If you run paid media, the gap between "we deployed a CMP" and "consent is flowing end-to-end through the stack" is where most of your stack lives, and it's where 15 to 40 percent of your conversion signal is leaking before it ever reaches the platforms doing the bidding. Your bidding algorithms are training on what made it through, not on what you designed. Three recent publication themes are circling the same finding. None of them names the mechanism.
ad_storage consent state. Every consent stack that has been quietly subsidized by a permissive Google Signals setting stops being subsidized. The implementation gets the load that the configuration page used to absorb.Three independent signals. Same underlying claim, said three different ways: the consent layer is doing real work, most consent layers don't actually work, and the cost of that gap is becoming legible.
What this looks like on your dashboard
Performance Max and Advantage+ optimize against the conversion shape your stack permitted, not the one you designed. If your consent layer is silently dropping events, mangling user_data parameters, or firing pixels before consent state is established, the platforms aren't measuring user behavior. They're measuring your stack's failure modes, and they're spending budget against them.
This is the gap the three pieces are circling. Consent is the first portal every signal passes through on its way out of the browser. The CAPI event that fires (or doesn't), the Enhanced Conversions parameters that travel with it (or don't), the modeled conversion Consent Mode v2 imputes when it doesn't, the audience that syncs to Performance Max, the bid the algorithm makes next: all of it is conditioned on what happens at that one gating layer. If the layer is miscalibrated, every measurement downstream is distorted. The ML doesn't know. The dashboard doesn't show it. The variance just drifts. And because the distortion happens upstream of the analytics conversation, none of the analytics tools are positioned to catch it.
iubenda's piece is making this case from the marketing-stack side: stop treating consent as paperwork and start treating it as a performance lever. Simo's note is making it from the ad-platform side: the implementation has been carrying less weight than people realize, and a hidden subsidy is going away. The California enforcement record is making it from the regulatory side: the gap between "CMP deployed" and "consent flowing end-to-end" is now legally and financially material, on top of being technically broken.
Three angles. Same finding. The mechanism is consent state integrity, and almost nobody is monitoring it.
What this looks like under a console
Disney's $2.75M settlement in February is the cleanest illustration. The opt-out machinery existed. The webforms were live. GPC signals were received. The signal just wasn't propagating across the services tied to a logged-in user's account, so the user opted out on one device and continued being tracked on another. That's a calibration failure, not an infrastructure failure. The infrastructure was deployed; the calibration was wrong; nobody was watching the boundary.
I ran a Signal Fracture Audit on a DTC supplement brand last week using only public browser data. The consent banner was a decorative ribbon. It captured no state. It blocked no cookies. The Consent Mode v2 update calls: non-existent. The site looked fine from the homepage yet leaked signal everywhere underneath: pre-consent firing on every page load, GPC ignored entirely, server-side container running with no consent payload propagated to it.
This is the norm, not the exception. CMP vendors sell the consent infrastructure. Compliance consultants check the paperwork. ML systems trust whatever signal arrives. Nobody is positioned to verify that the infrastructure is doing what the business thinks it's doing.
The relational frame, since it keeps coming up
There's a piece of this I've been turning over for a few weeks, and it doesn't quite fit in the dollar argument but it ties the three signals together. Consent isn't just permission. When the consent layer is calibrated, the brands a person opts into can find them, and the system shows ads that match what they actually care about. It's the same loop as a tuned organic feed: relevance is the whole product. When the consent layer is broken, the covenant breaks with it. Brands a person would never choose burn budget reaching them. Brands they would choose can't.
Calibrated consent is the precondition for advertising people actually want to receive. The mechanics produce the ethics, not the other way around. Consent is the place where measurement, performance, and ethics are the same problem, observed from three angles. That's the frame that ties iubenda's "performance lever," Simo's "single source of truth," and California's enforcement playbook together.
The lane
Compliance vendors sell paperwork. CMP vendors sell the infrastructure. Attribution platforms trust whatever upstream signal they get and add modeling on top. ML systems train on whatever crosses the boundary. None of those positions has an incentive to verify that consent is doing what the business thinks it's doing.
That's the lane. Find the leak. Quantify it in dollars. Close it. No platform migrations. No six-month overhauls. A clear, honest read on what your consent layer is actually doing, what it's costing you in CAC and modeled-conversion exposure, and the next move.
Three voices in three weeks said the same thing without quite saying it: consent is load-bearing, most implementations of it aren't carrying the load, and the cost is becoming legible. Calibration over compliance. Find the leak. Quantify it in dollars. Close it.