Cookie banner and Consent Mode v2: what a business website needs in 2026
What a cookie banner on a business website must have, how Consent Mode v2 works, how to check that GA4 and pixels don’t load before consent, and what to avoid.
A cookie banner is often treated as a plugin to install and forget. Then it turns out that Google Analytics loads before anyone has clicked “Accept”, and the reject button is hidden in the settings. How do you set it up so that it is correct and doesn’t break your measurement?
This is practical advice, not legal advice. I describe what I check myself on business websites and how to configure it. If you have doubts about the regulations, ask a lawyer.
The legal basis in brief
In Poland, the rules on storing and reading information on a user’s device (which includes cookies) are set out in Art. 399 of the Electronic Communications Law (Prawo komunikacji elektronicznej), which has applied since 10 November 2024. It replaced the former Art. 173 of the Telecommunications Law (Prawo telekomunikacyjne). If someone online still cites Art. 173, their text is out of date.
The rule is simple: consent from the visitor is needed to store and read things that are not essential for the website to work (analytics, advertising pixels, some embedded services). Essential files, for example a shopping cart in a store or a login session, do not require it.
What a good banner must have
This is the list I use in my implementations:
- A “Reject” button visible right away, just as easy to click as “Accept”. The same size, the same layer, not hidden in a second step.
- No pre-ticked consents. The analytics and advertising toggles are off by default.
- A split by purpose: essential, analytics, advertising. People can agree to one and reject another.
- Plain language: what a given purpose does and who collects the data.
- A link to the privacy policy and to the list of cookies in use.
- The ability to change the decision: a permanent button or a link in the footer (“Cookie settings”) that reopens the banner.
- Remembering the choice, so that the banner doesn’t pop up on every subpage.
The fact that a banner can be closed with an X or by scrolling the page is not consent. Consent is a clear action, that is, a click.
Scripts must not start before consent
The most common mistake I see: there is a banner, but the Google Analytics 4 code, the Facebook pixel or the Google Ads tag load right after you enter the website. The banner is then just decoration.
Correctly, it works like this: until consent is given, analytics and advertising scripts are neither downloaded nor run. After a click on “Accept”, the banner runs the appropriate tags. The most convenient way to manage this is through Google Tag Manager, which reads the consent state.
Consent Mode v2: what it is about
Consent Mode is a Google mechanism that passes to tags information about what the visitor has agreed to. In v2 there are four parameters:
ad_storage: storing advertising data,analytics_storage: storing analytics data,ad_user_data: passing user data to Google for advertising purposes,ad_personalization: ad personalization and remarketing.
In Google Ads help, Google writes that in the European Economic Area, using audience lists and conversion measurement requires passing these signals. In practice: if you run Google Ads and don’t have Consent Mode v2, you may lose measurement and remarketing.
If you advertise your business, it is worth keeping this in mind together with conversion setup. I do it as part of the Analytics and tags service, together with the consent banner.
Basic and advanced mode
Consent Mode works in two variants:
| Feature | Basic mode | Advanced mode |
|---|---|---|
| Google tags before consent | Don’t load | Load, but without storing cookies |
| Data without consent | None | Pings without cookies are sent |
| Modeling of missing data | Google’s general model | A model fitted to your account |
| Risk | Lower, but less data | Requires careful assessment and configuration |
For a small business I usually start with basic mode: it is easier to defend and easier to explain that nothing happens before consent. Advanced mode makes sense when your campaigns are bigger and you need modeling. It is worth consulting the choice with the person responsible for GDPR in your company.
How to check your website in 5 minutes
This is a test you can do yourself:
- Open the website in an incognito window so that you have no saved consents.
- Press F12 and go to the Network tab. Refresh the page, without clicking anything in the banner.
- Type
google-analytics,googletagmanager,facebookanddoubleclickinto the filter. If you see requests to these addresses before you click in the banner, the scripts are loading too early. - Go to the Application tab, then Cookies. Before consent there should be no files such as
_gaor_fbp. - Click “Reject” and check the same things. Then click “Accept” and see whether the scripts start only then.
To check whether Google tags are receiving the right consent signals, you can use preview mode in Google Tag Manager and the Google Tag Assistant tool.
If you prefer a quick review of the whole website, run my free Check your website. It checks speed, SEO, security, accessibility and AI visibility, so you will also catch other problems that affect customer trust.
The most common mistakes
- A banner without script blocking. It looks good, but it blocks nothing.
- “Accept” as the only visible button, with rejection in a submenu.
- Pre-ticked boxes for analytics and advertising.
- No Consent Mode v2 with Google Ads campaigns.
- Embedded maps, videos and chats that store data before consent. They can usually be loaded only after a click.
- An outdated cookie policy that doesn’t list the tools that actually run.
- No way to change consent after the banner is closed.
What may change: the Digital Omnibus
At EU level, work is under way on the Digital Omnibus package, which is also meant to include changes to the rules on cookies and consent. The Council of the EU is working on this topic. As of 14 October 2026, I treat it as a change in progress, not as binding law. Until anything enters into force, I stick to the current rules. When something changes, I will update this guide.
Summary
A good banner is one where rejecting is as easy as accepting, nothing is pre-ticked, and scripts load only after consent. On top of that comes Consent Mode v2, if you use Google Ads. You can check all this yourself in the browser in a few minutes.
If you prefer that I review your website and set up the banner, GA4 and conversions, write to me. I will handle it as part of Analytics and tags. I reply within 24 hours.
Frequently asked questions
A banner is needed when the website stores files or scripts on the visitor’s device that are not essential for it to work, for example analytics, advertising pixels, or maps and videos from external services. If you use only essential files, consent is not required, but it is worth mentioning this in your privacy policy. If in doubt, consult a lawyer.
Ads won’t switch off overnight, but in the EEA Google requires consent signals passed through Consent Mode v2 in order to use audience lists and conversion measurement. Without it, measurement and remarketing may be limited. Always check the details in Google Ads help.
A plugin may be enough if it is configured well: it blocks scripts until consent is given, has a reject button and passes signals to Google. Installing it alone is not enough, because many plugins block nothing by default. Always check how it works in your browser’s developer tools.
Under Polish electronic communications law, storing and reading information on a user’s device usually requires consent, except for files necessary to provide the service. Analytics is usually not considered necessary. This is, however, a topic for a lawyer if you have doubts.
These are proposed changes at EU level that are still going through the legislative process. Until they enter into force, the current rules apply. It is worth following announcements from UODO (Urząd Ochrony Danych Osobowych, Poland’s data protection authority) and the European Commission.
Related services
Have a similar project?
Describe what you need and I’ll send a quote within 24 hours. New clients get 20% off their first project.
