- €325m
- CNIL’s September 2025 fine on Google, including for cookie failures
- €150m
- CNIL’s September 2025 fine on Shein for placing trackers without consent
- 4
- Consent Mode v2 signals: ad_storage, analytics_storage, ad_user_data, ad_personalization
Most cookie banners are added the same way: install a plugin or consent platform, pick a design, publish. The banner appears, and everyone assumes the job is done.
Regulators do not look at the banner. They look at what the browser does. In case after case, European authorities have found sites where analytics and advertising tags fired the moment the page loaded, or kept firing after the visitor clicked Reject. The banner was there; the consent was not.
This guide explains what a working banner must do, how to test yours in about ten minutes with nothing but a browser, and how Google Consent Mode v2 fits in if you use Google Analytics or Google Ads.
Key takeaways
- A banner that appears is not the same as a banner that works; regulators test what the browser actually loads.
- In the EU, non-essential trackers must not run until the visitor agrees, and Reject must be as easy as Accept.
- The most common failure is a tag in the page head or tag manager that fires before the banner has loaded.
- Google Consent Mode v2 passes the visitor’s choice to Google tags through four signals, and needs a banner to set them.
- A ten-minute test in three fresh browser sessions (no choice, Reject, Accept) finds most problems.
What must a cookie banner actually do?
In the EU, Article 5(3) of the ePrivacy Directive requires consent before a site stores or reads information on a visitor’s device, unless that is strictly necessary for a service the visitor asked for. The GDPR sets the standard for that consent: freely given, specific, informed and unambiguous, by a clear affirmative action.
The Court of Justice confirmed in Planet49 in 2019 that a pre-ticked box is not consent, and that the rule covers any information stored on the device, whether or not it is personal data. The UK applies the same standard, with some new exceptions since February 2026.
So a working banner does three things. It stops non-essential trackers until the visitor agrees. It offers a real choice, with rejecting as easy as accepting. And it remembers and respects the answer, including when the visitor later changes their mind.
How do regulators check a cookie banner?
European authorities use the same approach you can: they open the site in a clean browser and record what happens. In January 2023 the European Data Protection Board published a report from its cookie banner taskforce setting out common positions. Most authorities agreed that having no Reject option on the first layer breaks the rules, as do pre-ticked boxes and designs that make Accept stand out while Reject is hidden or disguised as a link.
France’s CNIL has been the most active enforcer. In January 2022 it fined Google €150 million and Facebook €60 million because refusing cookies took more clicks than accepting them. In September 2025 it fined Google €325 million and Shein €150 million; the Shein decision was about trackers placed without consent.
The lesson is consistent: what counts is the browser’s behaviour before a choice, after Reject and after Accept.
| Check | Passes when | Common failure |
|---|---|---|
| Before any choice | Only strictly necessary cookies and requests | Analytics or ad tags in the page head fire on load |
| Reject | On the first layer, as visible as Accept | Hidden behind ‘Manage settings’ or styled as a faint link |
| After Reject | No new non-essential cookies or tracking requests | Tag manager ignores the choice; cookies from before stay |
| After Accept | Only the categories accepted are loaded | Accepting analytics also loads ad pixels |
| Withdrawal | A visible way to reopen settings and change the choice | No way back once the banner closes |
Why do so many banners not work?
The banner and the trackers are usually installed separately. Someone adds Google Analytics or a Meta Pixel to the page head, or to a tag manager, and someone else adds a consent tool. Unless the two are connected, the tags load on their own schedule and the banner only records an answer nobody reads.
Modern sites make this worse. Single-page apps, tag managers and consent scripts decide what to load while the page runs, so reading the HTML source does not tell you what fires. A tag that looks blocked in the code can still load through a tag manager trigger, a third-party widget or a script that runs before the consent tool.
AI app builders add another route: ask for analytics and the tag often goes straight into the page head, outside any consent logic.
How do I test my cookie banner in ten minutes?
You need a desktop browser and its developer tools. Run three sessions, each in a new private window so nothing carries over.
Session one, no choice: open developer tools first, then load your home page. Do not touch the banner. Look at Application, then Cookies, and at the Network tab. Note any cookies or requests from analytics or ad vendors, such as google-analytics.com, googletagmanager.com, doubleclick.net, facebook.com/tr, clarity.ms or hotjar.com.
Session two, Reject: load the page, click Reject (or Reject all), then reload and browse two or three pages. Nothing non-essential should appear. Session three, Accept: confirm the tags now load, and only the categories you accepted.
- Test the pages people actually land on, not just the home page: pricing, sign-up and blog posts.
- Test on a phone-sized window too; some banners behave differently on mobile layouts.
- Repeat after every new tag, plugin or embed, not once a year.
SafeLaunch automates this in a real browser: see how the cookie consent test works.
What is Google Consent Mode v2?
Consent Mode is how a site tells Google’s tags what the visitor agreed to. It does not show a banner or collect consent itself; your banner or consent platform must set it. Version 2 has four main signals: ad_storage and analytics_storage, which control whether Google tags can use cookies for ads and analytics, and ad_user_data and ad_personalization, which control whether user data can be sent to Google for advertising and used for personalised ads.
Google’s EU user consent policy requires sites that use its advertising and measurement products to get consent from visitors in the EEA and the UK, and since March 2024 Google has relied on these Consent Mode signals to confirm it. Without them, features such as remarketing and audience building stop working for those visitors.
The rule that matters most: the default for every signal must be set to denied before any Google tag runs. A default set after the tag has loaded is too late, because the tag has already done its work.
| Basic | Advanced | |
|---|---|---|
| Google tags before a choice | Not loaded | Loaded, with signals set to denied |
| Data sent if the visitor rejects | None | Cookieless pings without identifiers |
| Conversion modelling | General model | Model specific to your site |
| Cautious choice for EU traffic | Yes | Get advice first |
Basic or advanced Consent Mode?
In basic mode, Google tags do not load at all until the visitor accepts. That is the easiest to defend: nothing reaches Google from someone who said no.
In advanced mode, tags load immediately with signals denied and send cookieless pings that Google uses to model the conversions you cannot measure. Google designs those pings to work without cookies, but they still send information from the visitor’s browser to Google before any choice. Whether that needs consent under Article 5(3) is debated among European regulators and lawyers.
If most of your traffic is in the EU and you want the lowest risk, use basic mode. If you choose advanced mode for better measurement, take advice for your markets and record why.
Step-by-step setup and testing: Google Consent Mode v2 on SafeLaunch.
Checklist
- Run the three-session browser test: no choice, Reject and Accept.
- Move every analytics and ad tag behind your consent tool, including those in a tag manager.
- Put Reject on the first layer of the banner, as visible as Accept.
- Set all four Consent Mode v2 signals to denied by default, before any Google tag loads.
- Confirm that accepting one category does not load tags from another.
- Add a visible link that reopens cookie settings so visitors can change their mind.
- Save dated screenshots of each passing test as evidence.
- Re-test after every new tag, plugin, embed or site redesign.
FAQs
Is a cookie banner enough to comply with the GDPR?
No. The banner is only the interface. Compliance depends on what loads before and after the choice, and on your privacy notice describing the trackers accurately.
Do I need a Reject all button?
In practice, yes, for EU visitors. European regulators treat a missing first-layer Reject option as a breach when Accept is offered there, and CNIL has fined companies for making refusal harder than acceptance.
Can Google Analytics load before consent if it is anonymised?
Not in the EU, as a rule. IP anonymisation does not change the fact that the tag stores or reads information on the device, which needs consent. The UK has a narrower exception for statistics-only analytics since February 2026, with conditions.
Does Consent Mode v2 make my site compliant?
No. It passes the visitor’s choice to Google’s tags. You still need a banner that collects valid consent, correct defaults, and a test confirming that tags behave as the signals say.
Is Consent Mode v2 required?
If you use Google’s advertising or measurement features with visitors in the EEA or UK and want features such as remarketing to keep working, Google expects these signals. The legal requirement for consent comes from the ePrivacy rules, not from Google.
How often should I test my cookie banner?
After every change that could add a tag: a new plugin, embed, marketing tool or redesign. Otherwise, a quick test each quarter catches tags that marketing tools add on their own.
Primary sources
ePrivacy Directive 2002/58/EC, Article 5(3) (consent for storing or reading device information)Court of Justice of the EU, Planet49 (C-673/17), 1 October 2019: pre-ticked boxes are not consentEDPB, Report of the work undertaken by the Cookie Banner Taskforce (January 2023)CNIL, cookie fines on Google (€325m) and Shein (€150m), 3 September 2025Google, EU user consent policyGoogle for Developers, Set up consent mode on websitesGeneral information, not legal advice.