A Guide to Google Consent Mode

What is Google Consent Mode?

Originally introduced to operate alongside cookie consent systems, the initial version of the Google Consent Mode (GCM) library was designed to enforce what information a Google product could store against a user’s browser. Set up correctly, this would give the user control over whether they could be identified as an individual over their lifetime on a given website. This applied to all Google products, including Google Analytics 4 and Google Ads.

The main benefit of this approach (rather than blocking all tracking until consent is given) is that data can still be transmitted to Google’s servers and used within conversion modelling, but without breaching a user’s consent. Specifically, it allows the controller of Google Consent Mode to define whether a given marketing platform can store cookies against a user’s browser.

The system is created in such a way that other third-party marketing platforms can also respect the defined consent, however, most do not or implement their own variations – these should also be considered for the businesses wide consent compliance.

Towards the end of 2023 Google announced a critical update to Google Consent Mode coming in March 2024, named “Google Consent Mode v2”, which expands on the original system to:

• Define if Google can use user data for building advertising audiences.
• Define if Google can use the data for remarketing purposes.

Why is there a renewed importance?

Recently there has been fresh activity around the discussion of having Google Consent Mode v2 implemented on businesses’ websites. This is in response to new legislation within the EEA, where explicit consent needs to be collected from the user for these additional definitions. This needs to be added to websites by March 2024.

Failure to implement the new definitions mentioned above, or to have Google Consent Mode implemented at all, will result in no new data being processed for audiences and remarketing, effectively turning these important features off in platforms such as Google Ads.

Can Google tracking just be blocked until the user accepts?

Instead of using Google Consent Mode, some businesses opt to outright block any Google tracking tags until a user accepts the applicable consent choices.

Until now, this has given those businesses a similar output to those using Google Consent Mode (albeit with no conversion modelling or raw data within BigQuery). However, going forward this is not enough.

Regardless of whether the tracking libraries are outright blocked or not, without defining the specific Google Consent Mode v2 flags, Google cannot use the given data in its platforms. Therefore, this will turn off those audience and remarketing features.

Who does this change affect?

The new legislations only apply to users within the European Economic Area (EEA). Any users outside of the EEA will not be impacted and Google will continue to use their associated data as it currently does.

It is very important to note that this does not just mean a business that operates within the EEA, it specifically references user location.

This means that an international website that accepts traffic from European countries will need to have Google Consent Mode v2 configured and operational by March 2024.

Configurations can be set up to apply different rules based on the user’s location, however, it is often advised to apply the same rules to all users.

This is a business decision that needs to be made before beginning the implementation process and there are pros and cons to each option.

What are the definitions that need to be set?

The table below outlines the 7 definitions that can be set within Google Consent Mode v2, however, it is only the first 4 that are relevant to Google marketing and analytics platforms. These are the only ones that need to be focused on currently.

Each of these flags can have one of two states, either “granted” or “denied”. If set to “denied” the applicable platform will not be able to store or act on specific data against the current user.

Having a “denied” setting does have some use, in that tracking can still operate but any information is not associated between page loads. Meaning a platform cannot follow a user across their journey, but you can still understand how many page views / types of source / conversion occurred.

How are these definitions set?

This varies vastly from one website implementation to another. Some consent systems have Google Consent Mode built in, so simply updating their configuration will enable the newer Google Consent Mode v2 required settings.

Some consent systems only collect a response from users but do not govern any tracking platforms, these will therefore need updating manually.

Some websites do not have anything in place and are not only considered non-compliant but will also be affected by these new updates. Each configuration will eventually boil down to defining the flags in this document against the Google Tag library.

Regardless of the implementation, Google Consent Mode has to be tested before the end of March 2024 to ensure that there is no disruption to tracking and marketing efforts.

How is consent collected from the user?

Google has not advised on how to collect consent as this would increase their legal obligations. This is a business decision that should be advised by internal legal teams.

Compliance does orientate around ensuring the user is asked to consent against each definition, with a clear description of what that option means for the user. If you use a paid third-party consent system, then these will tend to have the required definitions applied – although even then this should be queried and checked with legal teams.

In theory a business could decide to not put a consent system in place and configure Google Consent Mode v2 so that each definition is always set to “granted”. However, this would not be compliant to the legislation and legal teams should advise against this approach.

It is important to note that just querying the user for cookie consent is not considered compliant consent for the new Google Consent Mode v2 definitions.

Specifically, “ad_user_data” and “ad_personalization” do not store cookies on a user’s browser, they are flags processed by Google’s tracking endpoints. However, there are clients who have made the business decision to use their existing cookie consent definition for “ad_storage” for the two new definitions (“ad_user_data” and “ad_personalization”).

How can the current implementation be tested?

Testing implementation is not a simple process and requires observing the various Google tracking endpoints at multiple interaction states, as well as how the configuration on-site has been put together. For example, is there a tag management platform injecting tracking tags, but a separately injected consent system?

We strongly advise having an expert review the configuration and provide actionable next steps for a specific setup.

If you need with either setting up or reviewing your configuration, make sure to get in touch today and one of our team of experts will be happy to help before the deadline in March.