The Swedish Business Guide to Consent Mode V2

In summer 2023, Sweden's data protection authority IMY (Integritetsskyddsmyndigheten) fined Tele2 12 million SEK and CDON 300,000 SEK over how the companies handled visitor data through Google Analytics. Two other companies in the same enforcement round, Dagens Industri and Coop, avoided fines entirely. The difference wasn't that they stopped using Google Analytics — it was how they had configured their data collection.

That's the core reason Consent Mode v2 matters for Swedish companies: it's no longer just a checkbox for cookie banners. It's the difference between a compliance note and a fine running into the millions of kronor.

What happened in IMY's enforcement cases

IMY's investigation centered on how the companies sent visitor data from Google Analytics (Universal Analytics) to Google in the US — a third country without an adequate level of protection under the EU Court of Justice's Schrems II ruling. Tele2 and CDON had not implemented sufficient technical safeguards before the data left the EU.

Dagens Industri and Coop had done two things differently: they had mapped the full lifecycle of their personal data and implemented server-side Google Tag Manager hosted on an EU-based server, with IP anonymization and cookie ID hashing before data left the server. Same tools, same analytics platform — but the configuration decided the outcome.

We covered the full case, including the specific technical measures that separated the companies, in our webinar GA, IMY, GDPR & e-privacy.

What is Consent Mode v2?

Consent Mode is Google's mechanism for letting you keep collecting data through Google Analytics and Google Ads while respecting a visitor's consent choice. Version 2 added two new signals on top of the two that existed in version 1:

Parameter	Introduced in	Controls
analytics_storage	v1	Whether Google Analytics can set cookies to measure visitors
ad_storage	v1	Whether ad-related cookies (e.g. remarketing) can be set
ad_user_data	v2	Whether user data can be sent to Google for advertising purposes
ad_personalization	v2	Whether data can be used for personalized advertising, e.g. remarketing lists

The two new parameters are a direct response to the EU's Digital Markets Act (DMA), which classifies Google as a "gatekeeper" and imposes stricter requirements on how user data can be shared for advertising. Since March 2024, a correctly implemented Consent Mode v2 has been required to use personalized ad features, remarketing, and full conversion tracking in Google Ads at all for visitors in the EEA, UK, and Switzerland.

Basic mode vs. advanced mode

You choose between two implementation modes. In basic mode, no Google tags load at all until the visitor consents — the simplest to reason about from a GDPR standpoint, but you lose all data from visitors who opt out. In advanced mode, tags load and send cookieless signals to Google even without consent, which Google uses to model the conversions you would otherwise have missed. According to our technical deep-dive in the knowledge base, advanced mode typically recovers 70–80 percent of the data you would otherwise lose.

Most Swedish companies we work with choose advanced mode, since the difference in data quality is significant and it remains fully GDPR-compliant as long as the signals are configured correctly.

How to implement Consent Mode v2

This article covers what Consent Mode v2 solves and why it's urgent for Swedish businesses. For the full technical walkthrough — GTM triggers, gtag.js code, region settings, and verification in Google Ads — we have a separate step-by-step guide: Google Consent Mode v2 – Complete Guide.

In short, implementation requires three things in place before you touch your GTM configuration:

• A Consent Management Platform (CMP) that supports Google's Consent Mode API, such as Cookiebot or CookieYes.
• A mapped data inventory — know exactly which tags and pixels run on your site before deciding what gets governed by consent.
• A decision on mode — basic or advanced — based on how much data quality matters against implementation complexity for your organization.

We covered Consent Mode v2 and its connection to the DMA in more detail, including the practical difference between basic and advanced mode, in our webinar Google Consent V2 & Measurement.

Common mistakes we see among Swedish companies

Confusing the cookie banner with Consent Mode. A cookie banner that looks correct to the visitor solves nothing if it doesn't actually send consent signals to Google Tag Manager. We've seen multiple implementations where the banner works visually but never triggers the consent update in GTM — meaning all data is collected as if consent had already been given.

Assuming server-side tracking automatically solves the consent question. Server-side Google Tag Manager reduces third-country transfer risk (it was a central part of the fix for Dagens Industri and Coop), but it doesn't replace Consent Mode. You need both: the right data infrastructure and the right consent handling. We cover when server-side tracking is actually worth the investment in our guide to server-side tracking for Swedish companies.

Waiting for the "right time." Historical data isn't affected by implementing Consent Mode now. There's no advantage to delaying — only growing risk as IMY's enforcement continues and NOYB (None of Your Business) builds semi-automated systems to file complaints against more companies, including smaller ones.

Frequently Asked Questions

Do all Swedish companies need to implement Consent Mode v2?

Any company using Google Analytics or Google Ads with visitors in the EEA, UK, or Switzerland needs Consent Mode v2 to retain full functionality in Google Ads — remarketing, personalized ads, and conversion tracking stop working correctly without it. Legally, the requirement is tied to GDPR and how you collect and share personal data, regardless of company size.

Does Consent Mode v2 affect my historical data in GA4?

No. Historical data in GA4 is not affected when you implement Consent Mode. The change applies going forward — how new data is collected depending on the visitor's consent choice.

What explains the difference between the Tele2 and CDON fines?

The difference in fine amounts (12 million SEK for Tele2 versus 300,000 SEK for CDON) reflects the companies' size and revenue, since GDPR sanctions are calculated as a share of global annual turnover. The underlying violation — insufficient protection when transferring personal data to the US via Google Analytics — was fundamentally the same.

Is installing a cookie banner enough?

No. A cookie banner is only the interface facing the visitor. If it isn't correctly connected to Google Tag Manager and doesn't actually send consent signals that govern your tags, you're still collecting data without valid consent — no matter how the banner looks.

Not sure whether your current implementation actually protects you, or whether you just have a banner that looks good? Book a free tracking audit and we'll walk through your GTM configuration and consent handling together.