Navigating the Changing Landscape of User Consent

This post is about user consent and data protection. Not exactly the most thrilling of reads for many (especially when you notice I’ve started referring to privacy laws in the next paragraph). However, its important stuff because there are changes which are going to impact how effective your website analytics and advertising data is going to be going forward. In a nutshell:

• Websites need a Cookie Management Platform (CMP) – aka a decent cookie banner solution – allowing users to explicitly accept or reject consent to different types of tracking.
   
• Large companies such as Google have a new obligation to ensure consent has been given by users before they can allow your website to take advantage of its services.
   
• If you don’t have the above in place, things such as Google Analytics 4 and Google Ads aren’t going to be very useful going forward in terms of the data they output.
   

Ready for the big read? Brews at the ready…

The digital advertising landscape has undergone significant changes due to the enforcement of regulations such as the ePrivacy Directive and GDPR, with businesses in the EEA and UK required to establish a legal basis for processing personal data.

The EU’s Digital Markets Act (and the UK’s similarly aligned DMCC Bill), approved in 2023 and enforced from March 2024, places new requirements on major companies, designating them as ‘gatekeepers’ and assigning them responsibility for collecting user consent for core platform services.

Google is one of these companies that from March 2024 needs to ensure user consent has been obtained to permit their engagement with platforms that digital brands take advantage of – Google Analytics 4, Google Ads and Google Tag Manager to name a few.

Step forward, Google Consent Mode v2

Google Consent Mode v2 is a mechanism allowing businesses to transmit consent signals from their website to Google, ensuring that user consent choices regarding data sharing for advertising, measurement, and personalization are respected.

(You’ll notice we’re referring to it as Google Consent Mode v2. That’s because Consent Mode has been around for some time now. However, in response to regulatory changes, they are updating it to version 2, which will be responsible for informing the likes of Google Ads whether your user has explicitly consented for the capture of user data or ad personalisation).

How can we practically get users to consent? The cookie banner. They have been around for several years, and in a variety of formats. But what we’re going to need to do going forward is have one that can allow users to explicitly PERMIT or REJECT consent for the use of different types of cookies.

User consent banner, controlled by a Cookie Management Platform (CMP)

Behavioural Modelling and AI

There’s great benefit for doing this too. Google Consent Mode utilizes statistical modelling and AI to intelligently predict user behaviour and website performance, even when consent isn’t given. This helps fill in gaps that would otherwise be there in the data – so we can gain a more comprehensive insight into site performance, improved reporting, attribution, and bidding strategies.

And here’s the important bit: websites not implementing Google Consent Mode v2 by March 2024 may face challenges in analysing website performance and optimizing ad campaigns due to incomplete data. If your website isn’t sending consent signals back to Google by then, you don’t get to benefit from the abovementioned modelling and AI. Ultimately, gaps are going to appear within your data.

What do you need to do?

Any digital brand and website owner that wants to take full advantage of Google platforms such as Analytics, Tag Manager and Ads going forward (via the standard implementation*) needs to consider the following:

• Ensure the website has a cookie banner capable of allowing users to explicitly consent (or reject) to the use of cookies for operational purposes, performance monitoring and personalisation. Furthermore, the cookie banner needs to be Google Consent Mode v2 compliant – meaning the banner technology can control website cookies (by blocking them before consent is given) and can send to Google the PERMIT or REJECT consent signals (so you can benefit from the best possible data generation). Cookie banner solutions that can do all the above are known as Cookie Management Platforms (CMP) – and as mentioned you’ll want to use one that is Google Consent Mode v2 capable.
  

• A review of your cookie banner technology also means ensuring your privacy policy is up-to-date and providing the user with the required information to make an informed decision on the above. There are several things to consider when it comes to ensuring you have a comprehensive privacy policy in place, but it ultimately breaks down to communication what personal information you may be collecting, what you (or your technologies) are using it for (and the lawful bases being utilised to process this information), and a summary about the cookies being used.
  
  While technology providers and partners (including us as a Digital Agency) can provide advice and information to include in the privacy policy, the legal responsibility for having a GDPR/DPA-compliant policy sits with the website owner. The good news is that several Cookie Management Platforms can assist with the formation of your Privacy Policy – many offering features that scan your website, identify the various cookies in use, and can summarise this for you within your policy (and cookie banner).
  
• Test and monitor. When the above is in place, we can use the likes of Google Tag Assistant to ensure Google consent signals are being sent, and that our Cookie Management Platform is indeed doing its job and blocking cookie use prior to user consent.

It’s a big change but gone are the days where we can use tracking platforms and expect them to report back full and accurate user movement. Now we’re in the age of user consent (hence the birth of Google Analytics 4) – so it’s important we move forward and embrace Google’s AI and machine learning to give us as comprehensive picture as possible.

If you’d like to discuss your website and its compliance with the above measures, please get in touch!

* This article assumes we’re talking about the standard setup of Google platforms, which tends to be the case for most website owners. However, there is an alternative for the likes of Google Analytics 4 that is fully cookieless – taking advantage of server-side tracking via a GTM implementation. It’s a more complex setup, but if you’d like more information take a read here.