What is Google Ads “Consent Mode” tracking?
The purpose of the consent mode is to guarantee the collection of important data enabling you to measure the effectiveness of your advertising campaigns via Google Ads, even if your users have not given their consent to cookies.
Products compatible with Consent Mode :
Suivi des conversions Google AdsTag de remarketing Google AdsFloodlightGoogle Analytics
How does Consent Mode tracking work?
To function, Google’s Consent Mode uses two tags to adjust the behavior of cookies and Google tags:
ad_storageanalytics_storage
The consent mode uses these beacons to receive information on the consent status of users directly from the cookie consent window provided by your CMP (consent management platform).
Cookie Management
Sending data to Google
Consent Mode recovers an average of 30% of data, excluding cookie validation.
It retrieves information using anonymized pings.
Pings are used for the following events:
- Consent status pings are sent from all pages visited by the user for each cookie category (even if the consent status changes),
- Conversion pings are sent as soon as a conversion has taken place,
- Google Analytics pings are sent to all pages of a website on which the Google Analytics tag has been implemented.
In what way?
- Time and date (of your website visit).
- User agent (if users visit your website)
- Referrer (how users accessed your website)
- Redirection information in URL (e.g. GCLID / DCLID)
- Boolean information on consent status
- Random number generated on each loaded page
RGBD compliance
What does the law say?
The RGPD directive establishes rules on the protection of individuals with regard to the processing of personal data.
“personal data” means any information relating to an
identified or identifiable natural person (hereinafter referred to as the “person
concerned”); an “identifiable natural person” is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity;
“processing” means any operation or set of operations which is performed upon personal data or sets of personal data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or
destruction;
Source: DIRECTIVE (EU) 2016/680 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL APR 27, 2016
RGPD IN BRIEF
No personal data or data enabling personal profiling either by ID or by nominative personal data may be processed without the consent and justified legitimate interest of the person concerned by the processing.
No personal data may be further processed in order to be anonymized to comply with the RGPD.
RGPD AND CONSENT MODE
What does Google have to say?
Anonymization of data processing and data collection first Parties only.
Technically and theoretically, Consent Mode makes it possible to obtain completely anonymous data:
a page = a unique id which is renewed on each page = an action = a ping sent to google solutions (analytics, Ads,…).
The user path cannot be followed.
Conversely, actions triggering conversions can be tracked, and degraded Analytics data can be tracked (session times, page views) thanks to the consent mode.
The Consent Mode not only uses no cookies, but also recovers First Party-oriented data.
What the CNIL says
For the first 4 techniques, the collection of individual data for
advertising purposes comes under the RGPD, and must logically be subject to
“free and informed” consent on the part of the Internet user. For the 5th
technique, that of the cohort that seeks to anonymize
personal data, it also imposes consent in the name of another
text, the ePrivacy directive.
CONSENT MODE IS BETA
Consent mode is sold as a tool for complying with RGPD regulations without ever mentioning it in the Google documentation. The consent mode plays on the fact that it does not collect any personal
data, as it only collects anonymous browsing data on the website (first parties). This data can therefore be processed.
On the other hand, the CNIL seems to be impartial on its side, and the boundary between personal data and website events (conversion tracking) seems relatively close. Consent mode has so far not obtained any conformity from the CNIL. For the moment, it’s an existing technology on a slippery slope, liable to be declared non-compliant by the CNIL.
All in all, it’s fair to say that Google GAFA has gone to great lengths to produce a tool that complies with regulations. However, this is to the detriment of the free interpretation of laws and the words used in legal texts.
Aggregators have their own user-privacy-oriented interpretations, while advertising agencies have their own business-oriented interpretations. Only official validation of the Api by the CNIL will determine the compliance of the consent mode.
