Skip to content
2.21Advanced11 min

Consent Mode v2 and Privacy Sandbox: What Remains After 2025

Lucas Blochberger··Updated 11 June 2026
Definition

Google deprecated all 10 Privacy Sandbox APIs on October 17, 2025, while third-party cookies remain in Chrome. Consent Mode v2 is mandatory for all Google Ads services in the EEA/UK since March 2024.

Key Takeaways

  • ✓Privacy Sandbox: All 10 APIs discontinued on October 17, 2025
  • ✓Third-party cookies remain enabled in Chrome
  • ✓CMA tests: 85% attribution inaccuracy, 30% publisher revenue decline
  • ✓Consent Mode v2: Mandatory for Google Ads in EEA/UK since March 2024
  • ✓Four parameters: ad_storage, analytics_storage, ad_user_data, ad_personalization
  • ✓Advanced Consent Mode: 15-25% conversion modeling uplift
  • ✓German TTDSG: Explicit consent required for ALL non-essential cookies

The privacy landscape has simplified dramatically in 2025: Privacy Sandbox is dead, Consent Mode v2 is mandatory.

Privacy Sandbox: End

Google discontinued all 10 remaining Privacy Sandbox APIs on October 17, 2025. CMA tests showed 85 percent attribution inaccuracy and 30 percent publisher revenue decline, fatal flaws after six years of development. Third-party cookies remain active.

Consent Mode v2

Mandatory for all Google Ads Services in EEA/UK since March 2024. Four parameters must be signaled via a Google-certified CMP with IAB TCF. Advanced Consent Mode (load tags before consent, cookieless pings on rejection) enables conversion modeling with 15-25 percent uplift.

DACH-specific

German TTDSG/TDDDG (§25): Explicit prior consent required for all non-essential cookies. Google Tag Manager requires consent before activation. Swiss nDSG: Opt-out principle, cookie banner not mandatory.

Data & Statistics

Einstellung zentraler Privacy-Sandbox-Technologien (u. a. Topics, Protected Audience, Attribution Reporting); Chrome behaelt den bisherigen Umgang mit Third-Party-Cookie-Wahl bei (angekuendigt 17.10.2025)

Google Privacy Sandbox Blog (Anthony Chavez, VP Privacy Sandbox) (2025)

Conversion Modeling im Consent Mode stellt im Schnitt mehr als 70 Prozent der durch fehlende Cookie-Einwilligung verlorenen Ad-Click-to-Conversion-Pfade wieder her

Google Marketing Platform Blog (blog.google) (2021)

Digital-Omnibus-Vorschlag: verpflichtender Single-Click-Reject-Button, zentrale maschinenlesbare Praeferenzsetzung (z. B. Browser) und Wegfall von Consent-Pop-ups fuer nicht risikobehaftete Zwecke (z. B. Besuchszaehlung)

Europaeische Kommission, Shaping Europe's digital future (Digital Package FAQ) (2025)

61 Prozent aller Cookies sind Third-Party (Top 1 Mio.), 77 Prozent bei den Top 1.000; nahezu 100 Prozent der Third-Party-Cookies setzen SameSite=None

HTTP Archive Web Almanac 2024, Cookies (Kapitel 19) (2024)

Bei rechtskonformem Cookie-Banner gehen im Schnitt rund 60 Prozent der Besuchsdaten verloren (entspricht ca. 40 Prozent Zustimmung)

etracker Cookie Consent Benchmark Study 2025 (2025)

Browser-Marktanteil Europa: Chrome rund 60 Prozent, Safari rund 20 Prozent, Edge rund 7 Prozent

StatCounter Global Stats (Browser Market Share Europe) (2026)

8,69 Millionen Internetnutzer in Oesterreich, Internetpenetration 95,3 Prozent (Januar 2025)

DataReportal, Digital 2025: Austria (2025)

Im Referenzjahr 2023 nutzten rund 31 Prozent (30,8 Prozent) der oesterreichischen Unternehmen E-Commerce, mit einem Umsatzanteil von 19,1 Prozent

Statistik Austria, IKT-Einsatz in Unternehmen 2024 (2024)

BVwG-Entscheidung vom 13.08.2025: pauschales Pay-or-Okay-Banner ohne granulare Wahlmoeglichkeit rechtswidrig

ePrivacy Blog (Analyse der BVwG-Entscheidung) (2025)

FAQ

Is Consent Mode v2 mandatory?
Yes. Since March 2024, Consent Mode v2 has been mandatory for all advertisers in the EEA and the UK who use Google Ads features such as remarketing or conversion tracking. Without correctly transmitted consent signals (ad_storage, analytics_storage, ad_user_data, ad_personalization), Google will not deliver personalized ads and will disable remarketing. The signals must be transmitted to Google Tag or Google Tag Manager via a Google-certified Consent Management Platform with IAB TCF.
What is the difference between Basic and Advanced Consent Mode?
In Basic Consent Mode, Google tags only load after consent is given; no data is sent beforehand. In Advanced Consent Mode, tags load from the start and send only anonymous, cookieless signals without personal identifiers when consent is missing. These pings provide the data basis for Conversion Modeling. Advanced Mode thus enables better modeling of lost conversions, but requires sufficient volume.
Does the end of Privacy Sandbox mean third-party cookies will remain?
Yes, for now. On October 17, 2025, Google announced it would discontinue a range of Privacy Sandbox technologies, including Topics, Protected Audience, and the Attribution Reporting API, and maintain the current approach to third-party cookie choice in Chrome. Third-party cookies will therefore not disappear from Chrome in the foreseeable future, and no new separate cookie prompt has been announced. The legal framework under GDPR and ePrivacy remains unaffected.
How many conversions does Conversion Modeling restore?
According to Google, Conversion Modeling in Consent Mode restores on average more than 70 percent of ad-click-to-conversion paths lost due to missing cookie consent. However, Google emphasizes that results depend heavily on consent rate and implementation quality. Expectations should be tempered for low-volume B2B: modeling requires sufficient data volume. Accounts with low click and user volumes often fail to reach the necessary data basis and then receive only coarser modeling.
Is a pay-or-okay banner permitted in Austria?
Not in blanket form. On August 13, 2025, the Austrian Federal Administrative Court ruled that a blanket pay-or-okay banner without granular choice options is unlawful. The court criticized that users could not granularly consent to or reject individual purposes such as advertising, profiling, and analytics. Granular control over processing purposes is therefore a prerequisite for valid consent.
Does server-side tagging replace cookie consent?
No. Server-side tagging (sGTM) shifts tag execution from the browser to a dedicated server, thereby improving data quality, cookie lifetime against ITP, and data control before transmission. However, it only changes the technical architecture, not the legal basis. Anyone measuring server-side without consent violates TKG 2021 and GDPR just as much as with client-side tracking. Consent therefore remains required in any case.
How does the consent setup affect visibility for AI crawlers?
AI crawlers such as GPTBot, ClaudeBot, and PerplexityBot do not give consent and do not click away banners. Content behind a cookie wall or loaded only after consent via JavaScript remains invisible to these systems. Editorial text and specialist content should therefore be in the initial HTML and rendered server-side. Only tracking and marketing tags belong behind consent. This separation of content and measurement ensures visibility in traditional search and in AI answers.

Related Articles

How does your website perform?

Get a free, AI-powered SEO report of your website by email: technical SEO, on-page, keywords & competitors. No obligation.

Get a free SEO audit →
Previous← AI Content and Google: Enforcement and EU AI ActNextPassage Ranking and GEO: Optimal Content Structure for AI Citation →