Your cookie banner looks fine.
It isn't working.
Most consent problems aren't missing banners — they're banners that don't block anything. We make consent actually enforce, wire up Consent Mode v2, and prove it with a before/after scan.
Misconfiguration, not absence
We scanned private UK clinics for pre-consent tracking. The pattern was unambiguous:
fired Google trackers before consent
of those already had a CMP
had Consent Mode v2 configured
When consent is wrong, Google receives fewer conversions than actually happened. Smart Bidding then optimises on incomplete data — spending your budget against a distorted picture of what converts. Consent Mode v2 lets Google model the gap.
Since 5 Feb 2026, the maximum UK cookie fine is £17.5m or 4% of turnover — up from £500k. The ICO has named online tracking an enforcement priority.
A consent layer that enforces — and proves it
CMP audit & repair
We check whether your Cookiebot, OneTrust, Complianz or Borlabs banner actually blocks tags before consent — most don't. We fix the enforcement, not just the look.
Consent Mode v2 signals
The two new required signals — ad_user_data and ad_personalization — wired into GTM alongside analytics_storage and ad_storage, with correct default and update states.
Pre-consent leak elimination
Every _ga, _gcl_au, _fbp and network hit that fires before a click gets traced to its tag and gated behind consent.
Advanced vs Basic mode
We pick the right mode for your risk appetite and wire conversion modelling so Google can recover the conversions consent legitimately hides.
Red → green proof
A before/after re-scan diff shows exactly what fired pre-consent before, and that nothing does after. Evidence, not assurances.
Documentation & handover
Your dev team gets a plain-language runbook of what changed in the container and why, with version rollback in place.
A correct fix usually cuts measured traffic and conversions by 15–40% — because you were counting data you legally shouldn't have. We set that expectation before we touch anything, then recover the signal with Consent Mode modelling and, later, server-side GTM. Flattering numbers aren't the goal. Decisions you can trust are.
Four steps, fully reversible
- 1
Free scan
Run your domain through our checker (or we do). We capture what fires before consent, your CMP fingerprint, and your AW / G / GTM IDs.
- 2
Diagnosis call
We walk the evidence together and set expectations — including the honest 15–40% measured-conversion drop a correct fix causes.
- 3
Implementation
GTM-side changes in a dedicated workspace with version rollback: consent-init tag, per-tag consent settings, CMP dataLayer wiring. Page-level gtag/pixel removals where the API can't reach.
- 4
Verify & hand over
Post-fix re-scan proves zero pre-consent leaks and correct Consent Mode v2 signalling. You get the runbook and the diff.
Consent Mode v2, answered
The Data (Use and Access) Act raised the maximum PECR/cookie penalty from £500k to £17.5m or 4% of global turnover — aligning it with UK GDPR. The ICO has also named online tracking an enforcement priority. Misconfigured consent went from a low-risk oversight to a material liability.
Yes. Google requires Consent Mode v2 signals to use EEA/UK user data for personalised advertising and remarketing. Without it, audiences shrink and Smart Bidding runs on incomplete conversion data.
No. We work in a dedicated GTM workspace with full version history, so every change is reviewable and reversible before it goes live. Nothing publishes without your sign-off.
Having a CMP and having a working CMP are different things. In our UK clinic probe, 100% of the sites leaking data pre-consent already had a CMP installed. The banner was there; the enforcement wasn't.
See what your site leaks before you commit
Run the free Consent Mode v2 checker, or book a call and we'll read your setup together.