AdSense GDPR Message and Certified CMPs: A Step-by-Step Guide
By Ramón Martínez · Updated 4 Nov 2026 · 7 min read
You don't need to live in Europe for this to matter. If people in the European Economic Area, the UK or Switzerland read your site, AdSense expects a recognised consent setup before it can show them personalized ads. Your location isn't the deciding factor. Your visitors' location is.
This guide covers what Google asks for, how to choose between its built-in message and a third-party tool, and how to confirm everything works. It's practical guidance rather than legal advice, so talk to a professional if your situation is complicated.
What a CMP is and what Google requires
A CMP (Consent Management Platform) displays the privacy prompt, stores each visitor's choice and passes that choice to ad technology. Google keeps a list of certified CMPs that integrate with IAB Europe's Transparency and Consent Framework (TCF).
According to AdSense Help, publishers who want to serve personalized ads need a Google-certified CMP for EEA and UK traffic since January 16, 2024, and for Swiss traffic since July 31, 2024.
Two points often get mixed up:
- A generic cookie banner isn't enough. A notice with an "Accept" button may look fine yet fail to pass consent in the format Google needs.
- Certification applies to the tool, not to your compliance. A certified CMP doesn't make your site compliant with every privacy law on its own. You still need a complete privacy policy, among other things.
Does it affect AdSense approval?
Google frames this as a condition for serving ads, not as a published criterion for its site review. A CMP won't make up for thin content, and you shouldn't assume a missing one explains a rejection. It's still worth setting up alongside the rest of our AdSense approval checklist, so European visitors are covered from day one.
What happens if you skip it
Traffic without a certified CMP can't receive personalized ads. Depending on the region, format and your settings, it may get non-personalized or limited ads instead, which tend to be less attractive to advertisers. Google doesn't publish a figure for the revenue impact because it varies by site, so be wary of anyone quoting an exact percentage.
Which option should you choose?
| Option | Good fit if… | Keep in mind |
|---|---|---|
| AdSense European regulations message | You run a small site and AdSense is your main ad source | Managed from your account with nothing extra to install. Check whether it covers any other cookies you use |
| Certified third-party CMP | You work with several ad networks or also need to manage analytics and other cookies | Confirm it's on Google's current list, which can change. May involve a fee |
| Cookie plugin that isn't a certified CMP | Only as an add-on for non-advertising cookies | Doesn't replace a certified CMP for personalized ads |
How to create the GDPR message in AdSense
Google updates its interface from time to time, so labels may differ slightly:
- Add your site and the AdSense code. The message appears on pages that load the AdSense code, so make sure it's in all your templates.
- Go to "Privacy & messaging" in your account menu and open the European regulations section.
- Create a new message and select the sites it applies to.
- Choose the languages your visitors read. If your site is multilingual, add each one you need.
- Set the visitor choices. Alongside consent, offer a way to manage options and a clear way to decline. Several European regulators stress that refusing should be as easy as accepting, so don't bury it to lift your consent rate.
- Add your privacy policy URL and confirm the link works.
- Adjust the styling (logo, colours) so visitors recognise your site and trust the prompt.
- Preview and publish. Then test it on the live site, as described below.
Check that section even if you don't remember creating a message. AdSense Help describes a setting called "Maximize message coverage" that can provide fallback messages when an ad request arrives without consent data, and it's on by default in most cases. You'll want to know what's active and make sure it doesn't overlap with another CMP.
If you use a third-party CMP
- Confirm certification on Google's official list, not just on the vendor's marketing page.
- Load the CMP before your ads. If the AdSense tag fires first, ad requests can go out without consent information.
- Review the vendor list so Google is included as an advertising vendor.
- Stick to one CMP. Two prompts confuse visitors and can send conflicting signals.
- Keep the plugin or script updated so it stays in step with TCF changes.
How to test it
A visible prompt doesn't prove the setup works. Run these checks from an EEA, UK or Swiss IP address. If you're elsewhere, you'll need a VPN:
| Test | Expected result |
|---|---|
| Open the site in a private window | The prompt appears on the first visit, in the right language |
| Decline and reload | Your choice is remembered and the prompt doesn't return on every page |
| Look for the option to change your choice | Visitors can revisit their decision later |
Run __tcfapi('getTCData', 2, console.log) in the browser console | Returns data with a tcString after you make a choice |
| Open the privacy policy link | It loads and explains how advertising cookies are used |
| Try it on a phone | Buttons are visible and easy to tap |
Check your site with a traffic light
MonetizeReady is free for Chrome and flags what could block approval right on your pages. Detection of well-known consent platforms is part of Premium, but always confirm certification on Google's official list.
Add to Chrome — freeFAQ
Do I need a CMP if my business is in the US?
If you get EEA, UK or Swiss traffic and want to show those visitors personalized ads, yes. The requirement follows the audience, not where your business is registered. US state privacy laws are a separate topic with their own settings.
Does the AdSense message cost anything?
Creating it from your account doesn't require a separate subscription. Third-party CMPs set their own plans and prices, so check with each vendor.
Do I still need a privacy policy?
Yes. The prompt summarises and records a choice, while the policy explains in detail who processes data, why, and what rights visitors have.
Does it also cover Google Analytics and other cookies?
Don't assume so. List the cookies and tags on your site and check what your setup manages. If something falls outside it, a broader CMP may work better than adding a second prompt.
Why can't I see the message on my own site?
European messages target the relevant regions, so you may not see them from another country. You may also have already made a choice in that browser. Test with a regional IP in a private window.
Want to make sure your content is ready too? Read our guide to the "low value content" rejection.
MonetizeReady is an independent tool, not affiliated with Google. AdSense is a trademark of Google LLC.