> The Digital Markets Act (DMA) sets new rules on cookie consent and data sharing with gatekeepers. A practical guide to adapting your website. > > Canonical: https://www.flowconsent.com/en/blog/digital-markets-act-dma-cookies-consent [Regulation](https://www.flowconsent.com/en/blog?category=regulation) # Digital Markets Act and cookies: what changes By FlowConsent · Published 1 April 2026 · Updated 1 October 2026 · 4 min read In short The Digital Markets Act (DMA) brings new rules on cookie consent and data sharing with gatekeepers. Here is how to adapt your website. ## TL;DR The Digital Markets Act (DMA) is a European regulation that took effect in March 2024 and imposes specific consent and tracking obligations on large digital platforms (gatekeepers). For website publishers, the DMA strengthens the requirement for explicit consent before any data is shared with gatekeeper services (Google, Meta, Amazon, Apple, etc.). In practice, it affects how you configure your cookies, your CMP and your advertising integrations. ## What is the Digital Markets Act? The Digital Markets Act (DMA) is a European Union regulation that aims to regulate the practices of large digital platforms designated as "gatekeepers". Adopted in 2022 and applicable since March 2024, it complements the GDPR by adding specific obligations on consent, data combination and advertising transparency. Unlike the GDPR, which applies to every data controller, the DMA specifically targets dominant platforms: Google (Search, Ads, Maps, Android, Chrome), Meta (Facebook, Instagram, WhatsApp, Messenger), Amazon, Apple, Microsoft, ByteDance (TikTok) and a few others. But its effects ripple through to every website that uses these gatekeepers' services. ## How does the DMA affect cookie management on your website? The DMA affects your website as soon as you use services provided by a gatekeeper: Google Analytics, Google Ads, Meta Pixel, Amazon Ads or any other tool from these platforms. The regulation prohibits gatekeepers from combining data across their different services without the user's explicit consent. For Meta's tag specifically, our guide to [Meta Pixel cookies and GDPR compliance](https://www.flowconsent.com/en/blog/meta-pixel-cookies-gdpr-compliance) explains how to block it until the visitor consents. ### Stronger consent for gatekeeper services Article 5(2) of the DMA prohibits gatekeepers from combining personal data collected through their platform service with data from other services, unless explicit consent is given. In practice, Google can no longer merge your [Google Analytics](https://www.flowconsent.com/en/blog/google-analytics-gdpr-compliant) data with Google Ads or YouTube data unless the user has given specific consent. For website publishers, this means your [consent banner](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide) must let users accept or refuse data sharing with each gatekeeper separately. A simple "Accept all cookies" button is not enough if users do not understand that their data will be combined across several Google services. ### The impact on Google Consent Mode and advertising signals Google has adapted [Consent Mode v2](https://www.flowconsent.com/en/blog/google-consent-mode-v2-implementation-guide) to comply with the DMA. The two new parameters (ad\_user\_data and ad\_personalization) directly address the DMA requirements: they let the publisher signal whether the user has consented to their data being shared with Google for personalised advertising and to the use of their first-party data. To see what these signals change for advertisers, read our analysis of [Consent Mode v2 and its impact on Google Ads campaigns](https://www.flowconsent.com/en/blog/consent-mode-v2-google-ads-campaign-impact). ## DMA vs GDPR: what are the differences for cookies? The DMA and the GDPR are complementary, not competing. The GDPR governs the processing of personal data by any organisation. The DMA adds an extra layer of obligations specific to gatekeepers and, by extension, to the publishers who use their services. ## What concrete steps should you take for your website? Even though the DMA targets gatekeepers, website publishers need to adapt their setup to stay compliant. Here are the steps to take. ### Update your CMP to send the right signals Your [CMP](https://www.flowconsent.com/en/blog/how-to-choose-consent-management-platform) must send the ad\_user\_data and ad\_personalization parameters in addition to ad\_storage and analytics\_storage. Without these signals, Google assumes the user has not consented to their data being shared, which disables advanced advertising features. The [FlowConsent Consent Mode v2 documentation](https://www.flowconsent.com/en/doc/google-consent-mode) shows that all four v2 signals, including ad\_user\_data and ad\_personalization, start as denied before any tag loads. ### Check the granularity of your consent banner The DMA requires specific consent for data combination. Your banner must let users understand which gatekeeper services are used and accept or refuse this sharing. [Cookie categories](https://www.flowconsent.com/en/blog/gdpr-cookie-categories-guide) (analytics, advertising, functional) remain relevant, but transparency about who receives the data becomes even more important. ### Document data flows to gatekeepers Add to your [cookie policy](https://www.flowconsent.com/en/blog/cookie-policy-gdpr-guide) the list of gatekeeper services used on your website, the data sent and the purposes. The DMA strengthens transparency: users must be able to clearly identify which gatekeepers receive their data. With FlowConsent, the [cookie declaration](https://www.flowconsent.com/en/doc/cookie-declaration) is generated from the active services, which makes this list easier to keep up to date. ## Common mistakes about the DMA and cookies **Thinking the DMA only concerns Big Tech.** The DMA directly concerns gatekeepers, but it affects every website that uses their services. If you use Google Analytics, Google Ads or Meta Pixel, the DMA obligations concern you indirectly. The same applies to TikTok, owned by the gatekeeper ByteDance: see our guide to [the TikTok Pixel and GDPR](https://www.flowconsent.com/en/blog/tiktok-pixel-cookies-gdpr-consent). **Confusing GDPR compliance with DMA compliance.** Being GDPR-compliant is not enough. The DMA adds specific requirements on combining data across services. A GDPR-compliant cookie banner may not be compliant under the DMA if the ad\_user\_data and ad\_personalization signals are not sent. **Ignoring your CMP updates.** CMPs regularly update their integrations to support new DMA requirements. Failing to update your CMP can lead to a loss of advertising features without you realising it. **Not adapting your cookie policy.** The DMA requires greater transparency about who receives the data. If your cookie policy does not explicitly mention gatekeepers and data combination, it is incomplete. ## DMA and cookies checklist 1. Identify all gatekeeper services used on your website (Google, Meta, Amazon, Apple, etc.) 2. Check that your CMP sends the ad\_user\_data and ad\_personalization parameters 3. Make sure your consent banner offers sufficient granularity for gatekeeper services 4. Update your cookie policy to list the gatekeepers and the data shared 5. Test how your tags behave when the user refuses data sharing 6. Document your setup in your record of processing activities 7. Follow European Commission decisions on designated gatekeepers 8. Update your CMP regularly to incorporate new requirements ## Conclusion The DMA does not replace the GDPR; it complements it. For website publishers, the main impact concerns CMP configuration and transparency towards users about data sharing with gatekeepers. Websites that use Google, Meta or Amazon services must adapt their setup to send the right consent signals. The starting point: check that your CMP is up to date and that all four Consent Mode v2 parameters are correctly configured. [Run a free scan of your website with FlowConsent](https://www.flowconsent.com/en/scan) to identify the gatekeeper trackers present on your pages. [Back to the blog](https://www.flowconsent.com/en/blog) Share this article · [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fdigital-markets-act-dma-cookies-consent) · [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fdigital-markets-act-dma-cookies-consent) Questions ## Common questions on this topic. Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What is a gatekeeper under the Digital Markets Act? A gatekeeper is a large digital platform designated by the European Commission because it controls a core platform service (search engine, social network, operating system, browser, etc.) with an entrenched market position. Current gatekeepers include Alphabet (Google), Meta, Amazon, Apple, Microsoft and ByteDance. ### Does the DMA require me to change my cookie banner? Not directly, but indirectly yes. The DMA requires gatekeepers to obtain explicit consent to combine data across their services. Your banner must let users specifically consent to this sharing, which often means updating your CMP and the Consent Mode signals it sends. ### What is the difference between the DMA and the GDPR for cookies? The GDPR requires consent for placing non-essential cookies. The DMA adds a specific obligation: gatekeepers cannot combine data across their different services without separate consent. The two regulations apply cumulatively; one does not replace the other. ### Are DMA penalties more severe than GDPR penalties? Yes, potentially. The DMA provides for fines of up to 10% of the gatekeeper's worldwide turnover, and up to 20% for repeat infringements. The GDPR caps fines at 4% of worldwide turnover. However, these penalties target gatekeepers, not individual website publishers. ### How does the DMA affect my Google Ads and Meta Ads campaigns? The DMA affects Google's and Meta's ability to use your data for ad targeting. If your users do not consent to data combination, remarketing and advanced targeting features are limited. That is why correctly configuring Consent Mode v2 and Meta consent signals (CAPI) is essential. ### My website is outside Europe: does the DMA still concern me? The DMA applies to gatekeepers operating in the EU. If your website uses these gatekeepers' services to target European users, the DMA requirements indirectly affect your setup. However, if you do not target European traffic, the DMA has no direct impact on your website. Read next ## Keep reading. [All articles](https://www.flowconsent.com/en/blog) [Regulation · 2 April 2026](https://www.flowconsent.com/en/blog/eprivacy-regulation-cookies-europe-what-changes) ### [ePrivacy Regulation: what changes for cookies](https://www.flowconsent.com/en/blog/eprivacy-regulation-cookies-europe-what-changes) [The ePrivacy Regulation will replace the 2002 cookie directive. Wider tracker definitions, browser-based consent and uniform EU rules: here is what to prepare for.](https://www.flowconsent.com/en/blog/eprivacy-regulation-cookies-europe-what-changes) [Read the article ](https://www.flowconsent.com/en/blog/eprivacy-regulation-cookies-europe-what-changes)· [Platform guides · 13 July 2026](https://www.flowconsent.com/en/blog/nextjs-cookies-gdpr-compliance-guide) ### [Next.js cookie consent and GDPR: the complete compliance guide](https://www.flowconsent.com/en/blog/nextjs-cookies-gdpr-compliance-guide) [How to collect valid cookie consent in a Next.js app, from App Router installation and SPA navigation to Google Consent Mode v2 and server-side consent checks.](https://www.flowconsent.com/en/blog/nextjs-cookies-gdpr-compliance-guide) [Read the article ](https://www.flowconsent.com/en/blog/nextjs-cookies-gdpr-compliance-guide)· [Marketing tools · 1 July 2026](https://www.flowconsent.com/en/blog/ga-cookie-gid-gat-explained-gdpr) ### [The \_ga, \_gid and \_gat cookies explained: purpose, lifetime and GDPR consent](https://www.flowconsent.com/en/blog/ga-cookie-gid-gat-explained-gdpr) [What the Google Analytics cookies \_ga, \_ga\_\, \_gid and \_gat actually do, how long they last, why they need consent in the EU and how Consent Mode v2 changes their behaviour.](https://www.flowconsent.com/en/blog/ga-cookie-gid-gat-explained-gdpr) [Read the article](https://www.flowconsent.com/en/blog/ga-cookie-gid-gat-explained-gdpr) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)