Cookie Consent

Cookie consent is the legal requirement to obtain a user's permission before storing or accessing cookies and similar tracking technologies on their device. It is mandated by regulations like GDPR (EU), ePrivacy Directive (EU), CCPA/CPRA (California), and LGPD (Brazil), each with different requirements for how consent must be obtained and managed.

Category: Analytics (also: Privacy)

Author: Atomic Glue Analytics Team

## Definition

Cookie consent refers to the process of obtaining, recording, and managing a user's permission to place cookies and similar tracking technologies on their device. Regulations like the EU's General Data Protection Regulation (GDPR) and ePrivacy Directive require that non-essential cookies (those used for analytics, advertising, personalization) can only be dropped after the user gives informed, explicit, and freely given consent. Essential cookies (those needed for basic site functionality, like session cookies or shopping cart cookies) are exempt from consent requirements. The consent mechanism must be: informed (users must understand what they are consenting to), specific (separate toggles for different purposes), unambiguous (pre-ticked checkboxes do not count), and revocable (users must be able to withdraw consent as easily as they gave it). Cookie consent is enforced through cookie consent management platforms (CMPs) like Cookiebot, OneTrust, CookieYes, and Usercentrics.

## GDPR consent requirements

Under GDPR, analytics and marketing cookies require 'prior informed consent.' This means the cookie banner must appear before any non-essential cookies are dropped. Consent must be granular (separate toggles for analytics vs marketing vs functional). No 'cookie walls' that block all access if the user refuses. The user must be able to withdraw consent as easily as they gave it. Consent records must be stored and auditable. The penalty for non-compliance can reach 4% of annual global turnover or 20 million Euros, whichever is higher.

## Consent management platforms (CMPs)

A CMP is a third-party service that provides a cookie banner, manages user preferences, stores consent records, and integrates with your tag management system to block or allow tags based on consent status. Most CMPs integrate with Google Tag Manager via the Consent Mode API, which lets tags respect consent choices automatically. When a user declines analytics cookies, the CMP blocks GA4 from firing. When they later accept, the CMP unblocks GA4. Consent records are stored with timestamps and can be exported for compliance audits.

## Google Consent Mode

Google Consent Mode (v2, released 2023) is a framework that adjusts how Google tags (GA4, Google Ads, Floodlight) behave based on user consent status. When consent is denied, tags behave differently depending on the configuration: they may send cookieless pings (modeled data), send basic analytics without cookies, or not fire at all. Consent Mode v2 added consent checks for ad_user_data and ad_personalization, required for continued use of Google Advertising products in EEA markets.

## Note

Misconception: you only need cookie consent if you are based in the EU. GDPR applies to any site that has visitors from the EU, regardless of where the business is based. CCPA applies to businesses serving California residents above certain revenue thresholds. Many countries (Brazil, South Africa, Japan, South Korea) have similar privacy laws. Cookie consent is a global requirement, not a regional one. Another misconception: cookie consent only applies to cookies. It applies to any form of tracking technology including localStorage, fingerprinting, pixels, and SDKs.

## In code

// Google Consent Mode v2 consent defaults (set before GTM loads)
gtag('consent', 'default', {
  analytics_storage: 'denied',
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  functionality_storage: 'granted',
  security_storage: 'granted',
  wait_for_update: 500 // ms to wait for CMP to load
});

// Update consent when user makes a choice
gtag('consent', 'update', {
  analytics_storage: 'granted',
  ad_storage: 'granted',
  ad_user_data: 'granted',
  ad_personalization: 'denied'
});

## Common questions

Q: Do I need a cookie banner if I don't use any cookies?

A: If you truly use no cookies, localStorage, fingerprinting, or tracking technologies, you likely do not need a banner. However, most sites use at least session cookies (which are essential and exempt) or hosting infrastructure that sets cookies. Verify carefully.

Q: What happens if I ignore cookie consent requirements?

A: Enforcement varies by jurisdiction. Maximum GDPR fines are 4% of global annual turnover. CCPA has lower fines but includes a private right of action for data breaches. Regulatory action, lawsuits, and reputational damage are real risks. Many companies have received fines in the tens of millions.

Q: Can I use Google Analytics without cookie consent?

A: In the EU, no. GA4 sets first-party cookies (if cookieless measurement is not configured) and sends user data to Google servers. This requires user consent under GDPR. Using GA4's cookieless measurement features reduces but does not eliminate consent requirements.

## Key takeaways

• Cookie consent is a legal requirement under GDPR, ePrivacy, CCPA, and other regulations
• Non-essential cookies need prior, informed, and specific consent
• Consent Management Platforms (CMPs) automate compliance and integrate with GTM
• Google Consent Mode v2 adjusts tag behavior based on consent state
• Requirements apply based on visitor location, not business location

## Related entries

• [Cookie Deprecation](atomicglue.co/glossary/cookie-deprecation)
• [First-Party Data](atomicglue.co/glossary/first-party-data)
• [Server-Side Tracking](atomicglue.co/glossary/server-side-tracking)
• [Google Analytics 4 (GA4)](atomicglue.co/glossary/google-analytics-4-ga4)

Last updated July 2026. Permalink: atomicglue.co/glossary/cookie-consent