Navigating Changes to Google Consent Mode

Consent Mode is a Google feature that enables organizations to respect their website visitors’ cookie consent choices by adjusting the behavior of Google tags (e.g. Google Analytics or Google Ads conversion tags) as necessary. For example, when a user provides consent to have their website activity tracked using cookies, your Google Analytics tag will fire as normal. However, when a user doesn’t provide that consent, GA only generates cookieless data — that is, data that can’t be tied back to any individual user.

Recently, Google announced some significant updates to Consent Mode, known as Consent Mode v2, or CMv2. And starting today, Google is making Consent Mode mandatory — not optional — for advertisers wanting to use various Google Marketing Platform features in the European Economic Area (EEA). In this post, we’ll give you an overview of who’s affected by these changes, what the changes mean for advertisers, and next steps that we recommend.

Who’s affected?

Before we dive into the details of what’s changing, let’s state up front that these changes primarily affect organizations dealing with traffic from the EEA. If your organization wants to measure traffic from, or use Google tools to advertise in, the EEA — read on. Also, note that Consent Mode can also be used in the U.S. and around the world.

Why should you care?

There are two major implications for the adoption of CMv2. First, if CMv2 isn’t enabled for EEA users as of March 2024, new EEA users will no longer be included in audience lists, or added to personalized ads features, such as retargeting campaigns. In addition, measurement features will cease to function for EEA users.

Second, CMv2 — specifically when used in “advanced” mode — enables Google to provide “modeled” data to help to fill in gaps created by the loss of directly observed data. For example, modeled behavioral data for GA4, and modeled conversions for Google Ads. In other words, rather than simply losing data altogether when users do not consent, advanced mode allows organizations to get anonymous, modeled data. As data deprecation continues to accelerate, modeled data will become a  critical element of privacy-safe, data-driven marketing, because it provides marketers with the fullest possible view of performance where direct observability is no longer possible.

What exactly is changing?

Starting today (March 2024), Google has stated that if your organization wants “to keep using measurement, ad personalization, and remarketing features, you must collect consent for use of personal data from end users based in the EEA and share consent signals with Google.” As a result of this change, Consent Mode will be required — not optional — as the method for passing EEA users’ consent status to Google when using Google Marketing Platform products.

In addition to Consent Mode now being required for EEA users, CMv2 is adding two new parameters, which will be required for personalized advertising. In addition to the pre-existing analytics_storage and ads_storage parameters, CMv2 will include:

• ad_user_data, which controls whether user data can be sent to Google for advertising purposes, and
• ad_personalization, which controls whether personalized advertising (e.g. retargeting) can be enabled.

With this change, there’s now a distinction between “basic” Consent Mode and “advanced” Consent Mode. Here’s how the two differ.

Basic

• When consent is provided, tags behave as normal.
• When consent is not provided, Google receives no data whatsoever.

Advanced

• When consent is provided, tags behave as normal. (This is the same as basic.)
• When consent is not provided, tags adjust behavior to respect the consent status, and only send cookieless data to Google.

Effectively, Basic Mode is roughly equivalent to how many organizations set up Consent Management Platforms to control marketing tag behavior before the advent of Consent Mode, while Advanced Mode creates a cookieless way to share opt-out consent signals with Google to allow for modeling to fill gaps in observable data.

What should you do next?

There are a two key actions organizations should take if they don’t want to lose key capabilities for EEA audiences.

1. If you haven’t already, ensure you are equipped to collect user consent, worldwide, with a Consent Management Platform (CMP) that integrates with Consent Mode. At an absolute minimum, make sure you collect user consent for EEA users as soon as possible.
2. Implement or update (as appropriate) Consent Mode. Specifically, implement advanced Consent Mode if you want to be able to use — for EEA users — behavioral modeling in GA4, conversion modeling in GA4 and Google’s ads products and personalized advertising features. If you don’t want to send cookieless pings to Google (and are okay with losing out on data modeling and personalized advertising capabilities), implement basic Consent Mode.

Notes on getting started

Implementing CMv2 should be done very carefully, as an improper configuration could result in collecting data when a user has intended to opt out. Errors like these can result in legal headaches for your organization. Be sure to watch out for common issues such as:

• Sequencing: firing a tag too early, not waiting for consent signals due to the sequencing of scripts, etc.
• Rigorous testing: forgetting to use a VPN to test certain regions, forgetting to clear cookies to simulate new users, not testing against popular browsers such as Brave where Global Privacy Control is enabled by default, etc.

CMv2 can be implemented in various ways. For example, the changes required can be managed through a CMP. Indeed, many CMPs have built-in integrations to enable this feature. CMv2 can also be implemented by a developer, or configured within Google Tag Manager by a reputable partner.

To learn more about CMv2 and its implications for privacy, measurement, and activation, contact us to speak with a subject matter expert.