Amazon Consent Signal (ACS): the guide for Amazon Ads in Europe

What is the Amazon Consent Signal?

ACS is Amazon's own format for passing a visitor's privacy choices to Amazon Ads. According to Amazon's official consent signal requirements, whenever you transmit personal data of UK and EEA users to Amazon Ads, you must provide a valid consent signal. Amazon accepts three options: the IAB Transparency and Consent Framework (TCF), the Global Privacy Platform string (GPP, which Amazon's page calls Global Privacy Protocol) and its own Amazon Consent Signal.

Many people search for "Amazon consent mode" because the idea looks like Google Consent Mode v2: a small set of flags that travels with your tags and tells the ad platform what it may do with the visit. The comparison is useful but limited. ACS is not a Google product, it has its own parameter names, and you should not assume that Google features such as conversion modelling have an Amazon equivalent.

The two ACS parameters

• amzn_ad_storage: whether the visitor consents to Amazon reading or writing advertising cookies or similar technologies on their device. Accepted values: GRANTED or DENIED.
• amzn_user_data: whether the visitor consents to Amazon processing their personal data for advertising purposes. Accepted values: GRANTED or DENIED.

The split mirrors ad_storage and ad_user_data in Google's framework. If you already know Google Consent Mode v2, the logic will feel familiar: one flag for device storage, one for the use of personal data in advertising.

Who has to send it?

The requirement applies to advertisers and third parties that send personal data of UK or EEA users to Amazon Ads. In practice, you are concerned if you are one of the following:

• A brand or retailer that places the Amazon Ad Tag on its own website to measure conversions, build audiences or retarget visitors (for example with Amazon DSP).
• An e-commerce site that sends conversion events server to server through Amazon's Conversions API or Events API.
• An agency, tag management platform or CDP that forwards events to Amazon Ads on behalf of clients.
• A publisher that lets Amazon place advertising cookies on its pages.

Amazon Attribution works differently. It is Amazon's free measurement tool for sellers in Brand Registry, vendors, KDP authors and agencies: you add attribution tags to the links of your off-Amazon campaigns, and Amazon reports what happens on Amazon within a 14-day window. If you only use those tagged links, no Amazon script runs on your own site and the visitor's consent is handled on Amazon. As soon as you also install the Amazon Ad Tag or send events, the consent signal rules apply to those flows.

Amazon's policies also set obligations that go beyond the signal itself. You must publish a clear privacy policy, collect affirmative opt-in consent, keep records of that consent and make them available to Amazon on request, and never send directly identifiable data such as names, email addresses or phone numbers, data of children under 13 or sensitive data. The Amazon Ads pixel requirements add that your notice must say that third parties, including Amazon, may place cookies, and explain how visitors can opt out of interest-based ads.

ACS, IAB TCF or GPP: which signal should you use?

Only one signal is required. If you send several, Amazon states that it defaults to the TC String, so conflicting values between TCF and ACS are a problem you want to avoid.

• IAB TCF: the natural choice if your site already runs a TCF CMP, which is common for publishers. Amazon Ads is registered in the IAB Europe Global Vendor List as vendor 793 ("Amazon Ads"), so it must be part of the vendors your banner discloses. Our TCF 2.2 guide explains how the TC String works.
• GPP: relevant if you already use the Global Privacy Platform string to manage several jurisdictions in one format.
• ACS: the lightest option for advertisers and online shops that do not use TCF. Two flags and a country code are enough.

Rule of thumb: a brand or e-commerce site that does not sell ad inventory rarely needs a full TCF setup just for Amazon. ACS does the job with far less complexity. A publisher that already relies on TCF can keep the TC String, which Amazon reads first.

Deadlines: where things stand in 2026

Amazon's public policy page describes the requirements but does not publish dates. According to trade press and several CMP vendors, enforcement for UK and EEA personal data started on 7 February 2025, and a second deadline of 30 June 2026 targeted the Amazon Ad Tag, the Conversions API and the newer Events API. Both dates are now in the past.

The practical conclusion is simple: treat a consent signal as mandatory today for any UK or EEA traffic you send to Amazon Ads, and check the notices in your Amazon Ads console for the exact status of your account. Reports from the industry indicate that data sent without a valid signal may not be processed, which directly weakens attribution, retargeting and audience building.

Remember that ACS is a contractual requirement from Amazon, not a law. The legal basis comes from the ePrivacy rules on cookies (PECR in the UK) and from the GDPR. The ICO guidance on cookies and similar technologies is clear that non-essential cookies, including advertising cookies, need consent given by a clear positive action.

How to pass ACS from your consent banner

Think of it as two jobs. Your consent banner asks the question, records the answer and makes it available. Your tag setup carries that answer to Amazon, together with the country where consent was given. Here are the three common approaches.

Option 1: Amazon's official Google Tag Manager template

Amazon publishes an "Amazon Advertising Tag" template in the GTM Community Template Gallery, with its source code on GitHub. It offers fields for TCFv2, for ACS (Country Code, Amazon Ad Storage, Amazon User Data and an optional IP Address) and for a GPP string. It also checks GTM's own consent state: if ad_storage or ad_user_data is denied, the tag does not fire.

1. In GTM, go to Templates, search the gallery for "Amazon Advertising Tag" and add it to your workspace.
2. Create variables that return GRANTED or DENIED from your CMP's advertising consent (for example from a dataLayer value or a first-party consent cookie).
3. Fill in the Country Code with a two-letter ISO 3166 code (GB, FR, DE...) that reflects where the visitor gave consent.
4. Map Amazon Ad Storage and Amazon User Data to your variables, then set your trigger.
5. Test in Preview mode twice, once accepting and once refusing, and check what the tag sends.

If your CMP already feeds Google Consent Mode v2 into GTM, the template's built-in check will follow the same choice. Our guide on Google Tag Manager and Consent Mode v2 covers that part of the setup.

Option 2: direct tag with conditional loading

Without GTM, the safest pattern is to load the Amazon Ad Tag only after the visitor accepts the advertising or marketing category, and to configure the consent fields as documented in the Advanced Tools Center of your Amazon Ads account. If a visitor later withdraws consent, the tag must stop running on the following pages. Do not copy code snippets from unofficial sources: Amazon updates its tag and the field names in your account are the reference.

Option 3: server-side events

With the Conversions API or the Events API, consent has to travel with each event. Store the visitor's choice and country at the moment of collection, attach the signal to every event that contains personal data, and do not send personal data for visitors who refused.

Common mistakes to avoid

• Hard-coding GRANTED in the tag while the tag still fires before the visitor has answered the banner.
• Sending both TCF and ACS with different values. Amazon will use the TC String.
• Leaving the country code empty or guessing it incorrectly.
• Forgetting withdrawal: a visitor who changes their mind must stop being tracked.
• Not naming Amazon in your cookie policy and privacy notice, although Amazon's pixel requirements ask for it.
• Having no proof of consent. Amazon may ask for your records, so read our article on proof of cookie consent.

What about FlowConsent?

To be transparent: FlowConsent does not currently offer a native Amazon Consent Signal integration, and IAB TCF support is coming soon but not yet available. The ACS values and the country code therefore have to be configured in your tag or GTM setup, as described above.

What FlowConsent does today can still support that setup. Prior blocking of scripts lets you classify the Amazon Ad Tag as marketing so that it does not load before consent. Google Consent Mode v2 is built in, which helps if you use Amazon's GTM template and its ad_storage and ad_user_data check. The automatic cookie scan shows which Amazon trackers your pages actually load, and consent records are kept for 13 months as proof.

Conclusion

The Amazon Consent Signal is a small technical change with real consequences: without a valid signal, your Amazon Ads data for UK and EEA visitors loses value. Choose one signal (ACS for most advertisers, TCF if you already use it), make sure the Amazon tag never fires before consent, pass the country code, and keep your consent records.

Not sure which Amazon trackers your site loads today, or whether they fire before the banner? Scan your website for free and get a clear list of the cookies and scripts to fix.