Google Consent Mode: The Path to Data Privacy-Compliant Strategy

Todd Bullivant, Vicki Lopez, and Kimberlee Raymond contributed to this post.

Privacy-centric legislation is ushering in a new era of marketing. As more laws are introduced to regulate data usage in the US and abroad, platforms and brands alike need to make some changes and update their tactics to comply with these rules.

Google is updating its Consent Mode offering to Consent Mode V2, which helps marketers get consent from users to use their data for retargeting. If you’re running Google Ads in the European Economic Area (EEA) or you’re using the Google tag, you need to update your website to comply with the new version of Consent Mode.

To make sure your brand is ready for this privacy-first future, we’ve got the details on new legislation in the US and the EU that may impact your marketing, how to implement Consent Mode updates, and what else you need to do to keep your brand on the right side of these regulations.

Please note that the information and best practices in this post do not constitute legal advice. Work with your legal department to ensure compliance with all legal obligations.

New rules: data legislation in the US and abroad

The European Commission’s Digital Markets Act (DMA) represents a major development in privacy rules. The DMA has been enforced since March and provides a framework for making designated platform gatekeepers (e.g. large online platforms like Google) accountable for the user data they collect and use from the European Economic Area.

The EU also implemented the Digital Services Act (DSA), which aims to prevent illegal and harmful online activities and protect users’ fundamental rights online with rules affecting online platforms depending on their size. The two combine into one set of comprehensive rules built to protect user safety in the EU.

The EU is ahead of the game when it comes to privacy laws, and what’s happening there might provide clues about where privacy in the US is headed. Legislation in the United States has so far happened largely on a state-by-state basis, with California leading the charge for stronger privacy laws in other states. Eight more states have announced privacy laws that will go into effect this year through 2026.

Source: iAPP

But the federal government looks positioned to join the privacy protection party: Senate and House officials recently announced the proposed American Privacy Rights Act (APRA), which would establish federal guidelines for how companies and large platforms can collect and use personal data online. If passed, the bill would override state-level measures already in place, allowing users to opt out of targeted advertising, request that personal data be removed, and sue companies that don’t comply with those requests. 

The bill has bipartisan support, but we’re still waiting to see if it passes. But further data restrictions are clearly on the way for advertisers.

Rolling out enforcement of new rules isn’t easy and can be a slow process, but remember that the government can choose to enforce these laws at any time (and even use certain companies as examples, as we saw with the $1.2 million fine California levied against Sephora for violating the CCPA). Advertisers and platforms alike need to respond to these regulations promptly and make sure their strategies are fully compliant to avoid facing penalties.

Consent Mode V2: updates for data privacy compliance

Google’s efforts is updating its Consent Mode offering with new functionality to meet these evolving standards. Consent Mode, a feature within Google Tag Manager (GTM) for managing user consent regarding data collection for advertising and analytics purposes, helps businesses navigate the complexities of data privacy regulations and ensure compliance.

Source: Google Marketing Platform

It works by integrating with a Consent Management Platform (CMP) like OneTrust or Cookiebot to pass signals that contain user consent choices to GTM, where it integrates these signals with firing logic. When a user declines consent, this logic is used to prevent events that track user interactions from firing (Basic) or to send them as cookie-less pings (Advanced). 

Consent Mode originally came with the following parameters, used to manage consent and storage options:

• ad_storage: for advertising-related storage
• analytics_storage: for analytics-related events
• functionality_storage: for core website functionality
• personalization_storage: for site personalization options, like item recommendations
• security_storage: for functions like authentication or fraud prevention

These signals pass information showing that a visitor has either granted or denied consent to use cookies or other functionality for the related options.

The new Consent Mode V2 introduced two new signals to handle user consent options in a more granular way: 

• ad_user_data: for user data being sent to Google’s advertising services
• ad_personalization: for controlling ad personalization user consent choices

Set it up: implementing Consent Mode

Advertisers need to update to the new version of Consent Mode immediately to keep collecting first-party data. Without Consent Mode, businesses will lose the ability to collect first-party data and share that data with Google Ads and Google Analytics 4. 

They’ll also lose remarketing capabilities with Google’s advertising services. This will limit your ability to understand user behavior, target relevant audiences, and optimize their marketing strategies based on data insights.

Brands in the EEA had to update their sites and apps to Consent Mode V2 by March 2024, after which websites defaulted to consent being automatically denied, blocking retargeting opportunities in the EEA. Other markets are still rolling out these updates as the year progresses. 

You should proactively implement the new updates in Consent Mode V2, especially if you’re operating in the EEA, so you can safeguard user privacy while still leveraging the power of data-driven marketing strategies. 

You can implement Consent Mode in two ways:

• Basic Mode: All GTM event code is blocked from running until a user consents to data collection.
• Advanced Mode: GTM events will fire when a page loads regardless of consent. When a user opts out of tracking, the data is anonymized and cookie-less pings are sent to Google. The data within the pings are used for enhanced behavioral and conversion modeling. 

Consult with your legal team to determine which method meets your compliance needs and definitions. Consider the pros and cons of Basic Mode and Advanced Mode to see which works better for your compliance goals and data collection practices.

But that’s not all you need to do. If you’re not currently using a Consent Management Platform (CMP), now’s the time to start exploring your options. Google offers a CMP Partner Program that allows users to integrate Consent Mode V2 with existing consent implementations.

Source: Google

Next steps: privacy-first solutions

Consent Mode is only one step in creating a privacy-compliant data strategy. Once you’ve made those updates, start exploring where else you need to make changes to ensure your strategy is aligned with the latest data regulations. 

Make sure you’re ready for whatever comes next by:

• Prioritizing first-party, consent-based data collection in your overall strategy
• Evaluating your data infrastructure to use your first-party data for targeting and measurement 
• Incorporating robust incrementality testing and data clean rooms into your measurement strategy
• Leveraging an accurate media mix model to optimize your media mix and forecast effectively

Even if privacy regulations and platform changes like Google’s Consent Mode updates don’t impact your company right away, data loss is coming and you need to be ready. If you prepare today, you won’t be caught off guard by any potential changes coming your way in the future.

Looking for more ways to future-proof your data strategy? Check out our white paper, State of the Data 2024, for all the details on this year’s privacy changes.