Start with the data path
Identify every place your website or app sends user data to Google: Google Ads tags, Analytics-linked advertising, app SDKs, enhanced conversions and uploaded customer data. The compliance review should follow the data, not just the marketing channel name.
Consent is more than showing a banner
A banner needs to capture a meaningful choice and the resulting consent status must be communicated to the tags or framework that uses it. A visual banner with no working signal logic is not a complete implementation.
Test denied and granted states
Use browser and tag-debugging tools to verify what happens before consent, after consent and after a user changes their choice. Measurement configuration should reflect the selected mode rather than behaving identically in every state.
Document ownership
Marketing, web and legal/privacy teams often each own only part of the setup. Write down who owns the CMP, tag configuration, policy language, analytics validation and change management when new tools are added.
Privacy implementation is a system of choices, signals and tag behavior—not a banner graphic.
This is a practical implementation summary, not legal advice. Requirements vary by jurisdiction and data use.