Guide · European regulation

GDPR for sites with ads, explained without legalese

If your site receives visits from Europe and shows ads, the GDPR and the cookie rules apply to those visits, even if the company is Brazilian. This guide shows who the law applies to, what valid consent is, how much a mistake costs and what Google requires from those who use AdSense and Ad Manager.

Audit my site now Read the guide

✓Based on the regulation's official text and EDPB guidance
✓Practical examples of what is and is not allowed
✓Reads the site without changing anything

6legal bases for processing personal data

4%of annual worldwide turnover, the ceiling for the highest fines

2018year the GDPR began to apply

3regions in Google's consent policy: EEA, UK and Switzerland

What it is

The European law that decides how people's data can be used

The GDPR is Regulation (EU) 2016/679. It was adopted in April 2016 and began to apply on May 25, 2018 in all European Union countries, and it also applies in the rest of the European Economic Area (Iceland, Liechtenstein and Norway).

The law protects personal data, that is, any information linked to a person who can be identified. For a site, this includes things that seem technical: IP address, cookie identifiers, device IDs and the browsing history used to choose ads.

Whoever decides why and how data is used is the controller. Almost always it is the site owner. Whoever processes data on its behalf, such as an email or hosting tool, is the processor. Ad networks often act as independent controllers for part of the use.

The GDPR goes hand in hand with the ePrivacy Directive (2002/58/EC), which deals specifically with cookies. In practice, the rule is this: setting or reading cookies that are not strictly necessary, such as ad and analytics ones, requires prior consent. And that consent must meet the GDPR standard.

Checklist

What you need to meet

These are the points that the law, European authorities and Google require from a site with ads that receives visitors from the EEA.

Use a Google-certified CMP
Since January 16, 2024, AdSense and Ad Manager require a Google-certified CMP integrated with the IAB TCF to show personalized ads in the EEA. Without one, that traffic can only receive non-personalized or limited ads.
Example
In AdSense, click Privacy & messaging in the sidebar and create the European regulations message, or choose another CMP from Google's list.
Ask for consent before ad cookies
Cookies that are not essential can only be stored after a clear action by the visitor. According to the EDPB, pre-ticked boxes, scrolling or continuing to browse do not count as consent.
Example
Leave all purposes unticked until the person clicks an option.
Make it as easy to refuse and withdraw as to accept
Most European authorities consider a banner without a refuse option on the same layer as the accept button to be a violation. Withdrawing consent later must also be as easy as giving it.
Example
Use Google's 3-button message, which shows Consent, Do not consent and Manage options on the first screen, and a fixed link in the footer to reopen the choices.
4
Send Consent Mode v2 to Google tags
If the site uses Google Analytics or Google Ads, Google requires you to collect consent from EEA visitors and send the ad_user_data and ad_personalization signals. The default command must run before any tag that sends data.
```
gtag('consent', 'default', {
  'ad_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied',
  'analytics_storage': 'denied'
});
```
Say who receives the data
Google's consent policy asks the site to identify each company that may collect or use data because of Google products. It also asks for easy-to-find information on how each one uses that data.
Example
In the privacy policy, include an Advertising partners section with Google and every ad network that runs on the site.
Keep proof of consent
Under the GDPR, the site must be able to prove that consent was given. Google's policy also requires keeping a record of the consents collected.
Example
Check in the CMP dashboard that consent logging is active and how long the records are kept.
Do not block content for people who refuse
The EDPB guidelines say that access to the service should not depend on accepting cookies. A site that hides everything until the visitor clicks accept does not get freely given consent.
Example
People who refuse can still read the article and may see non-personalized or limited ads.
Answer requests within one month
When a visitor asks for access, correction or deletion of their data, the answer should in principle go out within one month, at no cost. If you are unsure about specific cases, check with your legal team.
Example
Put an email address just for privacy requests in the privacy policy.

In practice

Right and wrong

WrongThe first screen only has accept, and refusing is hidden in another menu.
RightThe first screen shows accept and refuse with the same prominence.
WrongThe personalized ads boxes already appear ticked.
RightAd purposes start unticked and only change when the person chooses.
WrongAd and measurement tags fire before the visitor chooses.
RightGoogle tags start with consent denied and wait for the banner's answer.
WrongThe policy is generic text with no partners and only appears on a hidden page.
RightThe privacy policy lists the ad partners and has a link on every page.

Official tools

Certified CMPs and official links

For personalized Google ads in the EEA, the CMP must be on Google's list, and these are the official pages to choose and set one up.

Who it applies to

Your site in Brazil may also be within the GDPR

The law does not look only at where the company is. It looks at where the people whose data is used are.

Companies in the European Union

Every company established in the EU follows the GDPR, no matter where the data is processed or where the servers are.

Companies outside Europe

Article 3 reaches those outside the EU who offer goods or services to people in the EU or monitor their behavior there. Personalized ads and tracking cookies are a clear example of monitoring.

Brazilian site with a European audience

A Portuguese-language blog with visits from Portugal, or an English-language site with traffic from Germany, must treat those visits under European rules, even with a company registration and server in Brazil.

United Kingdom and Switzerland

They have their own laws, similar to the GDPR (the UK GDPR and the Swiss data protection law). For Google, the three territories follow the same consent policy.

Legal bases

The 6 legal bases in Article 6

Every use of personal data needs a legal basis chosen before it starts. For ad cookies, in practice, the basis is consent.

Consent

The person agrees freely and clearly. It is the basis required for non-essential cookies and personalized ads.

Contract

The data is necessary to fulfill a contract with the person, such as delivering an order or maintaining a subscription.

Legal obligation

A law requires keeping or using the data, such as invoices and accounting records.

Vital interests

Protecting the life of the person or another person. Rarely applies to content sites.

Public interest

Tasks in the public interest or in the exercise of official authority. Used by public bodies, almost never by publishers.

Legitimate interest

A real interest of the company that does not override the person's rights, such as site security. It does not replace the consent required for ad cookies.

Valid consent

Free, specific, informed and unambiguous

The GDPR defines consent as a freely given, specific, informed and unambiguous indication of the person's wishes, given by a statement or a clear affirmative action. Each of these words has a practical effect on the cookie banner.

Free means there is a real choice. The decline button must be as visible as the accept one, and declining must not bring any harm. The guidelines of the European Data Protection Board (EDPB) say that blocking content until the person accepts cookies, the so-called cookie wall, does not produce free consent.

Specific and informed means the person knows what each use is for and who the partners receiving the data are. Unambiguous means there was a clear action: pre-ticked boxes, silence, continued browsing or scrolling the page do not count as consent.

Finally, Article 7 requires that withdrawing consent be as easy as giving it. In practice, the site needs a permanent link or button, such as Cookie preferences in the footer, that reopens the options at any time. And the controller must be able to prove that the person consented, which is why the CMP keeps a record of each choice.

Site obligations

What a site with ads needs to have for European visitors

Map what the site collectsList the cookies, tags and ad partners that load on each page. Without this map, the banner and the privacy policy end up incomplete.
Show a consent banner before cookiesUse a CMP that blocks ad and analytics cookies until the person chooses, with accept and reject buttons at the same level.
Publish a clear privacy policyExplain who the controller is, what data is used, for what, on what legal basis, for how long, with which partners and how the person exercises their rights.
Honor people's rightsHave a channel for requests for access, correction, erasure, portability, objection and withdrawal of consent. The response must come without delay, as a rule within one month.
Document and assess risksKeep a record of processing activities. When the use of data poses a high risk, such as large-scale monitoring, carry out an impact assessment (DPIA).
Prepare the incident responseA data breach that poses a risk to people must be reported to the authority within 72 hours after the company becomes aware of it.
Check whether you need an EU representativeCompanies outside the EU that come under the GDPR through Article 3 may have to appoint a representative in the Union. Confirm with your legal team whether your case fits the exceptions.

Enforcement and fines

Who enforces it and what a mistake costs

Each country has its own data protection authority, such as the CNIL in France and the CNPD in Portugal. They receive complaints, investigate and apply sanctions.

Fines of up to 20 million euros or 4%

For the most serious infringements, such as using data without a legal basis or disregarding consent, the ceiling is 20 million euros or 4% of annual worldwide turnover, whichever is higher.

Fines of up to 10 million euros or 2%

For organizational failures, such as not keeping records or not carrying out the impact assessment when required, the ceiling is 10 million euros or 2% of worldwide turnover.

Other measures

The authority can issue a warning, order the banner to be fixed, or limit or prohibit data processing. For an infringement that is only likely, it can issue just a notice.

Criteria for the amount

The fine takes into account the seriousness, the duration, whether there was intent or negligence, what was done to reduce the harm and the level of cooperation with the authority.

Timeline

The dates that most affect a site with ads

From the cookie rule to the requirement for a Google-certified CMP.

2002
ePrivacy Directive
Creates the European rules for cookies and electronic communications, later strengthened to require consent before setting non-essential cookies.
April 27, 2016
GDPR is adopted
Regulation (EU) 2016/679 is approved, with a two-year period for companies to adapt.
May 25, 2018
GDPR takes effect
The rules on consent, rights and fines begin to be applied. In the same month, Google releases updates for publishers and advertisers.
2020
EDPB Guidelines 05/2020
The European board details valid consent: cookie walls, page scrolling and pre-ticked boxes do not qualify.
January 16, 2024
CMP certified by Google
For personalized ads in the EEA and the United Kingdom, AdSense, Ad Manager and AdMob start requiring a CMP certified by Google and integrated with the TCF.
July 31, 2024
Switzerland joins the rule
The requirement of a certified CMP with TCF now also applies to visitors from Switzerland.

AdSense and Ad Manager

What Google requires from those with European visitors

Google's EU user consent policy applies to the EEA, the United Kingdom and Switzerland. It asks for legally valid consent for cookies where the law requires it, consent to use data in personalized ads, identification of all partners that receive data, a record of choices and clear instructions to withdraw consent.

Since January 16, 2024, to receive personalized ads in these regions, the site needs a CMP certified by Google and integrated with the IAB Europe TCF. The Privacy message from AdSense and Ad Manager itself is one of the certified options.

Without a certified CMP, European traffic may be left with only non-personalized or limited ads, which pay less. In the AdSense dashboard, this appears as restricted ad personalization in the EEA, the UK and Switzerland. If the site also uses Google Analytics or Google Ads, Consent Mode carries the banner's choice to those tags.

Google may limit or suspend the use of its products by those who do not comply with the policy. That is why the right banner is both a legal matter and a revenue matter.

In practice

What is and is not allowed in the banner and cookies

Real examples of setups that appear on sites with ads.

Allowed

Accept all and Reject all buttons side by side, with the same size and prominence
Loading essential cookies, such as the cart or login, without asking for consent
Showing the TCF message only to visitors from the EEA, the UK and Switzerland
A Cookie preferences link in the footer that reopens the options at any time
Listing the ad partners on the banner's second layer, with the purpose of each
Offering non-personalized ads to those who decline

Not allowed

Setting ad cookies before the person responds to the banner
Hiding Reject on another screen while Accept stands out
Leaving the purpose boxes already ticked
Treating page scrolling or continued browsing as consent
Blocking all content until the person accepts cookies
Using an ordinary cookie plugin without Google certification for personalized ads

Common errors

Failures that most often appear on Brazilian sites with European traffic

Almost all go unnoticed, because the site keeps working and the ads keep appearing.

Thinking the law does not apply to Brazil

The company is Brazilian, but the visitor is in Portugal. For that visitor, European rules and Google's policy apply.

Banner that only informs

A bar with the text This site uses cookies and an OK button does not ask for consent. The cookies were already set before the click.

Tags loading before the choice

The ad code or Analytics is at the top of the page, above the CMP. Cookies are set in the first seconds, without consent.

Generic privacy policy

Text copied from another site, without mentioning Google, ad partners, legal bases and how to withdraw consent.

No way to change their mind

After the first click, the visitor can no longer find the banner. Withdrawing consent becomes harder than giving it.

European message for the whole world

Showing the TCF to visitors from Brazil or the United States is not required and drops those visitors' revenue for no reason.

In ConsentMode

What the audit checks about the GDPR on your site

Opens the site as a visitor from Europe and as a visitor from outside, and shows in a screenshot where the banner appears and where it does not.
Checks whether ad or analytics cookies are set before any click on the banner.
Identifies the CMP, reads the TCF string and checks whether it is on Google's list of certified CMPs.
Checks whether the reject button is on the first layer and whether there is a link to reopen the preferences.
Reads the privacy policy and points out what is missing: Google, ad partners, cookies and how to withdraw consent.

Run an audit See everything that is checked

Frequently asked questions about the GDPR

My site is Brazilian and written in Portuguese. Does the GDPR apply to me?

It applies to visits coming from Europe when you use ad or tracking cookies on those visitors. For the Brazilian audience, the LGPD applies. That is why the right setup uses regions: European rules for Europeans, local rules for the rest.

Do I need consent for Google Analytics?

In Europe, analytics cookies are not considered strictly necessary, so as a rule they require prior consent. Consent Mode helps respect that choice without losing all measurement.

Can I use legitimate interest for personalized ads?

To set and read ad cookies, the European cookie rule requires consent. In addition, Google asks for consent for personalized ads in the EEA, the UK and Switzerland. In practice, the safe path is consent.

Are cookie walls prohibited?

The EDPB guidelines say that making access to content conditional on accepting cookies does not produce free consent. Some countries are discussing alternative models, such as paying to browse without ads, but this requires legal analysis case by case.

How long is consent valid?

The GDPR does not set a single period. Many authorities recommend asking again after a few months, and the IAB Europe TCF also has its own rules. Check the guidance for your audience's country and your CMP's.

Does ConsentMode replace a lawyer or a CMP?

No. ConsentMode is a read-only audit. It shows what the site does for each type of visitor, with screenshots and a fix plan. The legal decision and the banner remain with your team and your CMP.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

Find out what European visitors see on your site

The audit opens the site as a visitor from Europe, checks the banner, cookies and TCF, and shows exactly what to fix.

Start the audit