics_storage for analytics cookies, ad_user_data for sending user data to Google for advertising, and ad_personalization for personalised ads such as remarketing. The last two arrived with version 2 in November 2023.

Since early March 2024, Google has required those signals for visitors in the European Economic Area. An advertiser who sends no consent signals loses its EEA visitors from remarketing audiences and from Google’s measurement features. So a site that runs Google Ads to Europe needs both: a banner that asks, and Consent Mode that passes the answer on.

Basic or advanced Consent Mode

In basic mode, Google’s tags do not load at all until the visitor answers, and if they refuse, nothing is sent to Google, not even the refusal. In advanced mode, the tags load straight away with consent set to denied and send cookieless pings while consent is denied; Google uses them to model the conversions it can no longer observe directly. Google’s own documentation says advanced mode gives an advertiser-specific model, while basic mode relies on a general one, and that modelling only starts once a site sends enough data.

Advanced mode recovers more data, which is why advertisers like it, but those pings still travel from the visitor’s browser to Google before anyone has agreed to anything. Basic mode is the conservative choice, and the one we recommend unless your data-protection adviser has approved advanced. How much modelled data is worth to you depends on your ad spend; we look at that side in Google Ads vs Meta Ads costs.

Choosing and checking a consent platform

Most sites use a consent management platform rather than a home-made banner, and if you advertise with Google, pick one from Google’s list of certified platforms: Cookiebot, Usercentrics, OneTrust, Didomi, iubenda, CookieYes and Complianz, the usual WordPress plugin, are all on it. A certified platform sends the Consent Mode signals for you; the work left is listing every tool on the site under the right purpose and making sure each one actually waits for consent.

Then test it yourself, because a misconfigured platform is the most common way a banner ends up decorative. Open the site in a private window and, before clicking anything, look at the browser’s developer tools: the cookie list should hold only necessary cookies, and the network tab should show no requests to Google Analytics, Google Ads, Meta or other trackers. Click reject, reload, and check again. Finally, give the banner a fixed place in the layout so it does not push the page around when it appears, which counts against Core Web Vitals. It is also the first thing visitors see: in our sample of 20 landing pages, 14 covered part of their first screen with one.

Germany, Romania and what may change

In Germany, the cookie rule has been § 25 of the TDDDG since 14 May 2024, when the TTDSG was renamed without changing its substance. Since 1 April 2025 an ordinance also allows recognised consent management services, which store a visitor’s choices centrally so that sites can read them instead of asking again. They have not made banners disappear. In Romania, Article 4(5) of Law 506/2004 allows storage only after the user has agreed and has been given clear, complete information beforehand, including the purpose.

At EU level, the Commission’s Digital Omnibus proposal of November 2025 would move the cookie rule into the GDPR, require refusal with a single click, stop sites from asking again for six months after a refusal and let browsers send consent signals automatically. As of October 2026 it is still being discussed in the European Parliament’s committees, so none of it applies yet. The safe assumption is that whatever changes will make refusing easier, not harder.

What we recommend

Load less, and the banner shrinks with it, sometimes to nothing. Go through every script on the site and ask whether it earns a consent request. Host fonts yourself, load videos and maps on click, and use cookie-free analytics if you do not advertise. If you do run ads to Europe, use a certified consent platform with Consent Mode v2 in basic mode, test it with the browser as described above, and list the tools in your privacy notice.

We set this up as part of our Google Analytics 4 work, wire Consent Mode to the banner, and check that refusing really blocks the tags. If you would rather need no banner at all, that is a question of how the site is built, which is our web development work.

Sources

Legal texts and Google documentation checked on 10 October 2026. The check of our own sites (no cookies set, no third-party scripts) was made the same day on four pages of each domain.

Was this helpful?
Share this article
Related serviceWeb Design, Development & PlatformsRelated serviceDigital MarketingRelated packageGoogle Analytics 4 SetupRelated packageTechnical Audit

— FAQ

Frequently asked questions

Not sure what your banner actually blocks?

We check which tools load before consent, wire Consent Mode to your banner, and tell you which of them you could drop to need less of a banner.

Start a projectWhatsApp