Google Consent Mode v2: Mandatory for Swiss SMEs?

Google Consent Mode is neither a cookie banner nor a law. It is an interface. It passes your visitors' decision on to the Google tags, meaning Google Analytics 4 and Google Ads. The banner asks, Consent Mode forwards the answer, and the tags follow it.

Version two has widened the scope. Besides ad_storage and analytics_storage, ad_user_data and ad_personalization were added. They control whether Google may process and personalize user data for advertising.

Swiss law relies on information and objection. Under Article 45c of the Telecommunications Act, you may process data on your visitors' devices. The condition is that you inform them of the purpose and point out the option to decline. The Federal Data Protection and Information Commissioner (FDPIC) confirms this in its fact sheet from March 2026. A prior, explicit consent is needed only in exceptions. It applies when the processing is unexpected, carries a high risk or involves particularly sensitive data.

It looks different for visitors from the EU. European law requires consent there before non-essential cookies are set. If you deliberately address customers in the EU, you come into contact with it. On top of that comes Google's own policy. It applies to the European Economic Area (EEA: the EU plus Iceland, Liechtenstein and Norway), to the United Kingdom and, since 31 July 2024, also to Switzerland. If you use advertising tags such as Google Ads, you must obtain consent from these visitors. It applies to cookies where the law requires it, and to personalized advertising such as remarketing.

Google requires the verified consent signal only for the EEA. It applies as soon as you measure visitors with Google tags or use audiences and personalized advertising. For Swiss and British traffic, Google's own help says it does not expect such a signal. That is the status as of October 2026, and Google can change it. Check the policy before every new campaign.

The table shows the core: Google's signal requirement depends on the audience, not on the company's seat. A Swiss SME with EU customers falls under it, a purely local business usually doesn't.

Consent Mode comes in two implementation types. The difference determines how much measurement remains after a decline and how data-sparing the solution is. It is not a formality, but a trade-off between privacy and measurement depth.

Modeling means that Google estimates the missing figures from the behavior of visitors who gave consent. For Google Analytics 4 there is a hurdle. Google requires at least 1,000 events per day from visitors who decline, over at least seven days. In addition, at least 1,000 visitors per day with consent on seven of the last 28 days. That presupposes several thousand visitors a month, and even then modeling is not guaranteed. A website with around 850 visitors in 30 days, like noevu.ch, doesn't reach the threshold.

For Google Analytics 4, Advanced therefore closes measurement gaps only with enough traffic. Basic holds back as much as possible and loses the data of visitors without consent in return. The right choice follows your visitor numbers and your EU advertising budget, not the standard tutorial.

Advanced Consent Mode sounds tempting: more data, fewer measurement gaps. The price is in the fine print. Even those who decline trigger cookieless pings, which Google uses for modeling. You should know that and name it in your privacy policy before you activate Advanced.

A clean implementation needs four building blocks, whether you choose Basic or Advanced. If one is missing, the banner appears to work, but the signals may reach Google wrongly or not at all.

Google does not require advertisers to use a CMP from its partner program. The certification obligation applies to operators of websites that serve Google ads.

Consent Mode is a Google interface. If you use neither Google Analytics nor Google Ads, you have nothing to pass on and don't need it. Cookieless analytics such as Rybbit work without Consent Mode. Which providers exist is shown in the article below.

The price lies elsewhere. Without Google tags there are no remarketing lists and no measurement for Google campaigns. If you don't run campaigns, you lose hardly anything. If you do, you still need Google tags and therefore Consent Mode.

Cookieless also doesn't mean rule-free. Rybbit advertises “no cookies, no banner”. On noevu.ch, it stores a random identifier in the browser's local storage (Local Storage). The FDPIC explicitly names this storage as a similar technology. Whether such measurement can do without consent for EU visitors has not been conclusively settled. Your privacy policy therefore names every tool with its purpose and provider.

Two measurement systems run in parallel on noevu.ch. Cloudflare Zaraz, a tag manager, manages Google Analytics 4 centrally, as well as the consent banner. Visitors from the EU see the banner and decide there about analytics and advertising. Alongside it, Rybbit measures on its own server in Switzerland, without a banner and without cookies.

Both systems receive the same events, such as a booked appointment. The comparison shows roughly how many visitors are missing in Google Analytics, partly because of the banner for EU visitors. Read the gap as an order of magnitude, because the two systems count differently.

For client projects, an inventory comes first: Which services load, and which route fits them? Then follow the connection of Consent Mode v2 and a test of whether, before the decision, only what the chosen mode allows flows. The banner itself is explained in the guide to cookie banners for Swiss shops. If you want to tackle measurement and website together, you'll find the framework under website optimization.

The same mistakes repeat in implementation. They cost measurement data or trust, and usually show only once the numbers are already missing.