Short answer: for visitors in the European Economic Area and the United Kingdom, Google requires a consent signal from a Google-certified consent management platform (CMP). Without a valid signal, ad serving to those users is restricted — in practice, fewer or no ads. The revenue impact is immediate and usually misdiagnosed.
We buy European traffic into our own content properties, so a broken consent setup is not a compliance footnote for us; it is a hole in the day’s revenue. This is what we have learned about getting it right and, more usefully, about noticing when it has gone wrong.
What Google actually requires
Google’s EU user consent policy requires publishers using its ad products to obtain consent from EEA and UK users for the use of cookies and personal data, and to pass that consent to Google in a form it recognises. The recognised form is the IAB Transparency and Consent Framework (TCF) string, generated by a CMP that is on Google’s certified list. A home-made cookie banner that simply hides itself when clicked does not produce that string. Google treats its absence as “no consent”.
What happens without a valid signal
- Personalised ads are not served to those users. For many sites that alone removes most of the European demand.
- Depending on configuration, non-personalised or limited ads may be served, at lower rates — or nothing at all.
- Requests are still made. So impression eCPM can look healthy while European request eCPM collapses, which is why the problem hides. See the note on request eCPM.
The failure modes we see most
No certified CMP
A generic cookie plugin that is not on Google’s list. It looks like consent to a human and like nothing to Google.
A certified CMP, misconfigured
The CMP is installed but Google is not listed as a vendor, or the TC string is not passed before the ad tag fires, or the ad code loads outside the CMP’s control. Each of these produces the same result as having no CMP.
Consent gathered, then lost
The signal is present on the first page and missing on later ones — a caching layer, a template that omits the script, an AMP or app surface that was never wired. Revenue per session drops after page one and nobody connects the two.
Geo-detection that fires in the wrong place
The CMP shows to everyone, including users outside Europe who do not need it, which costs engagement; or it fails to show to users who do need it, which costs ad serving. Both are configuration, both are fixable.
How to see it in your numbers
- In Ad Manager reporting, split by country. Compare request eCPM for Germany, France, Spain, Italy and the UK against the United States.
- Compare fill rate for the same countries. A European fill rate far below the US one, on similar content, is a consent problem until proven otherwise.
- Check the ratio of personalised to non-personalised impressions for Europe. A heavy skew to non-personalised means consent is not reaching Google.
- Load the site from a European IP and look at the actual TC string in the browser. If it is not there, nothing downstream matters.
Getting it right
- Use a CMP from Google’s certified list, registered with the IAB TCF. Several are free at normal traffic levels.
- Configure Google as a vendor and set the CMP to load and resolve before the ad tags fire.
- Apply it to every template and surface, including pages served from cache and any app or AMP versions.
- Re-check it after every theme, plugin or ad-code change. It breaks quietly.
- Keep the banner honest. A design that makes “reject” hard to find is itself a policy problem.
Do I need a CMP if I only have a little European traffic?
If you use Google ad products and have any EEA or UK users, the policy applies. How much it costs you to ignore depends on how much of that traffic you have — but if you buy European traffic, it costs you on every click.
Does a certified CMP guarantee European revenue?
No. It restores eligibility. Revenue still depends on your content, your traffic quality and advertiser demand in each country.
Can consent problems get an account into policy trouble?
Yes. Missing or deceptive consent is an enforceable policy issue, not only a revenue one. If you already have a notice, this is how we handle it.
Consent setup is part of every monetisation engagement we take on. Start with the audit.