GDPR and Ad Tracking in the EU: What Needs Consent

This post covers the legal side of ad tracking in Europe: which rules apply, what needs consent and what Google expects from you. For how Google models the conversions you lose to declined consent, read our Consent Mode v2 guide. This is not legal advice. Your privacy policy and consent wording are for your lawyer or data protection officer.

Which laws apply to ad tracking in Europe?

Two sets of rules apply, and they do different jobs.

• The ePrivacy Directive covers storing or reading information on a visitor’s device, which is what cookies and tracking pixels do. Article 5(3) requires consent for it unless the storage is strictly necessary for a service the visitor asked for (ePrivacy Directive 2002/58/EC). Each EU country writes this into its own law.
• The GDPR covers what you do with personal data once you have it: the legal basis, how long you keep it, who you share it with (Regulation (EU) 2016/679).

Advertising cookies are not strictly necessary, so in practice they need consent before they’re set. National regulators enforce this. France’s CNIL, for example, says operators “must not read or write any data” on users’ devices before they have consent, and that scrolling doesn’t count as consent (CNIL).

The UK left the EU but kept the same structure: UK GDPR for personal data and PECR for cookies.

What does Google require from advertisers in the EEA?

Google’s EU user consent policy covers visitors in the EEA, the UK and Switzerland. It asks you to get consent for cookies where the law requires it and for the use of personal data to personalize ads, to keep records of that consent, and to tell visitors how to withdraw it (Google, EU user consent policy).

For EEA traffic, Google also requires you to pass those consent choices to its tags. Without consent signals, measurement, ad personalization and remarketing features are limited, and the same applies to Google Analytics data you use in Google Ads (Google Ads Help, consent mode for EEA traffic). Consent Mode is how you pass the signals: four settings, ad_storage, analytics_storage, ad_user_data and ad_personalization, that your banner sets to granted or denied (Google, consent mode reference).

What this means for your account:

• No consent signals: remarketing lists stop growing from EEA visitors and conversion measurement gets weaker.
• Signals set, visitor declines: tags respect the choice, and in advanced mode Google can still model some conversions.
• Signals set, visitor accepts: full measurement and personalization.

Does the Meta pixel need consent?

Yes, under the same ePrivacy rule. The Meta pixel sets and reads cookies, so in the EU and UK it should only load after the visitor agrees to marketing cookies. Meta’s own documentation describes a consent call for this: fbq('consent', 'revoke') on every page pauses the pixel, and fbq('consent', 'grant') resumes it once the visitor agrees (Meta for Developers, GDPR). Unlike Google’s advanced Consent Mode, there’s no cookieless modeling for visitors who decline, so the pixel either runs with consent or doesn’t. Server-side events through the Conversions API need a lawful basis too, and the usual approach is to send them only for visitors who consented. Our Meta CAPI setup guide covers the technical side.

Does server-side tracking get around consent?

No. Server-side tracking moves the step where data is sent to Google or Meta from the visitor’s browser to a server you control. It still relies on cookies or identifiers in the browser, so the ePrivacy consent rule still applies, and the data is still personal data under the GDPR.

What server-side tracking does give you is control. You decide which fields leave your server, you can strip IP addresses or other details before forwarding, and fewer events are lost to ad blockers and browser limits for visitors who did consent. TAGGRS, for example, runs server containers on EU servers. Our comparison of TAGGRS and self-hosted server-side GTM goes into the trade-offs.

Can you send EU visitor data to US ad platforms?

Google and Meta are US companies, so tracking data from EU visitors usually leaves the EU. Since the European Commission adopted its adequacy decision for the EU-US Data Privacy Framework, personal data “can flow freely from the EU to companies in the United States that participate in the Data Privacy Framework” (European Commission). Check whether each vendor you use is certified, and name them in your privacy policy.

A setup that holds up

1. Use a consent banner that blocks marketing and analytics tags until the visitor chooses, with “reject” as easy as “accept”.
2. Connect it to Consent Mode v2, so every Google tag reads the visitor’s choice. Default to denied for EEA and UK visitors.
3. Gate non-Google tags, such as the Meta pixel, LinkedIn and TikTok, on marketing consent.
4. Send server-side events only for consented visitors, and strip fields you don’t need.
5. Check it works. In Google Ads, the conversion diagnostics show whether consent signals arrive. In your browser, decline cookies and confirm no ad cookies are set.

We build this as part of conversion tracking setup, and it’s the first thing we check for businesses advertising in the UK and EU.

FAQ

Is Google Analytics legal in the EU?

It can be, with consent for analytics cookies, a correct privacy policy and a lawful basis for the transfer to the US. Since the EU-US Data Privacy Framework, transfers to certified US companies don’t need extra mechanisms. Ask your lawyer whether your setup meets your country’s rules.

Do I need consent for conversion tracking?

In the EU and the UK, yes, if the conversion tag sets or reads cookies, which Google Ads and Meta tags do. Consent Mode’s advanced setting lets Google tags send cookieless pings without consent, which Google uses for modeling. Some EU regulators question whether those pings are allowed without consent, so ask your lawyer before choosing advanced over basic mode.

What happens if I run ads in the EU without Consent Mode?

Google limits measurement, remarketing and ad personalization for EEA traffic when your tags don’t pass consent signals. Your campaigns keep running, but they learn from less data.

Does the cookie law apply to B2B websites?

Yes. The ePrivacy rules are about storing information on a device, not about who the visitor works for. A business visitor’s consent is needed the same way.