Google Consent Mode and Cookiebot CMP

What is Google Consent Mode and why is it a big deal?

Mass collection of users’ personal data from users for targeted advertising online has created a rift. On one side are efforts to protect users from abuse and privacy infringements, and on the other is securing marketing revenue and analytics for websites that rely on this. This data and revenue are needed not only to survive, but also to provide the free content and information that has come to define the Internet as we know it.

Google Consent Mode is a tool that bridges the gap between data privacy and data-driven digital advertising by helping to make sure that your website’s analytics and marketing can run seamlessly based on each specific user’s consent choice.

Consent Mode adjusts how Google services collect users’ data based on their consent preferences. When a visitor opts in or out, Google Consent Mode directs Google Analytics and advertising services to either collect full data (opt in) or only anonymized data (opt out), which doesn’t include personally identifiable information.

Originally designed to communicate users’ consent preferences to Google tags for analytics and advertising cookies, Google Consent Mode has since evolved to function more as a signaling tool. Its latest update in November 2023 enables website owners to comply with global data privacy laws, integrate systems, and respect users’ consent choices automatically.

Consent is becoming a stable requirement of most data privacy laws in the world, including theEU’s General Data Protection Regulation (GDPR), which assigns the responsibility of obtaining end-users’ consent prior to processing personal data to website owners and data controllers.

Google Consent Mode helps build a more sustainable internet economy that brings both elements into greater balance. The tool helps move towards a consent-based dynamic system that respects the privacy and dignity of each individual user without breaking the underlying business model of large parts of the Internet.

What services does Google Consent Mode support?

• Google Analytics
• Google Ads (Google Ads Conversion Tracking and Remarketing)
• Floodlight
• Conversion Linker

Google Consent Mode can also signal consent state for third-party tags using the “additional consent” settings if it is manually configured for this purpose.

How does Google Consent Mode work?

Google Consent Mode is an API that can be used with a consent management platform (CMP) like Cookiebot CMP, with the global site tag (tag.js) or Google Tag Manager (GTM).userce

It enables your users’ consent state to determine how Google’s tags and scripts behave on your website, even though they load before the consent banner appears for users. These tags won’t be able to use browser storage though, and personal data will be redacted. 

Once consent has been granted these tags gain their normal capabilities.

Your CMP collects user consent preferences, and Google Consent Mode transmits these to Google for further processing. Tags dynamically adjust their behavior, i.e. whether they collect full or anonymised data, based on whether users accept or reject cookies for a specific purpose.

An additional feature, Consent Initialization, enables tags that require user consent choice to fire before all other tags. 

With the Google Consent Mode updates to Google Tag Manager, you can now see and customize each tag’s consent settings, as well as see which types of consent each tag requires in the Consent Overview.

Google Consent Mode introduced two new tag settings that will manage cookies for analytics and advertising purposes on your website: 

• analytics_storage
• ad_storage

Google Analytics 4 (GA4) Consent Mode

With the “analytics_storage” tag setting, Google Consent Mode controls the behavior of statistics cookies on your website based on the consent state of your end users, making Google Analytics 4 adjust its data collection based on the granular consent choice of each individual user.

If users don’t give consent to statistics cookies, for example, your website will still receive aggregate and non-identifying basic measurements and modeling data, such as:

• timestamps of visits to your website
• user agent, i.e. whether users landed on your website
• referrer, i.e. how the user landed on your website
• whether the current or prior page in user’s navigation includes ad click information in the URL
• random number per each page load

Google Ads Consent Mode

With the “ad_storage” tag setting, Google Consent Mode controls the behavior of marketing cookies on your website based on the consent state of your end users. For example, if a user doesn’t consent to marketing or advertising cookies, Google Consent Mode will ensure that all marketing-related Google tags will adjust and not use those cookies.

If users do not give consent to marketing cookies, your website will still be able to show contextual advertisements based on anonymous data instead of targeted advertising based on tracking of personal data..

Google Consent Mode enables your website to measure conversions related to a specific campaign on an aggregate level, rather than on an individual user level. This helps ensure that you get insights into the performance of your website’s marketing in a fully GDPR-compliant way without the use of personal data.

Additionally, Google Consent Mode enables Google tags to change behavior if a user later changes their consent state. It also enables you to configure Google tag behaviors to specific regions, e.g. automatically ensuring that no cookies are activated without consent for users inside the EU, while using cookies for users in the US.

By using Cookiebot CMP and Google Tag Manager together you can now control all tags on your website based on the consent state of your end users without manual configuration.

Combining Google Consent Mode with Cookiebot CMP enables you to receive vital insights and analytics through conversion modeling and non-identifying data if your end users choose to opt out of cookies.

Conversion modeling for Google Ads

Another feature of Google Consent Mode, introduced in April 2021, is conversion modeling, a probability-based and privacy-friendly measurement tool for ad interactions and conversions on your website.

Conversion modeling provides anonymous analytics data on your website for users who choose to reject or decline cookies, filling in missing attribution paths by using observable data from people who chose to opt in to cookies and thereby giving you an estimate of how the anonymous users might have behaved on your domain as well.

Conversion modeling is integrated automatically in your Google Ads campaign reports.

What changes does Google Consent Mode v2 bring?

Google has introduced two new tag settings with the latest version of Google Consent Mode released in November 2023. These two new tag settings are set based on the same trigger as the “ad_storage” key:

• ”ad_user_data”: determines whether personal data is sent to a Google service
• “ad_personalization”: determines whether data can be used for displaying personalized ads (e.g. for remarketing)

How do you integrate Google Consent Mode with Google Tag Manager?

Google Tag Manager (GTM) can be integrated with or without a Consent Management Platform (CMP).

With a CMP: Some CMPs, including Cookiebot CMP, come with a Tag Manager template that’s designed to work with the Consent API. This template is readily available within the Google Tag Manager interface, which reduces the need for coding and makes the integration process easy to set up.

Without a CMP: Implementing Google Consent Mode without the Cookiebot CMP template tag is only slightly more difficult, as you would need to add an additional script that must be loaded before the Google Tag Manager container.

Cookiebot CMP and Google Consent Mode

Cookiebot CMP fully integrates with Google Consent Mode right out of the box.

• Cookiebot CMP scans and detects all cookies and trackers on your website, automatically blocking them until your end users give their consent.
• Cookiebot CMP enables users to give their consent through a highly customizable consent banner on your website that is user-friendly details on each specific cookie (such as purpose, provider and duration).
• Cookiebot CMP forwards the consent state of the user to the Google Consent Mode, which then determines the behavior of all tags and scripts from its services based on the consent state, e.g. through Gtag.

Once users give their consent through Cookiebot CMP, only the consent state is forwarded to Google – i.e. no personal data is sent from Cookiebot CMP to Google, but only the specifics of the anonymous user’s consent, e.g. whether they have accepted marketing cookies or not.

Example: Cookiebot CMP and Google Consent Mode at work

A user visits your website and is presented with a Cookiebot CMP consent banner that shows them four cookie categories up front and the option to see how many cookies and trackers the Cookiebot™ scanner has found on your domain.

The user chooses not to give their consent to any analytics or marketing cookies, and Cookiebot CMP keeps blocking all such trackers from activation, respecting the user’s consent choice.

Cookiebot CMP sends the user’s consent state to Google Consent Mode, and this specific consent state becomes the basis of operation for all Google services that you are using on your website, e.g. by controlling Google Analytics data collection based  on user consent states.

Try Cookiebot free for 14 days… or forever if you have a small website.

Consent is sustainable, targeted advertisement is not

A “wild west” environment where the mass collection of user data has existed for years on the Internet, but only really surfaced to public knowledge over the last few years. Major news headlines about data breaches and questionable operations by large tech companies have contributed to creating distrust in big tech companies, in addition to growing public awareness of data privacy.

Landmark data protection laws have emerged, partly as a response, most notably the EU’s General Data Protection Regulation (GDPR). That regulation empowers individuals in Europe with enforceable rights over the data they generate every day, and defines clear rules and responsibilities for websites and tech companies when processing this data.

Google, consent and the “hard block”

Consent management platforms are a safe and effective way for websites to become compliant with the GDPR, by handing over the controls for the activation of cookies and trackers to the user through consent.

But when users choose not to consent to analytics and marketing cookies through a website’s CMP, this often means a hard block of the domain’s analytics and marketing services. These run on such cookies and trackers, so such actions effectively cut off vital analytics insights and marketing revenue streams that are crucial for the commercial survival of not only major tech companies or media domains, but smaller, independent websites and ecommerce operations as well.

Ad blockers and privacy browsers have acted as self-defense tools for end users, but have not been able to solve the larger, structural issues around the coexistence of data privacy and digital advertisement, partly because of their blanket approach to blocking everything, and partly because many users don’t have the time or the skills to defend themselves in this way to begin with.

Add to this research showing targeted advertisements provide only marginally better results compared to contextual advertising that isn’t based on users’ personal data, and the industry move away from mass personal data collection for privacy-infringing behavioral advertising seems to have been an event horizon coming ever closer.

Google moves the Internet, again

When Google launched Consent Mode in September 2020, website operators got new options so it was no longer only a choice between protecting user privacy and optimizing opt-in rates for websites big and small.

Harvard Professor Emeritus Shoshana Zuboff argues in The Age Of Surveillance Capitalism that surveillance capitalism — the business model of mass data collection for user behavioral predictions — started in 2002 when Google decided to commodify the unfathomable amounts of data their search engine collected.

In 2020, Google’s decision to move the digital advertising industry in the direction of consent with the launch of the Google Consent Mode marks a defining chapter in this story, providing a way forward to a more safe, private and fair Internet.

Consent in the making

Consent is the basis of the EU’s GDPR, ePrivacy Directive and the Digital Markets Act (DMA), as well as data privacy laws in other countries, such as Brazil’s LGPD, because it empowers individuals with enforceable rights over all the digital traces of their lives, they live online every day.

But in practice, consent keeps evolving to become more complex. It was once a mere scroll on a web page or pre-ticked checkboxes on cookie banners.

In 2002 and 2009, the ePrivacy Directive (also known as the “EU cookie law”) first introduced a requirement for cookie banners on websites. But these cookie banners only required website owners to state that the website uses cookies, with an accompanying “OK” button for users to click on. But cookies and trackers would already be in activation, rendering their consent meaningless.

In 2018, the GDPR carved out a clear definition of consent that many data privacy laws around the world have adopted or at the least reflected. Together with courts and data protection authorities this fundamental digital right keeps evolving.

The GDPR defines consent as the informed, prior, clear and unambiguous indication of a user’s wishes, i.e. that users must be made aware of exactly how your website processes personal data, what cookies and trackers are in use (including their purpose, provider and duration), and that users have the ability to give their explicit consent to each of these before any processing of their personal data can take place.

The Digital Markets Act (DMA), which came into force on November 2022 in the European Union and European Economic Area, reinforces the definition of consent under the GDPR, and requires the companies it has designated as “gatekeepers” under the regulation, as well as third-party businesses using the gatekeepers’ platforms, to collect and process user data only after obtaining valid consent, per this definition.

Cookiebot CMP has pushed to shape consent management since 2012, to make “consent” a no-nonsense term with real-world application: the explicit, informed and empowered voice of the individual person being the governing force for the processing of personal data on our digital infrastructures.

Try Cookiebot CMP free for 14 days… or forever if you have a small website.

FAQ