Open workspace

Guide · European regulation

DMA: why Google started requiring Consent Mode v2

The Digital Markets Act (DMA) is a European rule for large platforms, such as Google. It does not speak to your site directly, but it changed how Google receives consent from European visitors. This guide explains what the DMA is, what it requires of Google and what changes for publishers and advertisers.

Audit my site nowRead the guide
  • ✓Based on the European Commission's official DMA website
  • ✓Explains the link to the ad_user_data and ad_personalization signals
  • ✓Reads the site without changing anything
7companies designated as gatekeepers by the European Commission
8services of Alphabet, Google's owner, on the DMA list
10%of worldwide revenue, cap on fines, or 20% for repeat offenses
2024year gatekeepers began complying with all obligations

What it is

A law for the big digital platforms

The Digital Markets Act (DMA) is Regulation (EU) 2022/1925. It entered into force on November 1, 2022 and became applicable on May 2, 2023.

The goal is to make digital markets fairer and more open. To do that, the DMA creates a list of duties and prohibitions for so-called gatekeepers: very large companies that act as a gateway between businesses and consumers.

The DMA does not replace the GDPR or competition rules. It adds obligations to those that already exist. And, unlike the GDPR, it is not aimed at ordinary sites: the ones who must comply are the gatekeepers.

Even so, the effect reaches any site with Google ads. To comply with the DMA, Google had to change how it receives and uses consent from European visitors, and it passed this requirement on to publishers and advertisers.

Checklist

What you need to meet

The DMA binds gatekeepers, but Google passes on to your site the duty to collect and send consent from EEA visitors.

  1. Ask for consent for Google too

    Google's consent policy requires valid consent for cookies, where the law requires it, and for the use of personal data in personalized ads. This applies to every site that uses Google products with EEA visitors.

    Example

    Google appears in the banner's partner list, with the ad purposes.

  2. Send the four Consent Mode v2 signals

    To keep using measurement, personalized ads and remarketing with EEA visitors, Google asks the site to send the ad_user_data and ad_personalization signals, in addition to ad_storage and analytics_storage.

    Example

    In the CMP, turn on the Consent Mode integration and check that the four signals appear.

  3. Set the default before any tag

    Google asks for the default consent command to run on every page before any command that sends data. That way, nothing goes out before the visitor's choice.

    gtag('consent', 'default', {
  'ad_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied',
  'analytics_storage': 'denied'
});

  4. Use a certified CMP with TCF for ads

    For personalized Google ads in the EEA, the United Kingdom and Switzerland, AdSense and Ad Manager require a Google-certified CMP integrated with the IAB TCF.

  5. Allow the purposes Google needs

    In the TCF, Google needs consent for purposes 1, 3 and 4 for personalized ads and for purpose 1 for non-personalized ads. Without consent for purpose 1, the site should not call Google's ad tag.

    Example

    In the CMP, enable Google as a vendor and mark purposes 1, 3 and 4 as available.

  6. Report consent when sending customer lists

    Since March 2024, EEA customer lists sent to Google Ads must carry both consents as granted. Without them, that data is not used for personalization.

  7. Keep records and explain how to revoke

    Google's policy asks the site to keep a record of consents and give clear instructions for the person to withdraw their choice.

    Example

    A fixed link in the footer, Privacy preferences, reopens the banner.

In practice

Right and wrong

Official tools

Certified CMPs and official links

The DMA has no CMP list of its own, so Google's list of certified CMPs and the official Consent Mode guide apply.

Gatekeepers

Who was designated by the European Commission

Six companies were designated on September 6, 2023. Booking joined in May 2024. In all, the official list has 23 core platform services.

Alphabet (Google)

Search, YouTube, Android, Chrome, Google Play, Google Maps, Google Shopping and the online advertising service.

Meta

Facebook, Instagram, WhatsApp, Messenger and Meta Ads.

Amazon and Apple

Amazon's marketplace and advertising. Apple's App Store, iOS, iPadOS and Safari.

ByteDance, Microsoft and Booking

TikTok, LinkedIn, Windows and Booking's reservations platform.

The consent rule

The DMA point that touches ads

Among the DMA's rules, one directly affects advertising: the gatekeeper cannot process personal data of users who come from third-party services in order to do advertising, nor combine or cross-use data among its services, unless the user has chosen this and given consent within the meaning of the GDPR.

The regulation's recitals explain what this consent must look like. The person must be able to choose freely. Refusing consent cannot be harder than giving it. Withdrawing must be as easy as giving it. And the gatekeeper cannot ask again more than once a year of someone who has already refused.

Anyone who refuses must also have access to a less personalized but equivalent alternative. The service cannot be made conditional on consent.

For Google, this means: when a visitor's data arrives through tags installed on third-party sites and apps, such as those for Google Ads, Analytics, AdSense and Ad Manager, Google needs to know whether that European visitor consented. This is where the new Consent Mode signals come in.

Timeline

From the regulation to Google's new signals

The dates that explain why 2024 was the year of change.

  1. November 1, 2022

    DMA enters into force

    Regulation (EU) 2022/1925 officially comes into existence.

  2. May 2, 2023

    DMA becomes applicable

    Companies that reach the thresholds have two months to notify the Commission.

  3. September 6, 2023

    Gatekeepers designated

    Alphabet, Amazon, Apple, ByteDance, Meta and Microsoft are designated, with up to six months to comply with the obligations.

  4. October 2023

    Google notifies developers

    Google publishes changes to ad APIs to support the DMA, with a consent object for conversions and customer lists.

  5. January 16, 2024

    Certified CMP for publishers

    AdSense, Ad Manager and AdMob start requiring a Google-certified CMP integrated with the TCF for personalized ads in the EEA and the United Kingdom.

  6. March 7, 2024

    DMA obligations apply in full

    Gatekeepers must comply with all obligations. Google reinforces the EU consent policy and customer lists without consent start losing reach.

Consent Mode v2

The two signals that were born to meet the DMA

Before 2024, Consent Mode had two main signals: ad_storage, for ad cookies, and analytics_storage, for measurement cookies. They said whether the browser could store cookies, but not whether the person agreed to their data being used by Google for advertising.

Version 2 brought two new signals. The ad_user_data signal says whether the visitor's data can be sent to Google for online advertising purposes. The ad_personalization signal says whether the person accepts personalized ads, such as remarketing.

With these signals, Google can prove that it has the consent the DMA requires to use the data that arrives through the tags. Without them, Google stops using EEA visitors' data to build audiences, do remarketing and personalize ads.

Consent Mode is not a banner. The CMP is what asks the visitor. Consent Mode only carries the answer to Google's tags.

What changes for each side

Publishers and advertisers feel the DMA in different ways

The same European visitor goes through both sides: the site that shows the ad and the advertiser's site that measures the conversion.

Publishers (AdSense and Ad Manager)

The main signal for ads is the TCF string sent by a Google-certified CMP.

  • The certified CMP already carries consent to Google through the TCF
  • Those who refuse can still receive non-personalized or limited ads
  • Consent Mode completes the setup when the site uses Analytics
  • Without a certified CMP, EEA traffic loses personalized ads
  • A badly configured banner drags down European revenue
  • Restricted personalization shows up in the AdSense dashboard

Advertisers (Google Ads and Analytics)

The main signal is Consent Mode v2, with the four parameters.

  • With advanced mode, Google models conversions from people who refused
  • Audiences and remarketing continue for those who accepted
  • Conversion and list uploads carry consent along with them
  • Without ad_user_data and ad_personalization, you lose remarketing and audiences in the EEA
  • Customer lists without consent lose reach
  • Conversion measurement becomes incomplete

Enforcement

DMA penalties, which fall on gatekeepers

The European Commission is the one who enforces the DMA. The fines are for gatekeepers, but the pressure reaches partners, who need to send the right signals.

Fine of up to 10%

Of the company's total annual worldwide revenue for non-compliance.

Up to 20% for repeat offenses

For repeated infringements, the cap doubles.

Daily fines

Periodic payments of up to 5% of average daily revenue to force compliance.

Compliance reports

Gatekeepers submit reports and an audited description of their consumer profiling techniques.

What to do

How to get your site ready for the DMA

  1. Use a Google-certified CMPFor publishers with traffic from the EEA, the United Kingdom or Switzerland, it is the requirement for personalized ads. The Privacy & messaging tool in AdSense and Ad Manager is one of the options.
  2. Turn on Consent Mode v2 in the CMPCheck that the CMP sends the four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization.
  3. Set the default before the tagsThe default consent command must come at the top of the page, before gtag.js, Google Tag Manager and the ad code.
  4. Use regionsDeny by default where the law requires prior consent and keep it granted in the rest of the world, if local law allows.
  5. Check data uploadsIf you send offline conversions or customer lists to Google Ads, include the consent with them or complete the confirmation asked for in the interface.
Example of a denied default for some regions (the full list has every EEA country, plus the United Kingdom and Switzerland)
gtag('consent', 'default', {
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  analytics_storage: 'denied',
  region: ['AT', 'BE', 'DE', 'ES', 'FR', 'IT', 'PT', 'GB', 'CH'],
  wait_for_update: 500
});

Common errors

What shows up most on sites after the DMA

All of these errors leave the banner looking like it works, but Google receives the wrong signal.

Consent Mode v1 still on the site

The site sends ad_storage and analytics_storage, but not ad_user_data and ad_personalization. For Google, the consent required for ads is missing.

Signals sent after the tags

The CMP loads after the ad code. The first requests go out with no consent signal at all.

Opt-out that does not reach Google

The visitor refuses in the banner, but the update is not sent. The tags carry on as if nothing had changed.

Everything denied worldwide

The denied default applies to every country. Visitors from Brazil and the US lose ads unnecessarily.

In ConsentMode

What the audit checks about the DMA and Consent Mode

  • Opens the site as an EEA visitor and reads the consent commands in the page code, in the order they appear.
  • Checks that the four signals are present in the default and in the update after the choice.
  • Identifies the CMP, reads the TCF string and checks whether the CMP is on Google's list of certified CMPs.
  • Compares the European visit with the visit from outside Europe to see whether the regions are right.
  • Shows where to fix it, with a screenshot and the path in the CMP, Google Tag Manager or WordPress.
Run an auditSee everything that is checked

Frequently asked questions about the DMA

Does the DMA apply to my site?

Not directly. The DMA is for gatekeepers, such as Alphabet. But, to comply with the DMA, Google requires publishers and advertisers to send the consent of European visitors. In practice, anyone who uses Google products feels the effect.

What is the difference between the DMA and the GDPR?

The GDPR protects personal data and applies to any company that processes data of people in Europe. The DMA regulates the behavior of large platforms in the market. The DMA uses the GDPR's definition of consent.

My audience is only Brazilian. Do I need Consent Mode v2?

For visitors from Brazil, Google does not require it. If you have visitors from the EEA, the requirement applies to them. Use regions so you do not deny consent in Brazil.

Is Consent Mode v2 the same thing as the TCF?

No. The TCF is the IAB Europe standard that certified CMPs use to pass consent to all ad partners. Consent Mode is how Google receives the choice in its own tags. A certified CMP usually takes care of both.

Do the new signals drag down revenue?

Not by themselves. What reduces revenue is not sending the signals, or denying everything worldwide. With the right signals and well-defined regions, people who accept still get personalized ads.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

Check whether your site sends the signals Google expects

The audit reads the consent commands, the CMP and the TCF as a European visitor and shows what to fix.

Start the audit