Google Consent Mode v2 – Automate user consent with Cookiebot CMP

Everything you need to know about Google Consent Mode and how to seamlessly pass on consent-based user data to activate Google Ads and Analytics with Google Consent Mode v2.

Google announcement: Adapt to privacy and regulatory changes with consent mode

In this article you can learn about Cookiebot CMP, a simple, automated consent solution that enables GDPR and ePrivacy compliance and supports Google Consent Mode v2.

With Google Consent Mode, you can take full advantage of conversion modeling for more comprehensive reporting and optimization when conversions cannot be tied to ad interactions.

Cookiebot is certified Google CMP and integrated with Consent Mode and Google Tag Manager, ensuring a seamless implementation, allowing you to capture valuable insights while protecting user privacy.

Google Consent Mode is a way for your website to measure conversions and gain insights into analytics while being fully GDPR-compliant when using services such as Google Analytics, Google Tag Manager (GTM) and Google Ads.

Google Consent Mode allows your website to run all Google services in one simple way: based on the consent of your end users.

Integration of Cookiebot CMP with Google Consent Mode v2

If you do business in the EU or EEA and want your data-driven marketing practices to continue uninterrupted, you need a consent management solution that supports the latest version of Google Consent Mode.

As an existing user of Google services (GA4 and Google Ads), it is time to take action. Implement Cookiebot CMP consent solution and signal user consent in a simple and automated way before March 2024.

Using Google Consent Mode with Cookiebot CMP ensures you receive essential consent insights and analytics through conversion modeling and non-identifying data.

Don’t risk ad breaks or lost sales.

How Cookiebot CMP and Google Consent Mode work together

1. Cookie and tracker management

Cookiebot CMP scans and detects all cookies and trackers on your website and blocks all cookies except the necessary ones until your end users give their consent.

2. Compliant consent collection

Cookiebot CMP allows users to give consent via a customizable cookie consent banner on your website. The cookie banner is user-friendly and can provide detailed information such as the purpose, provider and duration of each specific cookie, allowing simplified or personalized consent options.

3. Consent modeling and signaling.

Cookiebot CMP sends the user’s consent status to Google Consent Mode, which then determines the behavior of all tags and scripts of its services based on that consent status, for example, via Gtag.

What is Google Consent Mode and why is it important?

The massive collection of users’ personal data for targeted online advertising has created a gap. On one side are efforts to protect users from abuse and privacy breaches, and on the other is securing marketing revenue and analytics for websites that rely on them.

This data and revenue is needed not only to survive, but also to provide the free content and information that define the Internet as we know it today.

Google Consent Mode is a tool that bridges the gap between data privacy and data-driven digital advertising by helping to ensure that your website’s analytics and marketing can run seamlessly based on each user’s specific consent.

Consent Mode adjusts how Google services collect data from users based on their consent preferences. When a visitor gives or withholds consent, Google Consent Mode sends the Google Analytics and advertising services either complete data (opt-in) or only anonymized data (opt-out), which does not contain personally identifiable information.

Originally, Google Consent Mode was designed to communicate users’ consent preferences to Google tags for analytics and advertising cookies. Since then, Google Consent Mode has evolved into a signaling tool. The latest update in November 2023 allows website owners to comply with global data privacy laws, integrate systems and automatically respect users’ consent choices.

Consent is increasingly becoming a requirement of most data privacy laws around the world, including the EU’s General Data Protection Regulation (GDPR), which assigns the responsibility of obtaining end-user consent before processing personal data to website owners and data administrators.

Google Consent Mode helps build a more sustainable Internet economy that balances both elements in a greater balance. The tool helps the movement toward a permission-based dynamic system that respects the privacy and dignity of each individual user without breaking the underlying business model of large parts of the Internet.

What services does Google Consent Mode support?

– Google Analytics

– Google Ads (Conversion tracking and Remarketing from Google Ads)

– Floodlight

– Conversion Linker

Google Consent Mode can also signal consent status for third-party tags using the “additional consent” settings if manually configured for this purpose.

How does Google Consent Mode work?

Google Consent Mode is an API that can be used with a consent management platform (CMP) such as Cookiebot CMP, with the global site tag (tag.js) or Google Tag Manager (GTM).

It allows your users’ permission status to determine how Google’s tags and scripts behave on your website, even if they are loaded before the cookie permission banner appears to users. However, these tags cannot use browser storage and personal information is omitted.

Once permission is granted, these tags will regain their normal capabilities.

Your CMP collects user consent preferences and Google Consent Mode sends them to Google for further processing. Tags dynamically adjust their behavior, i.e., whether they collect complete or anonymized data, based on whether users accept or reject cookies for a specific purpose.

An additional feature, Consent Initialization, allows tags that require user consent to be activated before all other tags.

With the Google Consent Mode updates to Google Tag Manager, you can now see and customize each tag’s permission settings, as well as see what types of permission each tag requires in the Consent Overview.

Google Consent Mode introduced two new tag settings that will manage cookies for analytics and advertising purposes on your website:

– analytics_storage

– ad_storage

Google Analytics 4 (GA4) Consent Mode

With the “analytics_storage” tag, Google Consent Mode controls the behavior of statistics cookies on your website based on the consent status of your end users, allowing Google Analytics 4 to adjust its data collection based on each individual user’s detailed consent choice.

If users do not consent to statistics cookies, your website will still receive aggregated and non-identifying baseline metrics and modeling data, such as:

• timestamps of visits to your website
• user-agent, i.e., whether users arrived at your website
• referrer, i.e. how the user arrived at your website
• Whether the current or previous page in the user’s navigation contains ad click information in the URL
• random number with each page load

Google Ads Consent Mode

With the “ad_storage” tag, Google Consent Mode controls the behavior of marketing cookies on your website based on the consent status of your end users. For example, if a user does not consent to marketing or advertising cookies, Google Consent Mode causes all marketing-related Google tags to adjust and not use these cookies.

If users do not consent to marketing cookies, your website can still show contextual ads based on anonymous data rather than targeted ads based on personal data tracking.

Google Consent Mode allows your website to measure conversions related to a specific campaign at an aggregate level, rather than at the individual user level. This helps to gain insight into your website’s marketing performance in a fully GDPR-compliant way without the use of personal data.

In addition, Google Consent Mode allows Google tags to change behavior if a user later changes their consent status. It also allows you to configure Google tag behaviors specifically by regions, for example automatically ensuring that no cookies are enabled without permission for users within the EU, while cookies are used for users in the US.

By using Cookiebot CMP and Google Tag Manager together, you can now manage all tags on your website based on the permission status of your end users without manual configuration.

Combining Google Consent Mode with Cookiebot CMP allows you to receive vital insights and analytics through conversion modeling and non-identifying data if your end users choose to reject cookies.

Conversion modeling for Google Ads

Another feature of Google Consent Mode, introduced in April 2021, is conversion modeling, a probability-based and privacy-friendly measurement tool for ad interactions and conversions on your website.

Conversion modeling provides anonymous analytics data about your website for users who choose to reject or decline cookies by filling in missing attribution paths using observable data from people who chose to accept cookies, giving you an estimate of how anonymous users might have behaved on your domain.

Conversion modeling is automatically integrated into your Google Ads campaign reports.

What changes does Google Consent Mode v2 bring?

Google has introduced two new tag settings with the latest version of Google Consent Mode, released Nov. 2023. These two new tag settings are based on the same trigger as the “ad_storage” key:

– “ad_user_data”: determines whether personal data is sent to a Google service

– “ad_personalization”: determines whether data can be used to display personalized ads (e.g., remarketing)

How do you integrate Google Consent Mode with Google Tag Manager?

Google Tag Manager (GTM) can be integrated with or without a Consent Management Platform (CMP).

With a CMP: Some CMPs, including Cookiebot CMP, come with a Tag Manager template designed to work with the Consent API. This template is available directly within the Google Tag Manager interface, which reduces the need for coding and makes the integration process easy to set up.

Without a CMP: Implementing Google Consent Mode without the Cookiebot CMP template tag is a little more difficult because you have to add an additional script that must be loaded before the Google Tag Manager container is loaded.

Cookiebot CMP and Google Consent Mode

Cookiebot CMP fully integrates with Google Consent Mode.

By displaying the Cookiebot cookie consent banner on your website, you enable users to give consent for each cookie category.

• Cookiebot CMP scans and detects all cookies and trackers on your website, and automatically blocks them until your end users give their consent.
• Cookiebot CMP allows users to give their consent through a highly customizable consent banner on your website that provides user-friendly details about each specific cookie (such as purpose, provider and duration).
• Cookiebot CMP sends the user’s consent status to Google Consent Mode, which then determines the behavior of all its services’ tags and scripts based on the consent status, for example, via Gtag.

Once users give their consent via Cookiebot CMP, only the consent status is forwarded to Google – i.e. no personal data is sent from Cookiebot CMP to Google, but only the specifications of the anonymous user’s consent, e.g. whether they have accepted marketing cookies or not.

Example: Cookiebot CMP and Google Consent Mode at work

A user visits your website and is presented with a Cookiebot CMP consent banner that presents them with four cookie categories and the option to see how many cookies and trackers the Cookiebot™ scanner found on your domain.

The user chooses not to consent to analytics or marketing cookies, and Cookiebot CMP continues to block all such trackers, respecting the user’s choice.

Cookiebot CMP sends the user’s consent status to Google Consent Mode, and this specific consent status becomes the basis of operation for all Google services you use on your website, for example, controlling Google Analytics data collection based on user consent.

Try Cookiebot for free for 14 days.

Consent is sustainable

A “wild west” environment where the massive collection of user data has existed on the Internet for years, but only really surfaced in recent years. Major news stories about data breaches and questionable operations of large technology companies have helped create distrust in large technology companies, in addition to growing public awareness of data privacy.

Important data protection laws have arisen partly in response, most notably the EU’s General Data Protection Regulation (GDPR).

This regulation gives individuals in Europe enforceable rights over the data they generate every day, and defines clear rules and responsibilities for websites and tech companies when processing this data.

Google, consent and the “hard blockade”

Consent management platforms are a safe and effective way for websites to comply with the GDPR by transferring control of cookie and tracker activation to the user via consent.

But when users choose not to consent to analytics and marketing cookies through a website’s CMP, it often means a hard block on the domain’s analytics and marketing services. These run on such cookies and trackers, so such actions effectively cut off vital analytical insights and marketing revenue streams that are crucial to the commercial survival not only of large tech companies or media domains, but also of smaller, independent websites and e-commerce operations.

Ad blockers and privacy browsers have functioned as self-defense tools for end users, but have failed to solve the larger, structural problems surrounding the coexistence of data privacy and digital advertising, partly because of their general approach of blocking everything, and partly because many users do not have the time or skills to defend themselves in this way.

Add to this research showing that targeted ads yield only marginally better results compared to contextual ads that are not based on users’ personal data, and the industry’s shift away from massive personal data collection for privacy-infringing behavioral advertising appears to have been an ever-closer event horizon.

Google moves the Internet, again

When Google launched Consent Mode in September 2020, website operators were given new options, so it was no longer just a choice between protecting user privacy and optimizing opt-in rates for websites large and small.

Harvard Professor Emeritus Shoshana Zuboff argues in The Age Of Surveillance Capitalism that surveillance capitalism – the business model of massive data collection for user behavior prediction – began in 2002 when Google decided to commodify the immeasurable amount of data their search engine collected.

In 2020, Google’s decision to move the digital ad industry toward consent with the launch of Google Consent Mode marks a defining chapter in this story, offering a path forward to a safer, more private and fairer Internet.

Consent in the making

Consent is the basis of GDPR, the e-Privacy Directive and the Digital Markets Act (DMA), as well as data privacy laws in other countries, such as Brazil’s LGPD, because it empowers individuals with enforceable rights over all digital traces of their lives.

But in practice, consent continues to evolve and become more complex. It was once a simple scroll on a Web page or pre-ticked check boxes on cookie banners.

In 2002 and 2009, the e-Privacy Directive (also known as the “EU cookie law”) first introduced a requirement for cookie banners on websites. But these cookie banners only required website owners to indicate that the website uses cookies, with an accompanying “OK” button for users to click. But cookies and trackers would already be in effect, rendering their consent meaningless.

In 2018, the GDPR developed a clear definition of consent that many data privacy laws around the world have adopted or at least mirrored. Along with courts and data protection authorities, this fundamental digital law continues to evolve.

The GDPR defines consent as the informed, prior, clear and unambiguous indication of a user’s wishes, i.e., users should know exactly how your website processes personal data, what cookies and trackers are in use (including their purpose, provider and duration), and that users have the opportunity to give their explicit consent to each of these before any processing of their personal data can take place.

The Digital Markets Act (DMA)., which took effect in the European Union and the European Economic Area in November 2022, strengthens the definition of consent under GDPR, and requires that the companies it has designated as “gatekeepers” under the regulations, as well as third parties using the gatekeepers’ platforms, may collect and process user data only after obtaining valid consent.

Cookiebot CMP has been striving to shape consent management since 2012, to make “consent” a clear term with practical applications: the explicit, informed and empowered voice of the individual person as the guiding force for processing personal data on digital infrastructures.

CookieInfo helps organizations from small to large work with cookies and trackers in a privacy-friendly manner. Did this article inspire you or do you have questions? Contact us and we will be happy to help you get started.