Google Consent Mode: balancing user privacy and analytics

Google Consent Mode is a tool that enables websites to communicate users’ cookie consent choices to various Google tags that help measure website and advertising performance. The tool was initially used primarily for anonymized data tracking. However, its intent and use have evolved, and today it functions more as a signaling tool.

With the November 2023 updates, website operators can continue to meet compliance requirements, integrate systems, and respect users’ consent choices automatically.

Google Consent Mode can be used with a consent management platform (CMP) like Usercentrics CMP, or directly with the global site tag (gtag.js) or Google Tag Manager (GTM).

A user’s consent preferences determine whether Google collects and processes their full data or anonymized data that can’t personally identify the user.

One of the primary reasons to use Google Consent Mode is to achieve or maintain compliance with global data privacy regulations, including the General Data Protection Regulation (GDPR).

• Google Consent Mode currently supports the following Google services:
• Google Analytics
• Google Analytics 4
• Google Ads (Google Ads Conversion Tracking and Remarketing)
• Floodlight
• Conversion Linker

It’s a simple, convenient customization and another way to stay one step ahead of evolving legal and technology needs for data privacy compliance.

Quite simply, using Google Consent Mode gives you a competitive advantage. Achieving and maintaining GDPR compliance is very important, but that’s a requirement, rather than a benefit. The stick, rather than the carrot. To date so much data privacy media coverage still focuses on what companies and advertising are losing, rather than what they’re gaining.

With Google Consent Mode, data- and consent-driven marketing is not only possible, but it also helps you futureproof your operations. It helps you leapfrog ahead of competitors that are still stuck trying to figure out how to continue to do things the old way and change as little as possible.

Companies need to comply with relevant data privacy laws, and they need user data to drive marketing decisions and secure ad revenue. These requirements do work together. Google Consent Mode enables website operators to get a substantial percentage of data back for advertisers. You can optimize consent rates and gain conversion insights for people who do not provide consent.

Building and maintaining user trust is critical to companies’ success, and transparency is a big part of that. Being transparent about privacy law requirements and why you’re asking for your users’ data is a key part of that.

Google Consent Mode helps website operators to move away from mass collection of users’ personal data to a dynamic, consent-based system. The advertising business model remains intact while respecting individuals’ privacy. Marketers still get data they need and clarity on conversions.

Google tags are loaded onto web pages before the cookie consent banner appears, so Google Consent Mode enables websites to dynamically adjust the behavior of these tags once a user allows or rejects cookies. Measurement tools will only be employed for specifically determined purposes if the user has given consent.

Usercentrics CMP collects user consent preferences, which Google Consent Mode transmits to Google for further processing. Users can accept all cookies, reject all (except strictly necessary cookies), or accept some cookies while rejecting others. Users’ privacy preferences are maintained at every step, and companies maintain the ability to make data-driven decisions.

Google Consent Mode added two new tag settings to manage cookie behavior based on user consent choices:

• “analytics_storage”: determines how analytics services (e.g. Google Analytics) behave
• “ad_storage”: determines how ad services (e.g. Google Ads) behave

Website owners can use conversion modeling to gather insights from anonymized data collected from users who reject cookies.

With the new version of Google Consent Mode, Google introduces two additional tag settings which are set based on the same trigger as the “ad_storage” key. The two new key tag settings are:

• ad_user_data: controls whether personal data is sent to a Google service
• ad_personalization: controls whether data can be used for ads personalization (e.g. for remarketing)

Google Consent Mode uses the “analytics_storage” tag to manage how GA4 cookies behave based on user consent.

If a user gives consent for analytics cookies, GA4 will collect full data from the user for statistics or analytics purposes. If a user rejects analytics cookies, then GA4 limits the data it collects to information that can’t personally identify the user, such as the browser or operating system of the device from which the user visited the website, and the referrer or how the user came to the website.

Google Consent Mode uses the “ad_storage” tag to manage how Google Ads cookies behave based on user consent.

If a user gives consent for ads cookies, Google Ads will collect full data from the user for marketing or advertising purposes. Suppose a user rejects cookies for advertising purposes. In that case, any Google Ads the user sees will not be targeted or personalized based on their data, as Google tags will not use advertising cookies.

Data from cookies is useful to help website owners track and identify users, study user behavior on their website and see the effectiveness of their ad campaigns and messaging in converting users to customers, among other things.

When users consent to cookies, gathering comprehensive data becomes straightforward and makes precise ad targeting and data analytics easier. When users reject cookies, these are a little harder to do so since the data collected is restricted and anonymized, causing gaps in the analytics.

Google uses Machine Learning to fill in the gaps with conversion modeling. It studies data and trends from users who consented to cookies and estimates the behavior of users who reject cookies with the help of this data.

Google Consent Mode can be integrated with Google Tag Manager in two ways, depending on whether the website owner uses a consent management platform (CMP).

With a CMP: By using the CMP’s Tag Manager template, which is integrated with the Consent API. This can be done from within Google Tag Manager itself, requires minimal coding and saves website owners’ time and effort.

Without a CMP: By creating a custom Tag Manager template, which requires coding knowledge and the help of a developer to build, implement and update.
Once Google Consent Mode and Google Tag Manager are integrated, user consent choices are passed on to Google Tag Manager, which then manages how cookies behave for a user’s visit.

Implementing Google Consent Mode with the Usercentrics CMP solution as an alternative to prior blocking can be done in a single step, though existing customers and those with custom data processing services should note the additional information below.

✔ Adjust the existing Google Tag Manager code by adding a few lines of code above your Google Tag Manager tag.

✔ If you are an existing customer, ensure the Google Consent Mode option is toggled ON in the Usercentrics Admin Interface.

✔ For new customers, Google Consent Mode is ON by default.

✔ If you have customer data processing services, use the Usercentrics CMP events to signal the consent status via the Consent Mode API.

We also have a convenient feature that automates the process of enabling Google Consent Mode in Usercentrics CMP. Get it up and running in two easy steps.

Google Consent Mode does not replace a CMP; it serves as a link between the CMP and Google. This becomes increasingly important with the enforcement of the Digital Markets Act (DMA) in the European Union as of March 2024. With Google designated one of the “gatekeeper” companies, third-party companies using its services will need to be able to achieve valid privacy compliance and signal consent to Google, e.g. for advertising.

Google Consent Mode is an interface that enables Google services to run on websites based on the types of consent collected from website users, without requiring Google to have direct access to personal data or denying companies access to information they need to drive conversions.

Obtaining user consent remains the website operator’s responsibility, and with the help of a consent management solution, you can collect granular user consent for all cookies and tracking technologies in use on the site in accordance with the GDPR and other data privacy laws.

By pairing the Consent Mode API with the Usercentrics Consent Management Platform (CMP), websites can indicate if the user has given consent for cookie usage related to analytics and/or advertising. The supported Google tags will respect this signal and adjust their behavior accordingly, only utilizing cookies if consent was granted for the specific purposes.

Website operators can use Google Consent Mode instead of prior blocking of the Google tags. This is beneficial because the tags are not blocked outright when consent has not been given. Instead, Google will use the signal to adjust tag behavior based on the user’s consent preferences in the Usercentrics CMP. The technologies mutually benefit each other, streamlining both the user experience and data management.

For example, if the website user decides to reject the use of cookies or trackers for certain marketing technologies, Google Consent Mode will react based on this consent status and will only display purely context-based advertising on the website, without using any personal data.

Google Consent Mode has been created especially for website operators who do not obtain user consent within the scope of the IAB Transparency and Consent Framework (TCF) with their Consent Management Platforms (CMP).

For companies actively using the IAB TCF 2.2, Google Tools will continue to read out and respect the IAB TC String.

Website operators wanting to use cookies or other tracking technologies on their websites—either for marketing purposes or for processing users’ personal data within the EU—require consent from the users as stipulated in the GDPR.

More importantly, consumers are increasingly aware of the collection and use of their data online, and companies need to provide user-friendly transparency about their privacy compliance and data collection, as well as providing choice, to build and retain user trust.

Proactively embracing consent-based marketing helps protect companies’ revenue and brand reputation, and helps them get ahead competitively. The future includes a focus on driving revenue by optimally leveraging technologies that address companies’ responsibilities and serve users’ needs. Companies can evolve their marketing efforts with smart, data-driven decisions. Privacy compliance simply can no longer be ignored.

According to Google, if the user does not provide consent to tracking via Google Analytics 4 (“analytics_storage: denied”), all data will be anonymized. This means that it will be captured without a client ID and recorded in aggregated form. Google will not collect any personally identifiable information when a user has denied consent.

Additionally, if the placement or reading out of advertising cookies is prevented (“ad_storage: denied”), the main processing purposes for which user consent is usually obtained will no longer react.

Opinions differ. According to the Orientation Help for Providers of Telemedia (DE) from the Datenschutzkonferenz (DSK), reach measurement can indeed represent legitimate interest for the website operator. But it is always necessary to first weigh website operator vs. user interests. If no personal data is forwarded to third parties (e.g. Google), and the data is not to be used for the third parties’ own purposes, legitimate interest might be claimed.

However, since IP address is transmitted during most interactions with website visitors, and according to the German Federal Court of Justice IP address is considered personal data, a fully anonymous interaction is not possible in most cases.

If a website operator does not think that collecting consent is necessary, from a technology perspective they must ensure that an anonymous interaction is possible in 100% of users’ website interactions. Website operators must also ensure that the forwarding of users’ personal data to servers in the USA is prevented. “Third country” is the key term here, otherwise consent will always need to be collected. Plus, beyond just legal compliance, being consent-focused is important for building user trust with the brand.

The point of “do I need consent?” is becoming irrelevant, however, as data privacy compliance obligations from regulatory authorities and dominant platform and service providers evolve. Many third-party companies that rely on those platforms need to achieve data privacy compliance and be able to signal it to maintain access to the audiences and data (and thus revenue) these platforms enable. This is in addition to avoiding penalties from government regulators.

With valid consent collection from website users, advertisers can continue to optimize opt-ins, measure conversions and retrieve analytics insights with Google Consent Mode while achieving and maintaining GDPR compliance. With Consent Mode, Google combines protection of users’ data with companies’ and the advertising industry’s interests, seamlessly combining marketing and privacy.

Data-driven business models will remain strong, using explicit consent and not at the expense of anyone’s privacy.

The simplest way to obtain granular, GDPR-compliant user consent for the use of cookies and other tracking technologies is via a consent management platform (CMP). With this tool, users can determine their data privacy preferences in detail with the help of a consent banner. They have the ability to agree to the use of certain technologies via opting in as well as opting out.

Even better, the full customizability of the Usercentrics CMP means you maintain your branding, can comply with multiple privacy regulations, and can continually optimize for higher opt-in rates. You’re also building trust by providing transparency to your users. Sounds easy? It is!

Keep in mind: the higher your consent rates are, the more data that will be available for marketing purposes, which boosts advertising revenues.

DISCLAIMER

Usercentrics does not provide legal advice, and information is provided for educational purposes only. We always recommend engaging qualified legal counsel or privacy specialists regarding data privacy and protection issues and operations.