GDPR + ePrivacy · UK GDPR + PECR

In Europe, consent comes first.

The ePrivacy Directive requires consent before any non-essential cookie is set, and the GDPR defines what valid consent looks like. UserGuard is designed to run that model: it holds tags until the visitor chooses, gives them a fair choice, and keeps a record of what they chose.

Get started → CCPA + US state laws

Search or jump to…⌘KRL

AAcme Healthacmehealth.exampleLive

Prior consent is enforced in the EU and UK.

Non-essential tags are held until consent, via Consent Mode v2 default-denied signals plus script gating. ?

What UserGuard is built to run

Prior consentShipped
Reject = accept prominenceShipped
Granular purposesShipped
Easy withdrawalShipped
Art. 7(1) recordsShipped
IAB TCFRoadmap

Receipts

WhenRegionAllowedBannerChoice

Nov 6, 14:22:07 UTCGermanyAnalyticsv4Saved preferences

Site: acmehealth.example
Banner version: v4, published Oct 19
Region: Germany (DE), prior consent
Language: de, shown in German
Choice: Analytics on, Marketing off
Recorded: 2026-11-06 14:22:07 UTC

What the EU requires

What European regulators expect.

European regulators have spelled out what they expect. Nothing non-essential fires before consent. “Reject” sits beside “Accept” with equal prominence. Consent is granular by purpose, and withdrawing is as easy as agreeing. Under Article 7(1), you also have to be able to demonstrate every consent you rely on. If you get any of those wrong, the banner is still non-compliant, however good it looks.

UserGuard holds non-essential tags until consent, using Consent Mode v2 signals and script gating, and logs every choice against the banner version. It’s designed to meet GDPR and ePrivacy consent requirements when properly configured.

Tags wait for consent

We hold non-essential tags until consent, using Consent Mode v2 default-denied signals plus script gating. There are three exceptions to know about. If our config is unreachable, scripts you marked by hand stay held and auto-detected ones are released, so an outage of ours can never take your site down with it. If you turn on Advanced consent mode, Google’s tags load before a choice, with their signals denied. And Speak Local’s tracker isn’t held: until a visitor allows analytics, it counts visits without storing anything.

A fair first layer

Accept all and reject optional look the same, with the same accent color, size and weight, and neither is pre-selected. Preferences opens the preference center, which has its own one-click reject all. We don’t use dark patterns or bury the reject button.

Records for Article 7(1)

Every consent event is tied to the site, banner version, region and timestamp. When someone asks you to demonstrate consent, you export a CSV.

United Kingdom

The UK has its own rules.

Since Brexit, the UK has run on UK GDPR plus PECR. It’s the same prior-consent model, enforced by the ICO, which has actively swept major UK sites for missing equal-prominence reject buttons. The rules are also diverging. The Data (Use and Access) Act 2025 adds UK-specific consent exemptions and raises PECR fines from £500K to UK GDPR levels.

By default, UK visitors get prior consent just like EU visitors, and we track the UK rules as they change.

Google Consent Mode v2

What Google requires.

Since March 2024, Consent Mode v2 has been required for Google advertising and measurement features covering EEA and UK users. UserGuard is designed to set default-denied signals for all four consent types before any Google tag loads, then update them the moment a visitor chooses, so your analytics and ads scale back instead of firing without consent.

IAB TCF support is on our roadmap. We intend to complete IAB Europe’s CMP validation, and we won’t claim the badge until we’ve done it.

FAQ

GDPR questions, answered

Do I need prior consent for cookies in the EU?

Yes. The ePrivacy Directive requires prior consent for any non-essential storage or access on a visitor’s device (cookies, pixels, localStorage), and the GDPR and regulator guidance set the consent standard: freely given, specific, informed, and unambiguous, with rejection as easy as acceptance and withdrawal as easy as giving it. Nothing non-essential should fire before the visitor says yes.

What are records of consent?

GDPR Article 7(1) requires you to be able to demonstrate that consent was given. UserGuard logs every consent event against the site, banner version, region and timestamp, and you can export the log as CSV when someone asks.

Does UserGuard support Google Consent Mode v2?

UserGuard is designed for full Consent Mode v2 integration: default-denied signals for all four consent types (ad_storage, analytics_storage, ad_user_data, ad_personalization) before any Google tag loads, updated the moment a visitor chooses. Consent Mode v2 has been required for Google advertising features covering EEA and UK users since March 2024.

Is UserGuard an IAB TCF certified CMP?

Not yet. TCF participation requires completing IAB Europe’s validation process, and we won’t claim it before it exists. TCF support is on our roadmap, and we intend to complete IAB Europe’s CMP validation.

Does the UK follow the same rules?

The UK has its own parallel framework (UK GDPR plus PECR, enforced by the ICO) with the same prior-consent model but growing differences, including the Data (Use and Access) Act 2025’s new exemptions and dramatically higher PECR fines. By default, UK visitors get prior consent, the same as EU visitors, and we track how the UK rules change.

This page is general information about privacy laws, not legal advice. UserGuard helps you operate consent and opt-out management as part of your compliance program. Configuration decisions and legal outcomes remain yours. Consult qualified counsel for your situation.