Google Consent Mode v2 and Cookie Banners for Websites in Pakistan and the UAE

Do Businesses in Pakistan and the UAE Need a Cookie Banner?

There are two separate questions here, and mixing them up is where most confusion starts. One is what the law in your own country requires. The other is what Google requires before it will use data from your website for ads and analytics, which depends on where your visitors are, not where you are.

Pakistan. At the time of writing there is still no enacted general data protection law. The Personal Data Protection Bill has been through several drafts but hasn't become law. That doesn't mean anything goes: you still need a truthful privacy policy, and the platforms you use (Google, Meta) have their own rules. But there is no Pakistani statute today that spells out cookie consent for ordinary business websites.

UAE. Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, usually called the PDPL, has been in force since 2 January 2022. It sets conditions for valid consent: specific, clear and unambiguous, and possible to withdraw. However, the Executive Regulations the law depends on for much of its detail had still not been published as of September 2026, and the Cabinet decision setting out penalties hadn't appeared either. In June 2026 the government announced a new Federal Authority for Artificial Intelligence and Data that takes over the UAE Data Office's functions, so enforcement may follow once the regulations arrive. Businesses in the DIFC and ADGM free zones are covered by those zones' own data protection laws instead, which are closer to Europe's GDPR.

Your visitors in Europe. This is the part that applies to almost everyone. If your website gets visitors from the European Economic Area, the UK or Switzerland, which is likely for any UAE business serving tourists or expats and any Pakistani business with overseas customers, Google's EU user consent policy applies to the data your Google tags collect from them. That's where Consent Mode v2 comes in.

We're web developers, not lawyers. If your business handles sensitive data, such as health, finance or children's information, get local legal advice for your situation.

What Google Consent Mode v2 Actually Does

Consent Mode is a way for your website to tell Google's tags (GA4, Google Ads, Floodlight) what the visitor agreed to. The tags then adjust what they store and send. It doesn't show a banner by itself. You still need a banner or a consent management platform (CMP) to ask the question; Consent Mode just passes the answer to Google.

Google updated it in November 2023, adding two parameters to the original two. Version 2 has four main consent types:

The four Consent Mode v2 parameters

Parameter	What it controls
ad_storage	Whether advertising cookies can be stored, such as Google Ads conversion cookies.
analytics_storage	Whether analytics cookies can be stored, such as the GA4 client ID cookie.
ad_user_data	Whether user data related to advertising can be sent to Google. Added in v2.
ad_personalization	Whether data can be used for personalised advertising, such as remarketing. Added in v2.

Each one is either granted or denied. You set a default when the page loads, then send an update when the visitor makes a choice.

Basic vs Advanced Consent Mode

Google describes two ways to implement it:

• Basic. Google tags don't load at all until the visitor accepts. If they decline, nothing is sent to Google. It's the simplest to explain and the most conservative.
• Advanced. Google tags load straight away with consent set to denied. Until the visitor accepts, they don't set cookies but they do send cookieless pings, which Google uses to model the conversions and visits it can't observe directly. When the visitor accepts, the tags switch to full measurement.

Advanced gives you better numbers in GA4 and Google Ads, because modelled data fills some of the gap left by people who decline. Basic sends less data. Which one fits depends on your company's privacy stance and, for EU visitors, your legal advice. Either way, the code below covers the part both share: setting defaults correctly and updating them when the visitor chooses.

AdSense Has a Separate, Stricter Rule

If you show Google AdSense ads, as many content sites in Pakistan and the UAE do, there's an extra requirement on top of Consent Mode. Google's consent management requirements for publishers say that to serve personalised ads to users in the EEA and UK (since 16 January 2024) and Switzerland (since 31 July 2024), you must use a Google-certified CMP that integrates with the IAB's Transparency and Consent Framework (TCF).

A home-made banner, even a well-built one, doesn't meet this, because it doesn't produce a TCF consent string. Without a certified CMP, Google says traffic from those regions may still get non-personalised or limited ads, but not personalised ones. Two more dates matter in 2026:

• TCF version 2.3 became mandatory for all new consent strings from 1 March 2026. Strings that don't meet it can cause ad requests to fall back to limited ads.
• Your CMP must list Google Advertising Products (vendor ID 755) among its disclosed vendors, otherwise Google can't act on the consent string.

The simplest route for most AdSense publishers is the free European regulations message in AdSense itself, under Privacy & messaging. Third-party certified CMPs also work; check that yours appears on Google's certified list.

So in practice: a site with AdSense and European visitors needs a certified CMP for ads. The custom banner and code in this guide suit sites that only use GA4 and Google Ads, or that want to handle non-European visitors themselves.

The Most Common Mistake: A Banner That Doesn't Tell Google Anything

We often see sites with a perfectly nice cookie banner. It has Accept and Decline buttons, and it remembers the choice in the browser so it doesn't show again. But nothing else happens. The GA4 tag loads before the banner and sets cookies regardless, and clicking Decline changes nothing except hiding the banner.

To check yours, open the site in a private window, open DevTools, and go to Application, then Cookies. Before you click anything, look for cookies whose names start with _ga. If they're already there for a European visitor, your defaults aren't working. Then click Decline, reload, and check again. You can also open the Console and type dataLayer to see whether any consent commands were sent at all.

The fix is a few lines of JavaScript placed before the Google tag, and one function the banner buttons call.

Tested Consent Mode v2 Code for a Static or WordPress Site

This uses gtag.js directly, which suits hand-coded sites and WordPress sites that add the Google tag in the theme header. If you use Google Tag Manager, Google recommends a consent mode template instead of raw gtag commands, because GTM processes the data layer differently.

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}

  // 1. Defaults: strict for the EEA, UK and Switzerland, open elsewhere.
  gtag('consent', 'default', {
    ad_storage: 'denied', ad_user_data: 'denied',
    ad_personalization: 'denied', analytics_storage: 'denied',
    region: ['AT','BE','BG','HR','CY','CZ','DK','EE','FI','FR','DE','GR','HU','IS','IE','IT','LV','LI','LT','LU','MT','NL','NO','PL','PT','RO','SK','SI','ES','SE','GB','CH'],
    wait_for_update: 500
  });
  gtag('consent', 'default', {
    ad_storage: 'granted', ad_user_data: 'granted',
    ad_personalization: 'granted', analytics_storage: 'granted'
  });

  // 2. Re-apply a choice the visitor already made on an earlier page.
  var CONSENT_KEY = 'site_cookie_consent';
  function consentState(choice) {
    var v = choice === 'accepted' ? 'granted' : 'denied';
    return { ad_storage: v, ad_user_data: v, ad_personalization: v, analytics_storage: v };
  }
  try {
    var saved = localStorage.getItem(CONSENT_KEY);
    if (saved === 'accepted' || saved === 'declined') {
      gtag('consent', 'update', consentState(saved));
    }
  } catch (e) { /* storage blocked: keep defaults */ }
</script>
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"></script>
<script>
  gtag('js', new Date());
  gtag('config', 'G-XXXXXXXXXX');
</script>

<!-- 3. The banner buttons call this. -->
<script>
  function saveConsent(choice) {
    try { localStorage.setItem(CONSENT_KEY, choice); } catch (e) {}
    gtag('consent', 'update', consentState(choice));
  }
</script>
<div class="cookie-banner" id="cookie-banner">
  <p>We use cookies for analytics and ads. <a href="/privacy-policy.html">Privacy Policy</a></p>
  <button type="button" onclick="saveConsent('declined')">Decline</button>
  <button type="button" onclick="saveConsent('accepted')">Accept</button>
</div>

How it works:

1. Two default commands. The first applies only to the listed regions: the 27 EU countries, Iceland, Liechtenstein and Norway (the EEA), plus the UK and Switzerland. It sets everything to denied. The second, with no region, applies to every other visitor. Google's documentation confirms that a default without a region covers everyone not matched by a region-specific default. If your legal advice says to ask everyone first, including UAE visitors, delete the second command and remove the region line from the first, so the denied default applies to all visitors.
2. wait_for_update: 500 gives the banner script half a second to send an update before tags fire, which Google recommends when consent code may load late.
3. Returning visitors. Consent Mode doesn't remember choices across pages. The code reads the saved choice from localStorage and sends an update before the GA4 config runs, so a visitor who accepted on the home page is measured properly on the next page.
4. The banner buttons call saveConsent(), which stores the choice and sends the update on the same page, as Google advises, rather than waiting for a reload.

We tested this in jsdom. On a first visit the data layer received the region-scoped default, then the global default, then the GA4 js command, in that order, and the region list contained all 32 codes. Clicking Accept stored the choice and pushed an update with all four types granted. On a simulated return visit with Decline saved, the denied update arrived before the GA4 command. Replace G-XXXXXXXXXX with your own measurement ID and style the banner to match your site.

On our own site we chose the more conservative option: every visitor, wherever they are, starts with all four types denied (functionality and security storage granted) and wait_for_update of 500 ms. The default runs in an inline script at the very top of the head, before gtag.js and AdSense load, and returning visitors who previously accepted get the update straight away from localStorage. The banner's Accept and Decline buttons send the granted or denied update on the same page, and only call gtag if it exists, so the banner still works if the tag is blocked.

Two practical points. First, show the banner only when no choice is saved, and give visitors a way to change their mind, such as a "Cookie settings" link in the footer that clears the saved choice and shows the banner again. Second, keep the buttons equally prominent. A huge green Accept and a tiny grey Decline link is the kind of design European regulators have criticised.

Optional Settings Worth Knowing

• URL passthrough. With gtag('set', 'url_passthrough', true); before the config command, ad click IDs are passed in the URL across your pages when ad cookies are denied, which improves conversion measurement. Test that the extra parameters don't break anything on your site.
• Ads data redaction. With gtag('set', 'ads_data_redaction', true);, ad click identifiers are removed from requests when ad_storage is denied.
• Separate choices. You can offer "Analytics only" by granting analytics_storage and denying the three advertising types. Many visitors are happier to allow analytics than ads.

How to Check That Consent Mode Works

1. Tag Assistant. Open Google Tag Assistant, connect it to your site and look at the Consent tab for each event. You should see the default state on page load and the updated state after a click.
2. Cookies. With a European region default, no _ga cookies should appear before Accept, and they should appear right after it.
3. Network requests. In the DevTools Network panel, filter by collect. Requests to Google include a gcs parameter describing the consent state, which changes after the visitor's choice.
4. GA4 and Google Ads. In GA4's Admin, the consent settings section shows whether consent signals are being received. Google Ads shows consent mode status in the conversion diagnostics.
5. Test from Europe. Region defaults depend on the visitor's location. Use a VPN with a European location, or ask a contact in Europe to check, rather than assuming.

Your Privacy Policy Has to Match

A banner that says one thing and a privacy policy that says another is worse than either alone. Make sure your privacy policy lists the tools that set cookies (GA4, Google Ads, AdSense, Meta Pixel, chat widgets), what each is for, how long cookies last, and how visitors can change their choice. If you add a new tool, update the policy and the banner text at the same time. For a UAE business, describe how people can withdraw consent, since the PDPL requires that withdrawal be possible.

If your site runs Meta ads as well, the same consent choice should control the Meta Pixel. Meta doesn't read Google's Consent Mode, so you have to handle it yourself; our guide to setting up the Meta Pixel and Conversions API shows where that fits.

Quick Decision Table

What a typical small business website needs

Your site	What we'd set up
GA4 only, visitors mainly in Pakistan	Simple banner, Consent Mode v2 with EEA/UK/CH denied defaults, honest privacy policy
GA4 and Google Ads, UAE business with tourist or expat traffic	Consent Mode v2 with region defaults (or denied for everyone, on legal advice), Accept/Decline/Analytics-only choices
AdSense on the site, any European traffic	Google-certified TCF CMP, such as AdSense's own European regulations message, plus Consent Mode for GA4
Business in DIFC or ADGM	Ask your adviser about that free zone's data protection law; treat consent as required for non-essential cookies

Frequently Asked Questions

Is a cookie banner required by law in Pakistan?

As of October 2026 Pakistan has no enacted general data protection law, so there is no statutory cookie banner rule for ordinary websites. Google's EU user consent policy still applies to visitors from the EEA, UK and Switzerland, and you should keep a truthful privacy policy.

Does the UAE PDPL require cookie consent?

The PDPL has been in force since 2 January 2022 and treats consent as one legal basis for processing, which must be specific, clear and withdrawable. Its Executive Regulations had not been published as of September 2026, so detailed rules are pending. DIFC and ADGM businesses fall under their own free zone laws.

What is the difference between Consent Mode v1 and v2?

Version 2, introduced in November 2023, adds ad_user_data and ad_personalization to the original ad_storage and analytics_storage. Google asks existing Consent Mode users to upgrade so the new parameters are sent.

Can I use my own cookie banner with AdSense?

Not for personalised ads to visitors from the EEA, UK or Switzerland. Google requires a certified CMP integrated with the IAB TCF for those visitors. Without one, that traffic may receive only non-personalised or limited ads.

Will Consent Mode reduce my GA4 numbers?

Visitors who decline won't be measured with cookies, so observed numbers drop for regions where you default to denied. Advanced Consent Mode lets Google model some of the missing data from cookieless pings, which recovers part of the gap.