Google Consent Mode: Gain valuable insights with privacy-proof data

Data collection in 2023 presents quite a few challenges. From the perspective of online marketers, data from website visitors is important to effectively steer campaigns. And as a data analyst, it is important to also safeguard the privacy of these users. This combination is becoming increasingly difficult to implement successfully due to the stricter rules being implemented regarding privacy.

Additionally, website visitors are becoming more aware of cookies and their functions. The result is that the tension between users and advertisers is growing further. Website visitors have the right to know what is done with their data, and advertisers, on the other hand, depend on user data. How the data is stored depends on which cookies are accepted and how an organization handles cookie preferences. Whether this data is then properly forwarded to the relevant channel is something many organizations struggle with or have not yet set up at all.

To fill this data gap, Google introduced Consent Mode some time ago. This feature ensures that the correct data is sent to Google that matches the user's preferences. It works with a Consent Management Platform (CMP) or a custom implementation to obtain consent (via a cookie banner) from users. Consent Mode receives the consent choices from users from the cookie banner and then dynamically adjusts the behavior of Analytics, Ads, and third-party tags that create or read cookies. When users refuse cookies, instead of storing cookies, pings are sent to Google. In Google Analytics 4, the data gaps are then filled via conversion modeling & behavioral modeling.

Conversion Modeling

Conversion modeling uses data that does not individually identify the user to estimate conversions where Google itself cannot directly observe this. This can provide better insight into conversions.

Benefits of conversion modeling:

• More insight into the measurements of all ad traffic: this provides a more accurate picture of ad results (ROI) and a complete view of the conversion path across different devices and channels as a result of ad interactions.
  
  
• Efficient campaign optimization: Modeled conversions help to optimize campaigns more effectively and achieve better business results.
• Accurate privacy-focused measurement: Individual users should not be identified and tracked. Google and conversion modeling have strict policies on this.

Conversion modeling via Consent Mode specifically looks at gaps in observable data. This can be applied by considering cookie consent regulations for different regions. Conversion modeling uses machine learning to analyze observable data and historical trends, then quantify the relationship between users with and without consent. The models then fill in missing attribution paths using observable user journeys where visitors have consented to the use of cookies. This provides a more complete and accurate picture of ad spending and results while respecting the user's consent choices.

The impact of Consent Mode on conversion content can also be viewed via Consent Mode Impact Results. The statistic shows changes in reported conversions. When conversion modeling goes live, there is the opportunity to view the uplift:

Image

Consent mode impact is the uplift in conversions after implementing Consent Mode, this is called the modeling start date. It is calculated using the following formula:

Modeled conversions / observed conversions

Uplift is calculated for each domain x country combination. Each pair represents a portion of traffic with its own Consent Mode impact results. This statistic is updated weekly.

Figures on the uplift are shown for 4 weeks after the model start date. The column with the modeling start date can be consulted to recognize the start of the 4-week period. The data can be downloaded and is updated weekly until the 4 weeks have passed.

To view the results of the modeling impact, volume and modeling 'thresholds' must be met. If these are met, impact results can be expected within 7 days after Consent Mode is implemented. The following criteria are used for this:

The 4-week timeline starts from the date the modeling goes live, even if a country x domain does not meet the uplift thresholds required to be displayed in the report. If an organization qualifies for conversion modeling from Consent Mode, the 4-week timeline starts from the modeling start date and is visible if a country x domain meets the reporting thresholds.

Behavioral Modeling

Behavioral modeling for Consent Mode uses machine learning to model the behavior of users who refuse analytical cookies based on the behavior of similar users who accept analytical cookies. Because the model is trained on the observed data of a Google Analytics 4 property, the property must have sufficient data to train the model. To qualify for behavioral modeling, the property must meet the following criteria:

It may take more than 7 days to meet the data threshold within those 28 days to successfully train the model; however, even the additional data may not be sufficient for Analytics to train the model.

Consent overview Google Tag Manager

Nowadays, there are also built-in tag checks for Consent Mode. Through Google Tag Manager, it can be ensured that the behavior of tags is modified based on the consent status. Tags created based on templates from Google and third parties have built-in consent checks, and custom checks can be added. Check the box 'Enable consent overview' under 'Additional settings' in the container settings:

Image

Then, a shield icon can be seen in the Tag overview at the top right. When clicked, the 'Consent Overview' window opens:

Image

Here, it is easy to distinguish between which tags have already been identified as configured for consent and which have not. Google Tags are already familiar with Consent Mode, and the overview shows that built-in consent checks are already set. The following products contain built-in consent checks and adjust behavior based on the consent status: Google Analytics, Google Ads (Conversion Tracking and Remarketing), Floodlight & Conversion Linker. This overview also provides the opportunity to add additional consent checks. This can be done by clicking the shield (with gear) at the top right:

Image

Here, consent settings of tags can be modified as shown below:

Image

This option is also available for other Tags, not just Google Tags. Thus, data can also be handled in a privacy-proof manner for, for example, Facebook Tags. Google Consent Mode and Conversion/Behavioral Modeling is specific to the Google Stack.

To check if the cookie banner and Consent Mode work and that the correct consent is sent, Google Tag Assistant can be used. Check the Consent tab for a table with the Event Consent State and the corresponding cookie preferences. Here, it is good to check if this is correctly reflected in Tag Assistant under different conditions (accepting or not accepting cookies):

Image

When Consent Mode is set, Google ensures that the visitor's Consent State is maintained across the pages they visit. When a visitor refuses consent to cookies, no more cookies are stored. Instead, minimal information about user activity is still sent. The Consent State and user activity are then sent to the Google server via cookieless 'pings' or 'signals'.

There are different types of pings to distinguish:

• Consent state pings for Google Ads and Floodlight Tags:

These pings are sent from every page the user visits and are also triggered for some tags when the Consent Mode changes from 'denied' to 'granted'.

• Conversion pings:

The conversion pings indicate when a conversion has occurred.

• Google Analytics pings:

These are sent from every website page where Google Analytics is loaded and where events are recorded.

These pings can then contain different types of information:

• Functional information (e.g., headers, passively added by the browser):
  • Timestamp
  • User agent (web only)
  • Referrer

• Aggregated/non-identifiable information:
  • An indication of ad-click information (e.g., GCLID / DCLID)
  • Information about the Consent State (Boolean)
  • Randomly generated number on each loaded page
  • Information about the used CMP

Regarding the Consent State and conversion pings, there are several options to consider.

All consent options granted:

• ad_storage=’granted’
• analytics_storage=’granted’

In this case, the following is set by default (web):

• Cookies related to ads can be read and written.
• IP addresses are collected.
• The full web page URL, including ad click information in URL parameters (e.g., GCLID / DCLID), is collected.
• Third-party web cookies previously set on google.com and doubleclick.net, and first-party conversion cookies (e.g., _gcl_*) are accessible.

One consent option granted:

• Ad_storage = denied
• Ad_storage = denied

In this case, the following behavior is applied (web):

• No new cookies related to ads may be written.
• No existing first-party ad cookies may be read.
• Requests are sent via a different domain to prevent previously set third-party cookies from being sent in request headers.
• Google Analytics does not read or write Google Ads cookies, and Google signal features do not collect data for this traffic.
• The full page URL is collected, which may contain ad click information in URL parameters (e.g., GCLID / DCLID). Ad click information is only used to approximate accurate traffic measurement.
• IP addresses are used to derive the IP country but are never logged by Google Ads and Floodlight systems and are immediately deleted after collection.
• Ad_storage = denied & Ads_data_reduction = true

In this case, the following conditions are added:

• No existing ad cookies may be read.
• In Google Ads, ad-click IDs (e.g., GCLID / DCLID) are redacted in consent and conversion pings.
• Analytics_storage = denied

Here, the following behavior is applied:

• No first-party analytical cookies are read or written.
• Cookieless pings are sent to Google Analytics for future measurements. Google Analytics 4 uses cookieless pings for modeling.
• Google Optimize is not affected by this setting.

In this case, cookieless pings are sent to Google Analytics. No Analytics cookies are placed, accessed, or read from the device. Pings without cookies send anonymized and non-identifiable Google Analytics events.

These pings, as part of regular HTTP/browser communication, may contain the following information: user agent, screen resolution, IP address. Note that Google Analytics 4 does not store or log IP addresses.

If an advertiser sets other fields, such as user_id and custom dimensions, these are sent normally. The data collected in the cookieless ping is used for behavioral and conversion modeling to fill in the data gaps.

Where to start with Consent Mode?

There are several ways to set up Consent Mode, but the easiest is to do it via Google Tag Manager and a CMP. A CMP like Cookiebot already has an integration and offers a Tag Manager template to set up Consent Mode. These templates are available in the Community Template Gallery, which is integrated with Google's Consent APIs. Additionally, it is possible for website developers to set up Consent Mode via gtag.js consent commands. However, this method is much more complex.

Best practices:

Regardless of how Consent Mode is set up, it is wise to adhere to the following best practices:

• Set an initial Consent State with the default values applicable to the organization. The default Consent State is already applicable when a visitor first views a page on the website.
• Implement Consent Mode so that page tags are loaded before the consent dialog is opened.
• Load Google tags in all cases, not just when the user consents. If consent is refused, Google receives cookieless pings. In Google Analytics 4 properties, cookieless pings enable behavior and conversion modeling to fill in the data gaps.
• Consent options should be shown to the visitor as soon as possible. Update the Consent State as soon as the visitor makes their choice.
• Give users the option to refuse or grant consent for each type of storage used by the tags on a website. For example, a user can consent to analytical cookies and refuse ad cookies.
• Since current privacy laws are region-specific, a default status applicable to certain regions is configured, rather than for all visitors.

Basic vs. Advanced Consent Mode implementation

Implementing Consent Mode by blocking Google Tags until consent is given is not the way to get all the benefits from Consent Mode. For example, you will not receive modeled data in GA4 to fill in the gaps when a user refuses consent. Whether you choose to block tags (Basic implementation) or 'unblock' them (advanced implementation), Google tags adjust their behavior based on the user's Consent State.

Below is a distinction of the differences between both implementations:

Image

*When you only block tags, conversion modeling in Ads is based on a general model, where the modeled conversion values are only attributed to users who give consent. This is less accurate than modeling via the advanced implementation, where the model is trained on both observed data from users who accept consent and the cookieless pings from users who refuse consent.

Advanced Consent features

• Set region-specific behavior

When users come from different countries, there is the option to specify the default behavior of the tags per country.

• Measure Ad click, Client ID, and Session ID in URLs

When a user lands on a website after clicking an ad, information about the ad can be added as a query parameter to the URL of the landing page. To improve conversion accuracy, this information is usually stored in first-party cookies on the domain.

However, if ad_storage is set to denied, this information is not stored locally. To improve the quality of ad click measurement when ad_storage is denied, there is an option to pass ad click information via URL parameters using URL passthrough.

Even if analytics_storage is set to denied, URL passthrough can be used to send cookie-free event and session-based analytics (including conversions) across pages.

The following conditions must be met to use URL passthrough:

• The Google tag is 'Consent-aware' and present on the page
• The advertiser has opted in to use the URL passthrough feature.
• Consent mode is implemented on the page.
• The outgoing link points to the same domain as the current page's domain.
• There is a GCLID/DCLID present in the URL (only Google Ads and Floodlight tags)
• Redacting Ads Data

When ad_storage is denied, no new cookies are placed for ad purposes. Additionally, third-party cookies previously set on google.com and doubleclick.net are not used. Data sent to Google still contains the full page URL, including ad click information in the URL parameters.

To further redact ad data when ad_storage is denied, ads_data_redaction must be set to 'true'.

Conclusion

Consent Mode offers opportunities to handle data more responsibly. Privacy-wise, it can better fulfill the wishes and needs of the user, and in terms of data, not necessarily much more data needs to be lost due to the features of Consent Mode. Especially in the case of larger organizations that generate a lot of traffic via the website, Consent Mode offers the solution to tackle the privacy issue. Conversion Modeling and Behavioral Modeling provide the opportunity to still obtain privacy-proof, valuable insights through machine learning.

```