Google’s Consent Mode remains an important topic, especially as from 2024 it will be mandatory to implement Consent Mode if a website or app collects data for audience building or remarketing with Google’s ad services.
With Google Consent Mode V2, the biggest updates are two new consent signals: ad_user_data and ad_personalisation, as well as a revised URL scheme for passing consent states to Google’s services.
In this blog, we will dig deeper into everything you need to know about Google Consent Mode V2.
What does Consent Mode V2 do?
Consent mode is used to determine how Google may handle the data of visitors to your website, and this also applies to all your other platforms. This way, you match your visitors’ privacy expectations.
With the introduction of consent mode V2, a more advanced version, you make sure you don’t miss out on important conversion metrics. Read on to discover what further impact this will have on your operations.
This approach to collecting analytical data and ad signals from users who have not given consent is based on the principle of avoiding browser storage access. As a result, cookies containing personal information (such as online identities) are not used by Google’s services, but temporary, random identifiers are deployed instead.
Data for which consent has not been obtained is not shown directly in Google’s reports. Instead, this data undergoes a process of modelling, where it is shaped to resemble legitimate data collected from users who did give consent.
What’s new in Consent Mode V2?
In V2, the original Consent Mode signals (ad_storage for ad cookies and analytics_storage for analytics cookies) are supplemented by two additional signals:
- ad_user_data: does the user consent to the use of their personal data for advertising purposes?
- ad_personalisation: does the user consent to the use of his data for remarketing?
Consent Types
Unlike ad_storage and analytics_storage, these have no functional impact on how the tags behave on the site itself. They are additional parameters sent to Google services with the pings, designed to instruct these services on how user data can be used for ads.
So while ad_storage and analytics_storage are qualifications for data (since they determine which identifiers are sent with the pings), ad_user_data and ad_personalisation are instructions to Google services on how to process the data.
Consent Mode has additional, more advanced settings such as ads_data_redaction, which prevent the transmission of third-party click identifiers or decorations on ad streams. In addition, there are settings such as allow_ad_personalisation_signals that also determine what type of data Google’s ad services can access. If there is a conflict between these settings and Consent Mode, the “strictest” setting wins in favour of data protection.
Google Consent Mode offers two levels of implementation – Basic and Advanced.
Basic implementation of Consent Mode V2
If a user consents to cookies, the website functions normally, activating all tags and collecting full data. If a user does not give consent, no data is collected and no cookie pings are sent. This is quite simple, but significantly limits data collection if users do not give consent.
To implement Basic Consent Mode, website owners need to:
- Set up a Consent Management Platform (CMP) to manage user permissions.
- Configure their website so that when a user rejects cookies, Google Analytics 4 (GA4) tags or similar tags are not triggered.
- Integrate a consent flag to communicate the user’s consent decision to Google.
Advanced Implementation of Consent Mode V2
This offers a more nuanced approach. Even if users do not consent to cookies, it allows anonymous, cookie-ess pings to Google for modelling purposes. This allows websites to recover some level of data for Google Ads and GA4, even without user consent.
In Advanced Consent Mode, implementation includes:
- Use of a CMP to manage user permissions.
- Configuring the website so that GA4 cookies are not set if consent is denied, but a consent flag is passed to Google.
- Sending cookieess pings to Google for data modelling.
More a requirement than an option
The Digital Markets Act (DMA) and Google Consent Mode V2 are closely linked, especially in the context of digital advertising and privacy regulations. This legislation requires “gatekeepers” such as Google to obtain explicit consent before collecting and using personal data from European citizens. In response to this and other privacy regulations, Google has updated its Consent Mode to version 2, making it mandatory for advertisers who want to use Google Ads for remarketing and auto-bidding.
It is essential for advertisers and publishers, especially in the European Economic Area (EEA), to ensure compliance and maintain the quality of their audience and measurement data in Google Ads. Without the implementation of Consent Mode V2, no data on new EEA users will be captured after March 2024 by ad platforms such as Google Ads and GA4, which has a significant impact on ad strategies and effectiveness. Below you can see an image showing what will soon be impossible if you do not comply with these regulations.
Cookiebanner met de Google Consent Mode V2
To use Google Consent Mode V2, it is necessary to have a cookie banner. This means having or getting a CMP that is in line with Google’s standards, as well as the GDPR and the e-privacy directive. The functionality of Consent Mode V2 depends on the language of the banner being in line with Google’s standards for compliance.
How it works: when a user gives consent, the cookie banner communicates this to Google through Google Consent Mode, allowing normal data collection. And vice versa: if consent is rejected, Google reduces data collection from those users. In this scenario, Google uses conversion modelling, which uses machine learning to make connections between user interactions and conversions.
Consent Mode V2 and Server-Side Tagging
Google Consent Mode is required for both browser- and server-side tracking. It is a widespread misconception that server-side tracking removes the need for user consent for tracking, but this is incorrect. Even server-side tracking still requires user consent.
This is particularly relevant under the General Data Protection Regulation and the EU User Consent Directive, which require explicit, informed consent for data processing and handling.
When integrating Consent Mode with server-side tracking, you must ensure that user consent is respected on both the client side (browser) and server side. This includes:
- Configuring consent mode in web Google Tag Manager.
- Passing user permission from the web GTM to the server-side GTM.
- Setting up server-side tags to respect users’ consent status, for example by ensuring that data sent to platforms such as Google Ads respects the user’s consent decision.
- “Advanced Consent Mode” involves sending signals to Google services from users who have not given consent. This practice can improve the quality of data modelling for GA4 and conversion tracking in Google Ads. However, consult your legal team on the implications of collecting data from users without their consent.
Should I use Consent Mode V2 in 2024?
Yes, especially if you are in or your site visitors are data subjects in the European Economic Area.
At the very least, you will most likely have to implement Basic Consent Mode for all your Google tags by 2024. It’s not necessarily a bad thing, even if it requires additional tagging and implementation resources. Since you only collect data from users who give consent, Basic Consent Mode simply means communicating this granted state to Google’s services with the data collected.
However, if you use Google’s advertising services (either directly or through Google Analytics 4), Consent Mode may be mandatory.
- If you collect first-party user data, or use the Google Ads user_id, or share Conversions from Google Analytics 4 to Google Ads, you must implement Consent Mode and set the ad_user_data flag.
- If you collect data for remarketing with Google’s ad services, you need to implement Consent Mode and set the ad_personalisation flag.
As far as I know, conversion tracking does not require Consent Mode and should work fine without it. However, you will obviously lose some of the benefits of conversion modelling if you choose not to implement Consent Mode.
If you want or need to implement Consent Mode, you should do so as soon as possible, but at least before March 2024. Consent Mode should be deployed as early as possible on the page or in the app rendering flow. Google Tag Manager for the web has a built-in trigger, Consent Initialisation, for this.
What if Consent Mode is not implemented by March 2024?
It is likely that audience building and remarketing capabilities will be limited or even completely disabled for the data collected from your digital properties.
Similarly, links between Google Analytics 4 and Google’s advertising services related to the above features will also not be functional.
As mentioned earlier, it is still not clear if and how much conversion tracking will be affected. Since it does not rely on user data collection similar to audience generation and remarketing, it is likely that it will continue to work to some extent.
In any case, if you want to use Google’s analytics and advertising services, we highly recommend putting Basic Consent Mode on your roadmap as soon as possible.
Does anything change from a data protection perspective?
We are not a legal team so we cannot advise you properly on this. We only know that this is important and so recommend it to everyone.
To keep it simple: nothing will change. Assuming you have so far only collected data from users who have given consent.
The data collected from these users looks pretty much the same as before – it just has the extra “permission granted” signal in place, and it may also include explicit instructions that the data can be used for Google’s advertising services.
Below is another good video that explains more about how Consent Mode works and what you can do with it.
