And why most websites break compliance long before anyone notices.
Keeping a modern website compliant is no longer a matter of adding a cookie banner and hoping for the best.
Over the past year, Google has shifted the playing field significantly — and Consent Mode V2 has become the new baseline for any organisation that uses Google Analytics, Google Ads, Tag Manager or any tool that loads Google resources.
What we see in practice, however, is a different reality: most websites still run on Consent Mode V1, outdated consent scripts, or custom integrations that appear to work while quietly leaking cookies long before visitors have given permission.
This isn’t speculation. It’s what regular audits keep confirming.
The illusion of compliance
A cookie banner can give a comforting impression: visitors see a modal, buttons look clean, and tags feel “blocked.”
But compliance isn’t measured by the appearance of the banner — it’s measured by what your website loads before consent.
In many real-world deployments, especially on enterprise-style stacks, at least one of these symptoms pops up:
- Google Analytics cookies firing pre-consent
- Third-party plugins inserting scripts bypassing the banner
- Inline JS blocks running before the consent tool can intercept
- Tracking pixels loading via indirect dependencies
- Server-side caching reintroducing scripts that were supposed to be delayed
Even well-respected consent plugins struggle when multiple components are involved. A typical corporate website easily includes:
- a consent suite
- analytics / tag manager
- CRM or newsletter widgets
- marketing automation scripts
- optimisation or A/B testing tools
- custom theme scripts
Each of these brings its own logic, timing and triggers. When two or more of them interact, simply “blocking a script” is not enough. And that is precisely where Consent Mode V1 hits its limits.
Why Consent Mode V2 changes the equation
Google’s Consent Mode V2 was introduced because V1 could not reliably prevent cookies from loading in complex environments. V2 brings three capabilities that make it the only realistic option going forward:
1. Pre-consent enforcement
Google tags are not just hidden — they are technically deactivated until the user explicitly agrees.
This solves the long-standing issue of tracking scripts firing too early.
2. Anonymous, compliant measurement for users who decline
This is Google’s most underrated improvement: even without consent, you still get basic analytics through aggregated, pseudonymised data modelling.
No cookies, no identifiers, no personal data — but still a meaningful signal.
3. Alignment with upcoming EU enforcement
Google has made Consent Mode V2 a requirement for EU compliance within its ecosystem.
Websites sticking to V1 will gradually lose:
- accurate analytics
- eligibility for certain Google features
- credibility in an audit
In short: Consent Mode V2 is no longer “nice to have.” It is the technical minimum.
Where organisations underestimate the effort
Implementing V2 is rarely a one-click upgrade. The integration touches all layers of the website:
- consent tool configuration
- Google Tag Manager or native GA integration
- handling of external scripts
- theme-embedded scripts
- server caching
- script blockers and delay mechanisms
- newsletter or CRM widgets
Many setups contain hundreds of configuration possibilities. The more plugins and systems are involved, the more combinations and conflicts arise.
That’s why V2 migrations often take longer than planned — and why organisations discover hidden problems only once an audit is already underway.
The business risk of waiting
From a leadership perspective, delaying the upgrade carries three concrete risks:
1. Compliance gaps
If cookies are set before consent, the organisation is technically non-compliant, even if the banner looks correct.
2. Data loss
Without V2, analytics becomes increasingly inaccurate due to browser restrictions and new EU policies.
3. Audit exposure
Auditors now explicitly check “pre-consent behaviour.”. If Google cookies load too early, it’s a documented violation — not a misunderstanding.
Most executives assume their site is compliant because “the consent banner is installed.”. Unfortunately, that assumption is wrong more often than not.
How Sebaf IT can help
At Sebaf IT, we support organisations through the full lifecycle of Consent Mode modernisation:
1. IST Analysis
- technical scan of pre-consent behaviour
- detection of leaks, preloaded scripts and silent trackers
- review of plugin interactions and timing conflicts
2. Solution Design
- mapping the correct Consent Mode V2 flows
- identifying misbehaving components
- defining a consistent, maintainable policy
3. Implementation
- integration of Consent Mode V2
- restructuring of Google Tags
- hardening of plugin and theme interactions
- validation across browsers and devices
4. Final Documentation for audits
- written record of findings
- description of implemented compliance measures
- proof of technical behaviour
A proper Consent Mode V2 upgrade is not only a compliance exercise — it’s risk management, data governance and infrastructure modernisation rolled into one.
Conclusion
If your organisation still relies on Consent Mode V1 — or simply assumes its cookie banner is doing the right thing — it is time for a review. Google has moved on. Regulators have moved on. Browsers have moved on.
Your web stack should too.
If you’d like a professional assessment of your current setup, Sebaf IT can help evaluate where you stand and guide you through a clean, compliant implementation.
If you have questions or your cookies are giving you grief, feel free to reach out — I’m happy to help.
Find other interesting WordPress related articles here.