The deadline passed on February 28, 2026. If your WooCommerce store runs Google Ads and your consent management platform (CMP) hasn’t migrated to TCF 2.3, Google is already defaulting your EU ad traffic to Limited Ads — meaning no personalisation, no frequency capping, and potentially more than 50% lower programmatic revenue (CookieYes, 2026). Most store owners have no idea this happened.

This isn’t a planning guide. The transition window is closed. This is a three-check audit you can run today to find out whether you’re compliant or quietly bleeding ad budget.

What Changed on February 28, 2026?#

The IAB’s Transparency and Consent Framework (TCF) governs how cookie consent signals travel between your site and advertising platforms like Google. TCF 2.3 introduced a mandatory disclosedVendors segment — a field in the consent string that lists every vendor the user was informed about. Without it, your consent string is technically invalid under the new standard.

Google made TCF 2.3 compliance a hard requirement as of the February 28 deadline. Any TC string generated by a CMP still running TCF 2.2 on or after that date is rejected — and Google defaults that ad request to Limited Ads instead of personalised ads.

Limited Ads means: no audience targeting, no remarketing, no frequency capping, no Smart Bidding signals from consent-based data. It’s the ad equivalent of your campaigns going dark.

Check 1: Is Your CMP Generating TCF 2.3 Strings?#

This is the foundation. If your CMP hasn’t upgraded, the other two checks are irrelevant — the problem starts here.

To verify:

• Log into your CMP dashboard (CookieYes, Cookiebot, Quantcast, or whichever you use)
• Look for a TCF version setting or changelog — it should explicitly show TCF 2.3
• If you can’t find it, contact your CMP vendor directly and ask for their TCF 2.3 upgrade status

You can also inspect the TC string your banner is generating. Open your browser’s developer tools, go to Application → Cookies, and look for euconsent-v2. Decode it using the IAB’s TC String Decoder at iabeurope.eu. A valid TCF 2.3 string will show Version: 3 in the decoded output.

60-70% of EU users reject cookies when accept and reject options are equally prominent (USENIX Security Symposium / CNIL, 2024). Even with a perfect TCF 2.3 setup, most of your EU consent signals will be rejections — and your ad serving for those users will be Limited Ads by necessity, not error. Compliance doesn’t recover consent. It just ensures you’re signalling accurately.

You may be interested in: GDPR Consent Mode V2 Is Breaking WooCommerce Tracking — Here Is the Math

Check 2: Are Your Google Ads Still Serving Personalised Ads?#

Even if your CMP upgraded, it’s worth verifying the outcome in Google Ads. Limited Ads show up as reduced impression volume, lower CPM, and degraded ROAS — but they don’t throw an error message. You have to look for them deliberately.

To check directly:

• Open Google Ads and navigate to Tools → Consent Signal Diagnostics (under Data Manager if available in your account)
• Check whether your consent signals are being received and categorized as personalised-eligible
• Review your EU audience segments — if remarketing lists are shrinking unexpectedly, Limited Ads are likely in play

After enforcing GDPR-compliant consent banners, one real-world analysis found conversion counts dropped 20%, and Consent Mode V2 behavioral modeling recovered only 9% — leaving an 11% permanent attribution gap (SR Analytics, 2025). That permanent gap gets wider if your consent signals aren’t even reaching Google correctly.

Check 3: Is Your Consent Signal Reaching Google Correctly?#

TCF 2.3 compliance at the CMP level doesn’t automatically mean the signal is being transmitted to Google’s systems correctly. The bridge is Consent Mode V2 — specifically the ad_user_data and ad_personalization parameters.

To verify the signal is flowing:

• Use Google Tag Assistant or your GTM preview to inspect the consent command firing in your dataLayer
• Confirm ad_storage, ad_user_data, and ad_personalization are all updating correctly based on user choice
• Check that your CMP’s Google-certified integration is active — not just the generic TCF 2.3 implementation

Behavioral modeling in GA4 only activates when a site records 1,000 or more daily events with analytics_storage denied, for at least 7 consecutive days (Google Analytics Help, 2025). Most WooCommerce stores never hit that threshold. If you’re counting on modeled conversions to fill the consent gap, they likely aren’t activating.

You may be interested in: WooCommerce Shows 50 Orders, GA4 Shows 12: The Attribution Gap Nobody Explains

The Recovery Layer: Enhanced Conversions After Compliant Consent#

Compliance is the front door. What’s behind it matters just as much.

Once your TCF 2.3 signal is flowing correctly, server-side enhanced conversions are the layer that recovers conversion data from users who do consent — with accuracy that client-side tracking can’t match. Advanced Consent Mode implementation with Enhanced Conversions can recover 30-50% of lost conversions: modeling adds 15-25% uplift, Enhanced Conversions adds 5-25%, and server-side tagging adds 10-30% accuracy improvement (Dataslayer / Google Ads Documentation, 2025).

Here’s how you actually close the loop. Transmute Engine™ is a first-party Node.js server that runs on your subdomain (e.g., data.yourstore.com). The inPIPE WordPress plugin captures WooCommerce checkout events and sends them via API to your Transmute Engine server, which hashes customer data (SHA256) and routes Google Ads Enhanced Conversions — all from your own domain, without touching GTM. Compliant consent signalling is the legal requirement. Server-side enhanced conversions are what you do with the data from users who said yes.

Key Takeaways#

• Deadline closed February 28, 2026: TCF 2.3 is mandatory. CMPs still generating 2.2 strings are producing invalid consent signals that Google rejects.
• Non-compliance = Limited Ads: Google defaults to Limited Ads when it rejects a TCF 2.2 string — no personalisation, no remarketing, no Smart Bidding signals.
• Three checks to run today: CMP version, Google Ads personalisation status, and Consent Mode V2 signal flow.
• Behavioral modeling won’t save you: GA4 modeled conversions only activate at 1,000+ daily denied events for 7+ consecutive days — most WooCommerce stores never qualify.
• Enhanced Conversions are the recovery layer: For users who consent, server-side enhanced conversions recover 30-50% of what consent restrictions remove.

Check your CMP version today — and if Enhanced Conversions aren’t in place for the data that compliant consent users do provide, seresa.io is where to start.