Audit your Consent Mode v2 setup before enforcement begins
Google said it would enforce its EU user consent policy starting in March. A five-point audit of banner, defaults, signals and audiences for EEA traffic.
Google has said it will tighten enforcement of its EU User Consent Policy for traffic from the European Economic Area starting in March 2024. It has not published a specific day. If you run remarketing or rely on conversion measurement for EEA users, the sensible assumption is that the change can reach you at any point this month, so the time to check your setup is now.
The work is mostly plumbing. Below is an order of operations we would use, from the cheapest check to the most involved.
Know what actually changed
Consent Mode v2 adds two parameters to the existing pair of ad_storage and analytics_storage: ad_user_data, which covers sending user data to Google for advertising purposes, and ad_personalization, which covers personalized advertising such as remarketing. Google's Tag Manager documentation says that for EEA customers still on version 1, values for ad_storage are copied to ad_user_data automatically starting in March 2024. That mapping is one-time, and ad_personalization is not mapped, so audience features need a real v2 implementation.
Step 1. Decide whether this applies to you
If you advertise in the EEA and use Google's measurement, remarketing or personalization, it applies. Search Engine Journal's summary of Google's guidance adds that UK organizations advertising in the EEA need the update as well. If you advertise only outside the region, you can stop here and note it down so the question does not come back.
Step 2. Check the banner and the defaults
Open your site from an EEA location, or with a region override, in a clean browser profile. Confirm that:
- The banner appears before any advertising tag fires, and the choices it offers match the four consent types.
- Your default state is set before any config or event command. Google's developer documentation warns that consent code called out of order means defaults will not work.
- A user's choice is stored by you and reapplied on later pages, because consent mode itself does not store choices.
- If your banner loads asynchronously, you use wait_for_update so tags do not fire before the user's earlier choice arrives.
Step 3. Confirm the signals reach the tags
Check that your consent management platform sends all four parameters, not just the two older ones. Then check that Google tags, including the Google Ads tag and GA4, read them. Test the denied path as well as the granted one. A setup that works only when the user accepts everything is the most common failure we would expect to find, since teams usually test the happy path.
Step 4. Look at audiences and conversions after the change
Google's guidance says that advertisers who do not share consent signals risk losing personalized and remarketing features for EEA users. Record the current size of your EEA remarketing lists and your daily EEA conversion counts today. Compare them weekly for the next month. A sudden fall in list growth or in recorded conversions is your cue to recheck steps 2 and 3, not to change bids.
Users who deny consent limit what can be measured, so expect the region to look less complete than before. Plan for that. Keep a separate EEA line in your reporting rather than blending it into global figures, so that a drop in recorded conversions is not mistaken for a drop in demand.
Step 5. Brief the people who will ask
Finance, legal and the regional team should know that a reporting dip in the EEA might be a consent artifact. Agree beforehand who owns the banner, who owns the tags, and who signs off on changes. Google's guidance also recommends working with a certified consent management platform, so confirm yours is on that list.
One more place defaults go wrong is region handling. Google's documentation says a default command can carry a list of region codes, that a default without a region applies to every visitor not covered by another regional default, and that the most specific region wins. If you set a permissive global default and forget a region override, EEA visitors can be treated as if they had already agreed. Test with a visitor from a country inside the EEA and one outside it, and compare what each one's tags do.
Practical takeaway
Run the clean-profile test this week, record your EEA baselines today, and treat any decline as a signal to audit before you touch budgets. The audit takes a few hours. Finding out from a missing audience in April takes much longer.