Consent Mode and enhanced conversions: a UK checklist

In this guide

What changed in UK cookie law in 2026
Which tags still need consent
Consent Mode v2: four parameters, two modes
Conversion modelling and the 700-click threshold
Enhanced conversions for web and for leads
Checking your setup
A UK marketer’s checklist
FAQ

UK cookie rules changed on 5 February 2026, when a new set of exceptions came into force (legislation.gov.uk, SI 2026/82). Google Ads tags still need opt-in consent. How Consent Mode passes that choice to Google affects how much conversion data Google receives and whether enhanced conversions sends its hashed data. Here’s what changed, what didn’t, and how to check Consent Mode v2 is passing consent to enhanced conversions.

This is practical guidance from a marketer, not legal advice. Check decisions about your own site with a privacy adviser.

Section 112 of the Data (Use and Access) Act 2025 replaces regulation 6 of the Privacy and Electronic Communications Regulations (PECR). Regulation 6 is the rule on storing and accessing information on a user’s device. Section 112 also adds a set of exceptions in a new Schedule A1 (legislation.gov.uk). It came into force on 5 February 2026, along with section 115 and Schedule 13, which cover PECR enforcement powers (SI 2026/82).

The ICO’s guidance on storage and access technologies was last updated on 29 April 2026. It lists five exceptions: communication, strictly necessary, statistical purposes, appearance and emergency assistance. The April update added material on “a simple means of objecting” and on technologies used for more than one purpose (ICO).

PECR enforcement is being aligned with UK GDPR and the Data Protection Act 2018 (ICO). The page doesn’t state a figure, so I won’t either.

The short answer: anything used for advertising.

The statistical-purposes exception

The ICO sets out the conditions (ICO):

Analytics must be the sole purpose, and it must be to improve your own service.
You give users clear information and a free, simple way to object.
A third-party provider may only help you improve your service.
It doesn’t cover tracking individuals or online advertising.

Advertising still needs opt-in

The ICO is direct: “The use of storage and access technologies for online advertising purposes requires consent.” Measuring that advertising is covered by the same consent (ICO).

So a common misreading, that the analytics exception means Google doesn’t need a banner any more, doesn’t hold. Google Ads conversion tags and remarketing are advertising. My reading is that GA4 linked to Google Ads to build audiences needs consent too, because the ICO requires consent for online advertising, and the statistical-purposes exception excludes advertising and tracking individuals.

Google’s own rules point the same way. Its EU user consent policy applies to users in “the European Economic Area, the UK and Switzerland”. It asks you to get valid consent for cookies where the law requires it and for personal data used in ad personalisation, keep records of consent, explain how to withdraw it and identify each party using the data (Google).

Consent Mode is how your banner’s answer reaches Google’s tags. Version 2 uses four parameters: ad_storage, analytics_storage, ad_user_data and ad_personalization. There are also optional settings: url_passthrough, ads_data_redaction and wait_for_update (Google for Developers).

There are two ways to run it (Google for Developers):

	Basic mode	Advanced mode
Tags before the banner choice	Blocked until the user interacts with the banner	Load with defaults set to denied and send cookieless pings
Modelling	A general model	An advertiser-specific model

Advanced mode loads Google’s tags before anyone has made a choice. Whether that fits your reading of the ICO’s advertising guidance is a call for you and your privacy adviser. Recovering more data on its own isn’t a reason to switch it on.

A common fault is timing. If your consent platform sets defaults late, tags may read consent before it exists. Google says defaults must be set before any tag reads consent (Google for Developers).

Conversion modelling and the 700-click threshold

Google’s help page sets a threshold for conversion modelling: 700 ad clicks over 7 days, per domain and country grouping (Google Ads Help).

If your account doesn’t reach that threshold, plan on reporting only the conversions that can be observed, and judge trends with that in mind. A drop in reported conversions after a banner change may come from measurement while demand stays the same. It’s one reason I’d rather judge campaigns on sales than on leads, as I explain in why your best campaign by leads might be your worst by sales.

Enhanced conversions for web and for leads

Enhanced conversions for web

Enhanced conversions for web sends first-party data (email, name, address and phone number) hashed with SHA256. It supplements your existing conversion tags (Google Ads Help).

Enhanced conversions for leads

Google describes enhanced conversions for leads as “an upgraded version of offline conversion import”. The tag hashes lead data when the form is submitted. When that lead later converts, you upload the same hashed data, plus the GCLID (Google click identifier). Web and leads share one on/off setting in the account (Google Ads Help).

The change to check: since 15 June 2026, these uploads go through the Data Manager API and are blocked in the Google Ads API (Google Ads Help). The exception is a developer token that was already sending those requests between January and June 2026 (Google Ads Help). If an older integration uploads leads through the Google Ads API, confirm it qualifies for that exception or has been moved. The wider process is in getting offline sales back into Google Ads.

Where consent comes in

When ad_user_data is denied, enhanced conversions doesn’t send hashed data (Google for Developers). A banner that never updates ad_user_data to granted leaves enhanced conversions without its hashed data, even when everything else looks fine.

Hashing doesn’t settle the privacy question either. My view is that a hashed email is still personal data and should be treated that way. Check that with your privacy adviser. The same question comes up with the Meta Conversions API for lead generation.

Checking your setup

In my own setup, the weekly search term report lists terms that spent without converting, so if consent isn’t passed correctly, that report is working from incomplete data. The tag check comes first.

In Tag Assistant

Google’s debugging guide sets out what to look for (Google for Developers):

Open the site in Tag Assistant and find the Consent tab.
The earliest Consent event should show defaults for all four parameters.
Accept or reject on the banner. The latest Consent event should show the update.
If the Consent tab is empty, Consent Mode isn’t implemented.
Repeat for each region where your banner behaves differently.

In Google Ads

In the Diagnostics view, look for “Consent mode is implemented” or “Consent mode is implemented and modeling is active”. Status updates can take 48 hours or longer (Google Ads Help), so allow 48 hours or more after a change before judging a fix.

A UK marketer’s checklist

Advertising tags (Google Ads conversions, remarketing, GA4 linked to Ads for audiences) only store or access information on the device after opt-in consent.
Anything relying on the statistical-purposes exception meets every one of the ICO’s conditions.
Your banner records consent, explains how to withdraw it and names each party using the data, as Google’s policy asks.
All four Consent Mode parameters have defaults, set before any tag reads consent.
The banner choice updates all four, including ad_user_data and ad_personalization.
You’ve chosen basic or advanced mode deliberately, with your privacy adviser.
Tag Assistant shows default and update Consent events in each region.
Google Ads diagnostics shows Consent Mode as implemented, and you know whether your traffic reaches the 700-click modelling threshold.
Enhanced conversions is on, and ad_user_data is granted when users consent.
Lead uploads go through the Data Manager API, unless your developer token was already sending them through the Google Ads API between January and June 2026.

FAQ

Do I still need a cookie banner for Google Analytics in the UK?

Only for analytics that falls outside the statistical-purposes exception. To qualify, analytics must be the sole purpose and must improve your own service. Users need clear information and a free, simple way to object. A third-party provider may only help you improve your service. The exception doesn’t cover tracking individuals or online advertising (ICO), so, on my reading of the ICO’s advertising guidance, GA4 linked to Google Ads for audiences needs consent. Whether your analytics setup meets the third-party condition is a question for your privacy adviser.

Does Consent Mode collect consent for me?

No. Consent Mode passes the user’s choice to Google’s tags (Google for Developers). Getting valid consent and keeping records is still your job under Google’s policy (Google).

For the wider picture, see my guide to marketing measurement.

14 sources, all opened and checked

Data (Use and Access) Act 2025, section 112, legislation.gov.uk
SI 2026/82, regulation 2 (commencement), legislation.gov.uk
Guidance on the use of storage and access technologies, ICO
What are the exceptions?, ICO
How do the rules apply to online advertising?, ICO
What happens if we don’t comply?, ICO
EU user consent policy, Google
Set up consent mode, Google for Developers
Consent mode overview, Google for Developers
Debug consent mode, Google for Developers
Consent mode and conversion modelling, Google Ads Help
About enhanced conversions, Google Ads Help
About enhanced conversions for leads, Google Ads Help
Offline conversion imports and the Data Manager API, Google Ads Help

What changed in UK cookie law in 2026

Which tags still need consent