A retargeting list is a bucket of people your pixel recognized. If a visitor rejects marketing cookies, your pixel never drops the tag, and that person never lands in the bucket. So the real size of your remarketing audience isn't your traffic. It's the slice of your traffic that opted in.
That slice is smaller than most marketers assume. Consent rates swing widely by region and design, and every rejected visitor is one you can't chase with a display or social ad later. This guide covers what actually happens to your audiences under consent, the platform minimums that decide whether a list even delivers, and what to do about the shortfall.
Why the pool shrinks
Retargeting depends on a first-party or third-party identifier written during a site visit: the Google Ads tag, the Meta Pixel, a remarketing cookie. Under GDPR and the UK's PECR, you can't write those for advertising purposes before the visitor agrees. So the flow is simple. Visitor rejects marketing cookies, tag stays dormant, no list membership.
Do the math on your own numbers. If 100 people visit a product page and 45 accept marketing cookies, your addressable retargeting pool from that page is 45, not 100. Subtract anyone sending a Global Privacy Control signal or browsing in a region where you default to reject, and it drops further. The pool isn't just smaller once. It refills slower on every campaign you run.
Platform minimums just moved in your favor
Both big platforms enforce a floor: a list has to reach a minimum active size before it can serve ads, mostly to protect user anonymity. Those floors used to punish sites with low consent rates, because a shrunken pool couldn't clear the bar.
That changed at the end of 2025. Google lowered the minimum audience size to 100 active users across Search, Display, and YouTube, for both remarketing lists and Customer Match lists, down from the long-standing 1,000-user threshold on Search and YouTube. The same 100-user floor now applies to Audience Insights. For advertisers whose consented pools never reached 1,000, that's the difference between a list that delivers and one that sits idle.
Meta sets its own floor. A Custom Audience generally needs about 100 people before it can be used for delivery. That's the technical minimum, not the practical one. Ad sets built on audiences under roughly 1,000 users often struggle to exit the learning phase, which shows up as unstable delivery and higher cost per result. A small consented pool doesn't just limit reach. It starves the optimizer of the signal it needs to bid well.
Consent Mode helps measurement, not audience building
Google's Consent Mode advanced implementation keeps a Google tag on the page even when a visitor rejects, sending cookieless pings that feed conversion modeling. Marketers sometimes assume that means their audiences are protected too. They aren't. Modeling reconstructs aggregate conversions. It does not let you build a personalized remarketing list from someone who said no to ad cookies. You can model what rejected users probably did in aggregate. You can't retarget an individual who never consented.
So treat the two problems separately. Consent Mode is a measurement recovery tool. Your retargeting pool is still only the people who opted in.
Rebuilding reach
Four levers actually move the needle.
- Lift your consent rate, honestly. The single biggest input to audience size is the share of visitors who accept. Clear copy, a real reject option at button parity, and tested layouts move accept rates without dark patterns. See our guide on raising consent rates without dark patterns.
- Lean on first-party lists. Customer Match (Google) and Custom Audiences from a customer list (Meta) let you upload hashed emails you collected with marketing consent. Those lists don't depend on a pixel firing during a browsing session, so they sidestep the cookie-consent bottleneck entirely, provided your email consent covers advertising use.
- Protect first-party cookie lifespan. Even consented visitors get shorter cookie windows under Safari's Intelligent Tracking Prevention, which caps client-set cookies at seven days. Server-side tagging extends that horizon so your consented audiences don't expire prematurely. See first-party cookies and server-side tagging and Safari ITP for marketers.
- Size the pool before you plan spend. If you know 40% of a segment consents, you know your real ceiling. Build the media plan around the addressable number, not the traffic number.
Where CookieBeam fits
You can't manage what you can't see. CookieBeam's consent analytics break the accept, reject, and customize split down by region, so you know what share of each traffic source actually enters your retargeting pools. When you want to grow that share, the built-in A/B testing runs banner variants against each other and reports the consent-rate difference, so you're optimizing on measured behavior rather than a hunch. Neither trick manufactures consent you don't have. They just tell you the truth about your addressable audience and help you enlarge it within the rules.
The takeaway: retargeting reach is a function of consent, and consent is measurable and improvable. Start by learning your real pool size, then decide whether the fix is a better banner, a first-party list, or a longer cookie lifespan. For the related problem of seed quality in lookalike targeting, see cookie consent and lookalike audiences.