New Cookie Consent Explained

For years, data protection has been a top priority for IT giant Google. To continuously guarantee the protection of personal data, the parameters and functions are constantly checked and optimized. Google was even considered a pioneer in terms of cookie notices and has been requesting user consent for its AdSense since 2015. With effect from January 1, 2021, at the latest, displaying a cookie notice and obtaining the consent of users to store their data is not only mandatory, but also compulsory – neglecting or even violating this requirement can be costly for website operators.

This year, Google is even strengthening the guidelines for user consent in the EU for its privacy-oriented platform for digital advertising.

Google requires advertisers to comply with guidelines in order to be able to use personalized ads. These measures affect corresponding measurement functions and apply to data from multiple sources.

First and foremost, from the websites and the implemented tags via which data is sent to Google. The same applies to apps whose software development kits (SDKs) are used to send data to Google. Data uploads are also affected by this. More specifically, tools for uploading data from non-Google sources.

If you would like to continue using the functions for personalized ads, measurements and remarketing, consent to the use of personalized data must be obtained from users in the European Economic Area and the consent signals must be sent to Google. This also applies if you use Google Analytics data in conjunction with a Google service.

Your users’ consent decisions must therefore be forwarded to Google – as soon as someone from the European Economic Area accesses your website or app. In consent mode, the behavior of the Google tags can be adapted according to the user’s consent decision.

To this end, Google has adapted the Consent Mode API and added two parameters – with the aim of being able to obtain differentiated user consent.

The parameters are as follows:

Another new feature is the ability to use the Google Tag user interface to select which Google services you want to share data with. But that’s not all. Google has added the following new features for consent mode:

Definition of behavior for a geographical region

Google now allows you to define the behavior based on a specific geographical region. To modify the default behavior of your Google tags for users from specific regions, you need to specify the region in the “Agree” command. An example for users from Spain and Alaska would be:

gtag('consent', 'default', { 'analytics_storage': 'denied', 'region': ['ES', 'US-AK'] }); gtag('consent', 'default', { 'ad_storage': 'denied' });

However, you need to ensure that the command with the more specific region takes precedence when using two standard consent commands. We’ll clarify this with the following example:

gtag('consent', 'default', { 'ad_storage': 'granted', 'region': ['USA'] }); gtag('consent', 'default', { 'ad_storage': 'denied', 'region': ['US-CA'] });

Even though you’ve enabled ad_storage for the entire USA, the more specific setting will apply to a user from California.

Ad click, client ID and session ID transferred in URLs

If users have not consented to the use of cookies, you can pass on information about the ad click, the client ID and the session ID in the URLs. If the user does not consent to the storage of information, it is not stored locally. However, parameters can be transferred across pages using URL passthrough.

To function properly, your Google tag must consider the consent status and be placed on your website. The URL pass-through feature for the advertiser must also be enabled, and the consent mode should be implemented on the page by default. It is also necessary that the outgoing link directs to the same domain as the current page and that the URL includes a GCLID or DCLID.

You need to include the following command before your configuration commands: 

gtag('set', 'url_passthrough', true);

Remove display information

If users deny consent for advertising cookies, no new cookies will be set for advertising purposes. Additionally, third-party cookies are only utilized for combating spam and fraud. You can now remove all advertising data using the ads_data_redaction parameter:

gtag('set', 'ads_data_redaction', true);

Based on your implemented cookie consent basics, there are several next steps you need to take. We have summarized them for you!

Scenario 1: Consent banner available and consent mode already in use

If you’re already using consent mode and aren’t placing personalized ads, you don’t have any additional tasks to address. However, if you decide to start placing personalized ads, you will need to manage a Google-certified consent management platform (CMP). You can find a list of these platforms here. Once you use one of these platforms, your provider will automatically update to the latest version of the consent mode.

If you use your own consent banner, you will need to upgrade to version 2 of the consent mode.

Scenario 2: Consent banner present and consent mode not in use

If you haven’t implemented the consent mode despite loading the Google tag, you should do so promptly to fully utilize all of Google’s advertising features. If you’re using a Google-certified consent management platform, you can adjust the consent mode settings directly within the banner configuration. Be sure to add this adjustment to your to-do list. If you prevent Google tags from loading before obtaining user consent, Google won’t be able to verify them, potentially leading to data loss.

Scenario 3: Consent banner not available and consent mode not in use

This scenario is one that should make web development and website operators take notice. As mentioned earlier, since January 1, 2021, every website is required to display a cookie notice. To avoid legal issues and ensure your data storage complies with GDPR standards, you should promptly switch to gtag.js or Google Tag Manage if you’re still using older tag types and implement a consent banner.

This should definitely be integrated using a Google-certified consent management platform. We would like to recommend two of these platforms to help you.

Certified consent management platforms – Borlab

The Borlabs Cookie Plugin is one of the best-known products from the German company Borlabs. It helps website operators comply with European Union data protection regulations, regardless of the content management system they use. The plugin is compatible with Google Analytics and Google Ads and can be used with Google Tag Manage.

In terms of technical features, Borlabs allows for the customization of cookie banners, the creation of cookie groups to categorize cookies, and provides opt-in and opt-out functions.

It also blocks third-party scripts until the user gives their consent.

The feature bundle, regular updates, and multilingual support have made Borlabs one of the leading providers of cookie plugins. The cost of the tool varies depending on the type of license and the number of websites where it will be used. The price for a single license currently starts at €59.

Certified platforms for consent management – Cookie First

Cookie First is a cookie banner and consent management platform that ensures compliance with GDPR, ePrivacy, CCPA, and more. The application can also be used to manage cookies and third-party scripts. Cookie First supports banner management in over 44 languages and provides users with regular cookie scans that summarize and evaluate cookies and local storage.

All Cookie First data is securely stored in an encrypted database within the EU, in compliance with GDPR. You can view these audit logs at any time and export the data as a CSV file.

In addition to these features, the tool offers opt-in rate optimization, customization of cookie banner text and styling, integration with Google Tag Manage and Google Consent Mode v2, as well as a JavaScript API.

You can test Cookie First free for two weeks. After the trial period expires, you can continue using Cookie First for one additional month free of charge, or choose from one of three pricing packages, starting at €19 per month.

Haven’t addressed your cookie notices yet or want to make adjustments and learn more? Then we’d be happy to assist you! We’ll set up Cookie First for you in accordance with applicable guidelines and continuously ensure that your tool remains compliant with the latest updates from Google and GDPR. Book your free consultation today and let’s get started. We’ll be happy to answer any questions you may have.