Not by law, and not everywhere: Google requires advertisers to collect consent from users in the EEA, the UK and Switzerland and send consent signals to Google. Without those signals you lose measurement, remarketing and ad personalization for that traffic. Consent mode is Google's standard way to send them from a website.
Consent mode is a Google feature that tells Google tags whether a visitor agreed to cookies and to the use of their data for ads. It doesn't ask anyone for consent. You still need a consent banner or a consent management platform (CMP), and Google says you are responsible for building a banner that meets regulatory standards.
So the obligation is really about consent, and consent mode is Google's way of passing that consent to its tags.
Who has to send consent signals?
Advertisers with visitors from the European Economic Area, the UK and Switzerland. Google's EU user consent policy covers end users in those three regions. It requires legally valid consent for cookies where the law requires it, and for the collection and use of personal data for ad personalization.
For the EEA, Google's help center is direct: to keep using Google tags for measurement, ad personalization and remarketing, you must collect consent from EEA users and share consent signals with Google.
These requirements are written for those three regions. If you advertise elsewhere, local privacy laws may still require consent, and consent mode can pass it to Google there too.
What happens if you don't use it?
- Ad personalization. Google states that if you don't send consent signals, you will lose ads personalization capabilities.
- Remarketing. When
ad_personalizationis denied, Google says remarketing in Google Ads doesn't receive the data. - Conversion tracking. The
ad_user_dataconsent type is required for measurement such as tag-based conversion tracking and enhanced conversions. - Conversion modeling. Google only models lost conversions if you have implemented consent mode or the IAB Transparency and Consent Framework (TCF v2.0), and you have at least 700 ad clicks over 7 days per country and domain grouping.
In my experience, for any account with European traffic the real decision is not whether to use consent mode, but which version. That is covered in basic vs advanced consent mode, and the setup in GTM is in my consent mode v2 guide.
Does it have to be consent mode?
Not strictly. Google's EU user consent policy doesn't mention consent mode at all: it asks for valid consent, records of that consent and clear information for users. On the Google side, the modeling requirements accept either consent mode or IAB TCF v2.0 as the way your consent choices reach Google tags.
Here's how I handle it: whatever CMP you pick, check that it passes all four consent types (ad_storage, analytics_storage, ad_user_data and ad_personalization) to Google. A banner that only blocks cookies without sending signals leaves you with the downsides above.
Sources
- Google Ads Help: Updates to consent mode for traffic in European Economic Area (EEA) - https://support.google.com/google-ads/answer/13695607?hl=en
- Google: EU user consent policy - https://www.google.com/about/company/user-consent-policy/
- Google Ads Help: Obtain user consent - https://support.google.com/google-ads/answer/14009343
- Google Ads Help: Consent mode reference - https://support.google.com/google-ads/answer/13802165?hl=en
- Google Ads Help: About consent mode modeling - https://support.google.com/google-ads/answer/10548233?hl=en