Consent Mode v2 and GDPR Banners for EU Shopify Stores
What Google's consent mode v2 requires, how Shopify's customer privacy API fits in, and what EU merchants must configure.
Written by Mantas Jurgutis — Founder, Adsify — builds the Google & Meta automation merchants use daily
Editorially reviewed by Adsify Editorial on March 26, 2026 — Reviewed against Shopify, Google Ads and Meta official documentation.
Why consent mode exists
Consent mode is Google's framework for adjusting how its tags, including Google Ads conversion tracking and Analytics, behave based on a visitor's cookie consent choice. Since March 2024, Google requires consent mode v2 for advertisers serving ads to users in the EEA, adding two new consent signals, ad_user_data and ad_personalization, alongside the older ad_storage and analytics_storage signals, per Google's own documentation.
The four consent signals explained
ad_storage governs whether cookies related to advertising can be set. analytics_storage governs analytics cookies. ad_user_data governs whether user data can be sent to Google for advertising purposes at all, and ad_personalization governs whether that data can be used for personalized/remarketing ads specifically. A visitor can grant analytics_storage while denying ad_user_data, for example, which is a common outcome with granular cookie banners.
Basic vs advanced consent mode
In basic consent mode, Google tags don't fire at all until consent is granted. In advanced consent mode, tags fire regardless of consent status but send anonymized, cookieless pings when consent is denied, which Google uses to model conversions statistically rather than measure them directly. Google's documentation notes that advanced consent mode generally produces better-recovered conversion counts through modeling than basic mode, which reports nothing for denied visitors.
How this maps to Shopify
Shopify has its own customer privacy API and built-in cookie banner support, configured under Online Store > Preferences > Customer privacy, or through the checkout's privacy settings for Shopify's own consent banner. When a merchant enables Shopify's customer privacy consent banner, it collects the visitor's choice and exposes it to Web Pixels and apps via Shopify's customer privacy JavaScript API, which apps can then translate into Google's consent mode signals.
Where the wiring can break
Consent mode only works correctly if the signals collected by your cookie banner are actually passed through to Google's tags, whether via Google Tag Manager's consent overview, the Google & YouTube Shopify app's built-in consent handling, or a custom pixel reading Shopify's customer privacy API. If a merchant installs a cookie banner app that never talks to the Google or Meta pixel apps, visitors see a compliant-looking banner while tracking behavior underneath is unchanged, which is a genuine compliance gap, not just a data quality one.
EEA and UK requirements specifically
Google's enforcement of consent mode v2 applies to advertisers with users in the European Economic Area and the UK, and Google Ads has stated that without valid consent signals, features like Enhanced Conversions, remarketing lists, and some conversion modeling would be limited or unavailable for EEA/UK traffic. This means the compliance requirement and the ad performance requirement point in the same direction: proper consent signaling is needed both to follow GDPR and to keep conversion tracking working for European traffic.
Third-party consent management platforms
Many EU merchants use a dedicated Consent Management Platform (CMP) app from the Shopify App Store rather than Shopify's native banner, particularly to support granular category-based consent (necessary, analytics, marketing) required by stricter interpretations of GDPR and ePrivacy in markets like Germany and France. Google maintains a list of certified CMP partners that integrate directly with consent mode; using a certified CMP reduces the risk of the wiring gap described above.
What happens to Meta tracking under GDPR
Meta's Conversions API and Web Pixel are also subject to the same consent requirement in principle: Meta's terms require advertisers to have a lawful basis and, where required by law, obtain consent before using data for advertising purposes for EU users. Meta doesn't have a single named 'consent mode' equivalent to Google's, but reputable Shopify apps for Meta tracking check Shopify's customer privacy API before firing pixel or Conversions API events for EU visitors who haven't consented to marketing.
A worked example of modeled conversions
Assume an EU-facing store gets 1,000 EEA sessions a week and 40% decline marketing cookies under a granular banner. Without consent mode, those 400 sessions produce zero usable Google Ads signal. With advanced consent mode configured correctly, Google can model a portion of the conversions from those denied sessions statistically based on patterns from consented sessions, recovering some visibility into performance that basic consent mode or no consent mode at all would report as a hard zero.
Testing your consent setup
Use your browser's network inspector or Google Tag Manager's built-in consent mode debugging (visible in GTM's Preview mode under the 'Consent' tab) to confirm that denying cookies in your banner actually changes the ad_storage and ad_user_data values sent with subsequent tag calls. If the values stay 'granted' regardless of what you click in the banner, the banner and the tags aren't actually wired together, regardless of how compliant the banner's design looks.
Documentation and audit trail
GDPR compliance isn't only about the technical signal; Shopify's customer privacy settings and most CMP apps log consent choices with a timestamp, which can serve as an audit trail if a regulator or customer asks what consent was recorded for a given visit. Keep this logging enabled rather than only using consent mode as a technical pass-through with no record retained.
Practical setup order for EU merchants
First, enable or install a compliant cookie banner that supports granular categories under Online Store > Preferences (or a certified CMP app). Second, confirm your Google Ads and Meta Shopify apps are configured to read Shopify's customer privacy API for consent state. Third, test with GTM's consent debugging or the platform's own event testing tools with consent both granted and denied. Fourth, monitor Google Ads' consent mode diagnostics, which flags accounts with missing or invalid consent signals for EEA traffic.