Cookie consent banner: what it has to do, Consent Mode v2, and which one to use

A cookie consent banner asks visitors before a site stores or reads anything non-essential on their device, keeps proof of each choice, and makes changing it as easy as giving it; Google Consent Mode v2 passes the choice to Google's tags. CookieYes (free to 5,000 pageviews a month, then from $10 a month per domain) and Cookiebot (free for one small domain, then from €7) are consent platforms that also scan for cookies and can block them automatically (as of 7 November 2026): pick one of them if you show Google ads as a publisher, need IAB TCF, or have trackers outside a tag manager. AgentFirstStack's banner is free and built into its tag manager: an AI agent turns it on, and it holds the container's tags, drives Consent Mode v2 and keeps consent records, but doesn't scan for cookies. This page isn't legal advice.

Updated 7 November 2026

Set it up with one prompt

Paste this into your coding agent. It looks at everything the site loads first, stops if the site needs a certified consent platform, and tests the banner in a real browser before publishing.

What a cookie banner has to do

This section summarises official texts so you know what to ask about. It isn't legal advice, and national rules and regulators' guidance add to it. Check what applies to your site with a lawyer or your data protection authority.

In the EU, the rule comes from Article 5(3) of the ePrivacy Directive: storing information on a visitor's device, or reading it, is allowed only if the visitor "has given his or her consent, having been provided with clear and comprehensive information". The exception is storage that's strictly necessary for a service the visitor asked for, or for sending a communication (Directive 2002/58/EC, consolidated). Consent takes its meaning from the GDPR: "freely given, specific, informed and unambiguous", by a clear affirmative action (Article 4(11)); Recital 32 adds that pre-ticked boxes or inactivity don't count (Regulation (EU) 2016/679).

The European Data Protection Board's cookie banner taskforce recorded where national regulators agree, as a minimum threshold rather than a full rulebook (report of 18 January 2023): a vast majority considered a banner with a consent button but no reject option on any layer an infringement; pre-ticked boxes on the second layer don't give valid consent; and sites should offer an easy way to withdraw at any time, such as a small permanent icon or a link in a visible place.

In the UK, the Information Commissioner's Office guidance on PECR (last updated 29 April 2026) lists, among its expectations, that a mechanism makes it "as easy to refuse consent as it is to accept", needs a positive action before non-exempt technologies are set, offers granular options by purpose, names the third parties data is shared with, and says how to revisit the choice (How do we manage consent in practice?). Advertising can't rely on any exception. A new "statistical purposes" exception covers some limited analytics, provided visitors get clear information and a simple, free way to object (What are the exceptions?).

Put together, and mapped to what the AgentFirstStack banner does:

What Google asks for: Consent Mode v2

Consent Mode is the way a site passes the visitor's choice to Google's tags. Google's own words: "Consent mode doesn't provide a consent banner or widget"; it works with the banner you have (About consent mode, as of 7 Nov 2026). Version 2 arrived in November 2023 and added ad_user_data and ad_personalization to the two older types (Tag Manager Help). The four, as Google's consent mode overview describes them:

In basic mode, Google's tags don't load until the visitor answers the banner; in advanced mode they load at once with consent denied and send measurements without cookies until the visitor grants it (consent mode overview). For the EEA, Google's Tag Manager Help says that to keep measurement, ad personalization and remarketing features you must "collect consent for use of personal data from end users based in the EEA" and share consent signals with Google.

Two Google requirements decide whether a home-made or built-in banner is enough:

• Advertisers (Google Ads and GA4 tags on your own site): Google's developer docs allow "a consent banner or other custom consent solution, or use a Consent Management Platform", as long as the consent state reaches Google (consent mode overview). Google's Tag Manager Help recommends a CMP, and its CMP Partner Program lists platforms integrated with Consent Mode and Tag Manager.
• Publishers using AdSense, Ad Manager or AdMob: since 16 January 2024 in the EEA and UK, and 31 July 2024 in Switzerland, "a certified CMP integrated with the TCF is required" to serve personalized ads there; traffic from a non-certified CMP may get non-personalized or limited ads. Google adds that it doesn't check CMPs for full compliance with the TCF or privacy laws (consent management requirements for publishers).

How the AgentFirstStack banner works

It's part of AgentFirstStack Tags, the tag manager your agent sets up. One block in the container's draft turns it on, and {"enabled": true} alone is a complete banner:

curl -s -X PATCH https://tags.agentfirststack.com/v1/containers/$C/draft -H "$H" -H 'content-type: application/json' \
  -d '{"consent_banner":{"enabled":true,"privacy_url":"https://example.com/privacy","reopen_button":true}}'
curl -s -X POST https://tags.agentfirststack.com/v1/containers/$C/preview -H "$H"   # add &afst_consent=open to preview_url
curl -s -X POST https://tags.agentfirststack.com/v1/containers/$C/publish -H "$H"
curl -s https://tags.agentfirststack.com/v1/containers/$C/consent -H "$H"            # accept and reject rates, records

• Who is asked: by default, visitors from the EU, Iceland, Liechtenstein, Norway, the UK and Switzerland, and visitors whose country is unknown, by the country of the request at the edge. Everyone else starts with the container's consent defaults, isn't shown the banner, and can still open it. regions: "all" asks everyone.
• What they see: a first layer with your title, text, privacy link, "Reject all" styled exactly like "Accept all" (same color, size and weight) and "Customize"; a settings layer with one unticked box per category and "Necessary" always on. These defaults can't be turned off. It's an accessible dialog in a shadow root, so the site's CSS can't break it, with focus handling, 44 px targets and stacked buttons on small screens. Validation warns when your colors fall under 4.5:1 contrast.
• Categories: analytics sets analytics_storage; advertising sets ad_storage and ad_user_data; personalization sets ad_personalization, personalization_storage and functionality_storage. A category you leave out is never offered, so never granted.
• What follows the choice: each tag in the container waits for its consent types and fires the moment they're granted; the Consent Mode v2 default goes to gtag before any Google tag, also for a GTM container loaded after the snippet, and each choice sends an update; a dataLayer event (afst_consent) lets other code react; AgentFirstStack session replay starts only with analytics consent; the analytics tracker waits too when it's set to keep a visitor id and wait for consent. In its default cookieless mode the tracker stores nothing on the device and keeps counting without asking.
• Withdrawal: a "Cookie settings" link (any element with data-afst-consent-open), afst('consent', 'open') or the optional floating "Privacy choices" button reopens the settings with the current choice. Turning a category off stops its tags, sends a Consent Mode update, and deletes the container's own identity and click-id cookies.
• The stored choice: one first-party cookie, _afst_cc, that holds only the choice, for 180 days by default (up to 395). Raising the banner's version, for example after adding an ad platform, makes it ask again; so does an expired choice.
• Proof of consent: each choice is one record: an anonymous consent id, the time from the server clock, the banner version, accept all, reject all or custom, the choice per category, the country, the language shown, and the container version whose config holds the exact text. Never the IP address, user agent, visitor id or page. Kept 12 months; a visitor finds their consent id in the settings layer, and your agent looks up their history with GET /v1/containers/:id/consent/records?consent_id=....
• Languages: English text is built in. Your agent adds up to 30 languages, picked by the page's lang and then the browser's languages.
• Size: the banner script is about 3.4 KB gzipped and loads only for visitors who have to see it.

Already have a consent platform? Keep it: the container follows any platform that calls gtag('consent', 'update', ...), and with consent.tcf it follows an IAB TCF v2 platform. Validation warns if you turn on both.

What it doesn't do

From the tags source as of 7 November 2026. These are the reasons to pick a full consent platform instead:

• No cookie scan or cookie list. It doesn't crawl the site for cookies, classify them or generate a cookie declaration. The tags scan reads up to 6 pages' HTML and reports the tags, tools and consent platforms it finds; it doesn't run the pages or list the cookies they set. Your privacy policy has to list them, and your agent can draft that list from a real browser, but nothing keeps it up to date.
• No blocking outside the container. Only tags that run through the container wait for consent, plus Google's own tags through Consent Mode, AgentFirstStack replay and the analytics tracker. A pixel hard-coded in the page, a plugin, a chat widget or a video embed keeps running until it's moved into the container or gated by your own code.
• Not an IAB TCF consent platform. It doesn't create a TC string or show the TCF vendor list. It can follow a TCF platform you run, but then that platform shows the banner.
• Not Google-certified. It isn't in Google's CMP Partner Program or its list of certified CMPs, so it doesn't meet Google's requirement for publishers serving personalized ads in the EEA, the UK or Switzerland.
• Categories, not vendors. Visitors choose analytics, advertising and personalization; they can't allow one vendor and refuse another in the same category.
• Other vendors' cookies. Withdrawal removes the container's own cookies. Cookies another vendor already set stay until they expire or that vendor clears them.
• No translations for you. Only English is built in, and nothing is translated automatically; have the texts your agent writes checked.
• No opt-out templates. Visitors outside the asked regions start with the defaults, with no "Do not sell or share" link or US-state templates. Browsers that send Global Privacy Control or Do Not Track get no tags at all by default.
• Websites only. There's no app SDK.

CookieYes and Cookiebot

CookieYes is a consent management platform ("Part of Mozilor Technologies", per its llms.txt) with banners, cookie scanning and consent logs. Its plans, per domain, with local taxes added (cookieyes.com/pricing, as of 7 Nov 2026):

Every CookieYes plan lists cookie auto-blocking, a consent log, Google Consent Mode v2, and both "Google Certified CMP" and "IAB TCF Certified CMP". Prices are also shown in euros (€9, €23, €50 a month) and pounds.

Cookiebot is the consent platform of Usercentrics ("Cookiebot is a trademark of Usercentrics A/S"). Cookiebot Core is priced by the number of subpages on each domain, and subdomains count as separate domains (cookiebot.com/en/pricing, as of 7 Nov 2026, in euros excluding VAT):

The Free plan has an initial cookie scan, manual blocking, one language and consent that expires after up to a month. Premium adds monthly automated scans (daily for €99 a month more), automatic blocking, 47+ languages, geotargeting, IAB TCF 2.4, CSV export of consents and consent that lasts up to 12 months; consent records are kept up to 12 months on both. The same page lists US dollar prices of $10 to $120. Its larger product, Usercentrics Advanced, is priced on request.

Both appear in Google's list of certified CMPs (CookieYes CMP with TCF CMP ID 401, Cookiebot CMP with 134) and as Gold partners in Google's CMP Partner Program.

Side by side

When you still need a consent platform

Use CookieYes or Cookiebot if

• You show Google ads on your site through AdSense, Ad Manager or AdMob to visitors in the EEA, the UK or Switzerland and want personalized ads: Google requires a certified CMP with TCF.
• Your ad partners read IAB TCF consent strings.
• Much of what sets cookies is outside a tag manager (CMS plugins, embeds, widgets, hard-coded pixels) and you want it blocked automatically from a scan rather than moved.
• You want a cookie declaration that a scheduled scan keeps up to date, or consent reports and exports for a legal team in a dashboard.
• You need many languages translated for you, per-law templates such as US state opt-outs, cross-domain consent sharing, or consent in mobile apps.

Use the AgentFirstStack banner if

• Your trackers run through a tag manager you can move them into, and you want the banner, the tags and Consent Mode v2 in one place, for free.
• An agent should set it up, test it in a preview and read consent rates and records over an API.
• You want refusing to look exactly like accepting, without configuring it.
• You want consent records that hold no IP address or visitor id, and code you can read or self-host.

FAQ

Does my website need a cookie consent banner?

If it stores or reads anything on visitors' devices that isn't strictly necessary, and it has visitors in the EU or the UK, the ePrivacy rules and the UK's PECR generally require their consent first, and a banner is the usual way to ask. In the UK, the ICO says advertising can't rely on any exception, while some limited analytics now can. This isn't legal advice: check the rules that apply to your site with a lawyer or your data protection authority's guidance.

What is Google Consent Mode v2?

Consent Mode is how a site tells Google's tags what a visitor agreed to. Version 2, introduced in November 2023, added ad_user_data and ad_personalization to ad_storage and analytics_storage. It doesn't show a banner: a banner or consent platform collects the choice and sends it through Consent Mode. Google says advertisers must collect consent from EEA users and share consent signals with Google to keep measurement, ad personalization and remarketing features.

Do I need a Google-certified consent management platform?

If you're a publisher using AdSense, Ad Manager or AdMob and serve personalized ads to users in the EEA, the UK or Switzerland, yes: Google requires a certified CMP integrated with the IAB TCF. For an advertiser sending Consent Mode signals from its own site, Google's developer docs allow a consent banner or other custom consent solution as well as a CMP.

Does the AgentFirstStack banner scan or block cookies automatically?

No. It holds the tags in its tag container until the visitor chooses, sends Google Consent Mode updates, and tells AgentFirstStack replay and analytics. It doesn't crawl the site for cookies or generate a cookie list, and scripts loaded outside the container keep running. Move them into the container, or use a consent platform such as CookieYes or Cookiebot, which scan and block automatically.

What do CookieYes and Cookiebot cost?

As of 7 November 2026, CookieYes is free up to 5,000 pageviews a month, then $10, $25 or $55 a month per domain ($100, $250 or $550 a year). Cookiebot is free for one domain up to 50 subpages, and Premium costs €7 to €90 a month per domain depending on the number of subpages. The AgentFirstStack banner is free, within the hosted service's fair-use limits.

Does a banner make my site compliant?

Not on its own, whichever you use. Compliance also depends on what the site actually loads, the text you show, the third parties you name, your privacy policy and how you use the data. A banner is the tool that asks and records; the decisions are yours.

Product names belong to their owners. AgentFirstStack isn't affiliated with CookieYes, Usercentrics (Cookiebot), Google or IAB Europe.

Related

• TagsTag managerThe container the banner is part of.
• TagsCookiebot alternativeA free banner in your tag manager, and when Cookiebot fits.
• TagsConversion trackingConversions that respect each visitor's choice.
• ReplaySession replayRecorded only after consent where the law asks.
• AnalyticsWeb analyticsCookieless by default.
• TagsGoogle Tag Manager MCP comparedEdit GTM, or let the agent run the tag manager.