Microsoft Ads GDPR Compliance: UET Consent Mode Setup Guide

Microsoft Ads GDPR compliance comes down to one technical fact: if your site uses the UET tag and gets visitors from the EEA, the UK or Switzerland, Microsoft expects a consent signal on every page, and it has enforced that since 5 May 2025. Without a valid signal, Microsoft stops counting your UET-based conversions and stops filling your remarketing lists. This guide shows how to set up UET Consent Mode, check that it really works, and handle enhanced conversions, the Conversions API and customer match without creating new GDPR problems. It reflects Microsoft's documentation as of October 2026.

1. What Microsoft actually requires

The rule comes from Section 9(b) of the Microsoft Advertising Agreement. In the EEA, the UK and other places where privacy law requires consent, you must obtain consent before you activate the UET tag or pass personal data to Microsoft. In March 2025 Microsoft announced that advertisers had to send explicit consent signals for site visits from the EEA, the UK and Switzerland by 5 May 2025. Microsoft's consent FAQ adds that some accounts were enforced earlier, where a review found UET running without consent.

Enforcement is not just a warning. According to the FAQ, Microsoft checks whether its cookies (MUID, _uetvid, _uetsid, _uetsid_exp, _uetvid_exp or MSPTC) are set before the visitor interacts with your banner, or after the visitor clicks Refuse. If they are, you lose conversion tracking and remarketing on exactly the European traffic you want to measure.

2. Consent Mode or TCF: pick one, never both

Microsoft accepts two ways of sending the signal, plus a tag manager route for Consent Mode. Its FAQ is explicit that you should use Consent Mode or TCF, not both at the same time.

Option	How it works	Best fit
UET Consent Mode	Your site or consent tool pushes an ad_storage value of denied or granted to UET on every page.	Most SME sites with their own banner or a consent tool that already supports UET Consent Mode.
IAB Europe TCF	A TCF-compatible consent tool lists Microsoft (vendor ID 1126) and Xandr (vendor ID 32) and asks for TCF Purposes 1, 2, 3, 4, 7, 9 and 10.	Publishers and sites that already run a TCF banner for other ad partners.
Google Tag Manager	The official UET template in GTM passes the consent state it receives from your consent tool.	Sites that manage all tags in GTM. GTM is not a consent tool itself.

One detail many teams miss: Microsoft says UET will also try to read consent signals from other standard sources automatically if you do not implement Consent Mode directly. You can switch this off with enableAutoConsent: false in the tag. Microsoft still recommends an explicit setup, and it is far easier to document if a regulator or client asks.

3. Basic or Advanced Consent Mode, and the ePrivacy question

Microsoft's UET Consent Mode setup page describes two configurations:

• Basic Consent Mode: the UET tag is blocked until the visitor grants consent. Nothing is sent before that.
• Advanced Consent Mode: the tag loads straight away with ad_storage set to denied. With consent denied, Microsoft says only anonymized data is collected and later aggregated for modeling. Microsoft explained Advanced Consent Mode, which models conversions lost to refusals, in a blog post on 19 February 2026, and recommends it as its technical best practice.

Microsoft's recommendation is about measurement, not about EU law. The ePrivacy Directive (Article 5(3)) covers more than cookies. In its Guidelines 2/2023 (version 2.0, adopted 7 October 2024), the EDPB says that tracking pixels and tracking links fall under Article 5(3) even when nothing is stored permanently, and that JavaScript which builds a tracking request counts as an instruction to the device. In plain terms: a cookieless ping sent before consent can still need consent, depending on what it contains and on your national regulator's view. If you cannot get a clear answer from your DPO or lawyer, Basic Consent Mode is the cautious choice. You trade some modeled conversions for a much simpler compliance story.

4. Step-by-step setup

1. Set the default on every page. Place the default command as high as possible in the <head>, right after the UET base tag: window.uetq = window.uetq || []; window.uetq.push('consent', 'default', {'ad_storage': 'denied'});
2. Update on acceptance. When the visitor accepts marketing cookies, push window.uetq.push('consent', 'update', {'ad_storage': 'granted'}); and keep sending the stored choice on later pages for as long as the consent applies.
3. Leave refusals alone. If the visitor refuses, the denied state stays. Make sure no other script sets MUID or _uetvid anyway, for example a second copy of UET added by a plugin.
4. Handle Clarity separately. If you use the UET and Clarity integration, Microsoft says Clarity needs its own consent setting. Clarity started enforcing consent signals for EEA, UK and Swiss visits on 31 October 2025.
5. Update your privacy policy. Section 9(a) of the agreement requires a prominent privacy policy link on every landing page. If you use UET, that policy (and your cookie policy) must say that Microsoft collects or receives personal data to provide Microsoft Advertising, with a link to the Microsoft Privacy Statement.

The banner itself must meet the usual EU standards: a reject option as easy as accept, no pre-ticked boxes, and a clear way to withdraw consent. Our cookie consent guide for European SMEs covers the banner side in detail.

5. Settings table: where GDPR touches your Microsoft Advertising account

Feature or setting	Where to find it	What to do for EU traffic
UET tag	Conversions > UET tag	Add the consent default and update calls, or connect a TCF banner. Check the Consent Signal column.
Conversion goals	Conversions > Conversion goals	Track only what you need. Every goal relies on the same consent state.
Enhanced conversions	Conversion goal > Turn on Enhanced conversions	Send hashed email or phone only for visitors who consented, and mention it in your privacy notice.
Offline conversions	Conversions > Offline conversions	Hashing is mandatory here. Upload only records you have a legal basis to share.
Conversions API (CAPI)	UET tag > Set up tagging > Use Conversions API	Send adStorageConsent on every event. Without it, Microsoft treats the event as granted.
Customer match lists	Customer list audiences, in the interface or the Bulk API	Accepting the Customer Match terms means you confirm you can lawfully disclose the data. Check your legal basis first.
Clarity integration	Clarity project > Settings > Setup	Turn off cookies by default and pass Clarity its own consent signal.

6. How to check that consent really works

Do not trust a consent tool's dashboard alone. Microsoft gives you three independent checks:

• UET Tag Helper (browser extension for Edge and Chrome): look at the asc parameter on the Page Load event. Before consent it should show denied (or UET should not fire at all). After acceptance it should show granted on every later event.
• Browser console: window.uetq.uetConfig.consent.enabled should return true, and window.uetq.uetConfig.consent.adStorageAllowed should return false until the visitor accepts. For TCF, window.uetq.uetConfig.tcf.enabled should return true.
• UET dashboard: under Conversions > UET tag, the Consent Signal column shows Healthy when more than 75% of events in the last 7 days carry a valid signal, Moderate between 0% and 75%, and Missing at 0%. The Test your tag tab shows Present or Not present per event.

Then do the manual test regulators do: clear cookies, open the site, click Refuse, browse a few pages, and look at the cookie list in developer tools. None of the Microsoft cookies listed above should appear.

7. Enhanced conversions, the Conversions API and customer match

Enhanced conversions

Enhanced conversions send an email address or phone number from your conversion page to Microsoft. If you do not hash an email yourself, Microsoft hashes it in the browser before collecting it. Microsoft then matches the hash against people signed in to Microsoft services such as Outlook and Edge. That matching is exactly why a hashed email is still personal data under GDPR: its whole purpose is to identify a person. Microsoft states that it keeps hashed PII provided for enhanced conversions for 30 days, and that it discards uploaded data it cannot match. Fire the enhanced conversion code only after consent, and name this use in your privacy notice.

Conversions API

Server-side tracking does not remove the consent question. Microsoft's CAPI documentation has a detail that matters for EU sites: if you do not send adStorageConsent, every event is processed as granted. Send D for visitors who refused (Microsoft says such events are not used for advertising purposes, including attribution and retargeting), or do not send their events at all. CAPI also relies on a client-side ID Sync pixel and a stored msclkid click ID, and both of these touch the visitor's device. Our article on server-side tracking and GDPR explains why moving tracking to the server rarely changes the consent answer.

Customer match

When you accept the Customer Match terms, in the interface or with Accept Customer Match Term=True in a bulk file, you confirm that you can lawfully give that personal data to Microsoft. Before you upload a CRM list, decide your legal basis, check that your privacy notice tells customers their data may be used for advertising on Microsoft services, and remove anyone who objected to direct marketing. Our guide to legitimate interest versus consent for ads helps with that decision.

8. Data processing terms: who is who

If your main place of business is in Europe, the Middle East or Africa, your contract is with Microsoft Ireland Operations Limited and Irish law governs it. Two clauses shape how you describe Microsoft in your own documents:

• Section 8: Microsoft owns and controls the data it collects through its tags and properties ("Microsoft Advertising User Data") and uses it for its own purposes, including improving its services.
• Section 9(d): data you provide ("Company Data") is used only to provide the services to you or as otherwise permitted by law.

Because Microsoft uses UET data for its own purposes, many advertisers describe Microsoft in their privacy notice as a separate recipient that uses data for its own purposes, rather than as a pure processor. Confirm the right wording with your adviser and check the current agreement, because Microsoft updates it over time. Our explainer on data processing agreements for marketers covers how to record this.

9. The DSA: special-category data, minors and the Ad Library

The Digital Services Act adds two targeting rules for online platforms. Article 26(3) bans ads based on profiling that uses special categories of data under GDPR Article 9, such as health, religion, political opinions or sexual orientation. Article 28(2) bans profiling-based ads to users the platform knows with reasonable certainty are minors. Strictly, these articles bind platforms, and Bing is designated as a very large online search engine, a separate DSA category. They still mark the line for your own targeting. Microsoft's own agreement says you must not use Microsoft Advertising to process Sensitive Personal Data in breach of the law, and its definition of Sensitive Personal Data includes data collected from a known child.

In practice: do not build remarketing lists from pages about medical conditions, religious services or similar topics, and do not aim profiling-based campaigns at under-18s. Also remember that Microsoft publishes an Ad Library of ads served to Bing users in the EU, as very large search engines must under Article 39. Your ad content and your advertiser name are public there, so write every ad as if a regulator will read it.

Common mistakes

• Assuming Google Consent Mode also covers Microsoft. It does not, unless your consent tool or the UET template passes the signal to UET as well.
• Sending the default command after UET has already fired, so the first page view goes out without a consent state.
• Running Consent Mode and TCF at the same time, which Microsoft says you should never do.
• Sending CAPI events with no adStorageConsent value, so refusals are processed as granted.
• Forgetting Clarity, or a second UET copy added by a website plugin.
• Treating hashed emails as anonymous data.
• Leaving the privacy policy without the Microsoft disclosure and link that Section 9(a) requires.

Checklist: what to do this week

1. Open Conversions > UET tag and note the Consent Signal status for every tag.
2. Run the Refuse test in a clean browser and list any Microsoft cookies that still appear.
3. Choose Consent Mode or TCF and remove the other.
4. Decide on Basic or Advanced Consent Mode with your DPO, and write down why.
5. Check that enhanced conversion code only fires after consent.
6. If you use CAPI, add adStorageConsent to every event.
7. Review customer match lists for legal basis and marketing objections.
8. Update your privacy and cookie policy with the Microsoft disclosure and link.
9. Remove remarketing lists built on sensitive pages.

If you also run Google campaigns, compare this list with our Google Ads GDPR settings guide and our article on GDPR and retargeting. For the bigger picture, start with the complete guide to GDPR-compliant marketing for European SMEs.

Where Adverizeo fits

UET and consent settings live in your website and your Microsoft Advertising account, so Adverizeo does not configure them. What it does is write ad copy for Microsoft Advertising and 23 other channels within each channel's limits, and give every text ad a compliance score from 0 to 100 with suggestions. That score is a risk check, not a legal guarantee. You can see how it works on our GDPR page, test an existing ad with the free GDPR ad checker, or start on the free plan.

This article is general information, not legal advice.