Privacy-compliant website tracking with Google Consent Mode (beta)

Estimated reading time: 11 minutes

‘Measure conversions while respecting user consent choices,’ this is Google’s apt headline for the launch announcement of Google Consent Mode back in September 2020.

Consent Mode (in beta, as of January 2021) is Google’s newest solution for managing Google tags in a way that adjusts to the level of consent granted by users. In order to fully understand how it works and what exactly it brings to the table, it’s worth first looking into how cookies (specifically ones used for analytics and advertising) normally work.

Cookies and privacy

Cookies are small text files that a website stores on the computer to remember information and identify a user or visitor. There are different cookies used for different purposes—some are necessary for certain functions or features of a website to work, some are simply used for analytics tracking (clicks, visits, etc.), while others are used for advertising, where certain information about the user is noted in order to personalize content and serve them relevant ads throughout the web. Marketers used to rely on these cookies in order to target the right audience based on demographics, known interests, browsing history, and other data.

This setup was great in terms of personalized and targeted advertising, but as you can imagine—not so much for users’ privacy, as advertising cookies keep track of information that’s considered ‘personal’. Over the past years, regulations have become stricter when it comes to these cookies—enforcing that there should be explicit consent from end users before these information can be collected and subsequently used in advertising. And just recently, major browsers like Safari, Firefox, and Chrome have all implemented their own blocking mechanisms that restrict tracking cookies by default when users browse websites.

Because of all this, website owners have lost access to a huge chunk of data and insight to their visitors (let’s be real—very few people actually click ‘Accept’ on cookie consent pop-ups that appear on websites). To a degree, there was still some data being collected by analytics tools, but there were also undeniable gaps in reporting—sessions and page hits are not all recorded, conversions do not align with reports from ad platforms (e.g., Facebook or Google Ads), sources (or external pages that users come from before landing on the website) are often not properly attributed because of the lack of persistent data shared between websites, and more.

As a result, collected analytics and conversion data have become sort of unreliable—there’s now some misgivings about insights gained from reports, knowing that because of the discrepancies caused by blocked cookies, there may be some unknown information that’s not being taken into account.

Enter Consent Mode.

What is Google Consent Mode?

To be clear right off the bat, Consent Mode does not provide a complete solution to the cookie problem described above. It’s also not a workaround that manages to collect the same data from users despite lack of recorded consent.

In a nutshell, Consent Mode is a feature that enables Google to adjust the behavior of tags used in your site according to the consent status by the user (i.e., whether consent is granted or denied). It introduces two new tag settings: ‘ad_storage’ and ‘analytics_storage’—which determine whether Google’s analytics and advertising tags can utilize browser storage.

How does Consent Mode work?

1. Consent Mode is a script that you add to your website either through Google’s global site tag (gtag.js) or Google Tag Manager.

2. Note that it relies on your website’s signals to determine whether a user has granted consent or not. As such, before implementation, you must already have some mechanism in place for managing user consent in your website. You can use a consent management tool like Cookiebot for this (these tools are the ones that handle the cookie consent bars you often see pop up on websites).

3. According to Google, it must be implemented in a way that loads the tags before the consent dialog (i.e., the cookie consent bar or popup) appears on the website. By default, Google will assume that no consent is granted until your consent management tool informs it that the user has granted consent for either or both analytics and advertising cookies.

4. Once Google receives signals as to what the user has consented to, it will then dynamically adjust how its tags should behave (i.e., whether or not to use analytics or advertising cookies).

5. Aside from this, Consent Mode is also able to collect non-personally identifying information that can help in analytics and conversion tracking, without cookies, instead of completely blocking tags when a user doesn’t provide consent. When consent is denied, Google collects these basic information instead:

• Timestamp
• User Agent
• Referrer
• An indication for whether or not the current page or a prior page in the user's navigation on the site included ad-click information in the URL (e.g., GCLID / DCLID)
• Boolean information about the consent state
• Random number generated on each page load (probably as an identifier for the current page load session; we are not sure as of February 3, 2021)

6. Note that if Consent Mode is active but the user has not granted consent for analytics or advertising tags, Google may be able to detect the hits but will not be able to follow the user through their site navigation—without cookies, there is no persistent identifier throughout the pages, instead, a new identifier will be sent each time a user navigates away to another page (i.e., a single user may be treated as different individuals since there’s no way to continuously identify them as they browse from one page to another without cookies. This is our understanding as of February 3, 2021.)

7. You may be able to see these data in the real-time reporting section in Google Analytics, but since the tags have not received consent to utilize browser storage, the data is not exposed in reports.

(Check out this help guide by Google for a more in-depth explanation of Consent Mode behavior in every possible consent status.)

What difference does it make?

For one, consent is more granular—some users may choose to decline all cookies, some may allow analytics cookies but not marketing ones, etc. In Consent Mode, Google is able to recognize what the user has consented to, and therefore is also able to dynamically adjust how its tags should behave.

Aside from this, when a website uses Consent Mode, Google products (i.e., Ads, Analytics, etc.) are also able to report conversions whether the user consents to tracking cookies or not. In the latter case, Google simply reports conversions on an aggregate level (i.e., by not processing any identity signals and firing advertising cookies), keeping the user anonymous but still tracking whether a conversion event happened in the website.

In practice—how Consent Mode works so far

The explanations provided above are all in theory, based on the information made publicly available by Google in their publications. Keep in mind that this feature is still in beta and is still subject to tweaks and changes as Google continues to test its efficacy.

The following are actual observations we’ve made in the time that we implemented Consent Mode in our websites and tested its reporting in Google Analytics—both Universal and GA4 properties (more on this later):

1. Even when users don’t accept cookies upon landing on the website, Google Consent Mode is still able to detect a page visit in the real time dashboard in Analytics.

2. However, such data only seems to appear in real time and not in other reports. We’ve also read similar cases as reported by others—according to Simo Ahava, this is probably because Google collects the aggregate data for modelling and measurement purposes, but since storage is declined by the user, the data cannot show up in reports for privacy purposes.

3. We’ve also seen cases where a user who doesn’t provide consent is treated as a separate user every time they switch to another page, even within the same session. We reckon that this is due to the lack of persistent data in between pages due to the absence of cookies to remember the session. Although you may miss out on the possibility to get personal data about your visitors to be used for retargeting and personalized advertising, your website is at least still able to track conversions from ad campaigns.

Consent Mode and consent management tools

Again, it’s important to remember that Consent Mode itself is not used to manage users’ consent. Its purpose is simply to send signals to Google about the consent status of your users in order to adjust the behavior of the tags. To be able to use Consent Mode effectively, you'll have to already have a consent management tool in place.

A consent management tool manages and records the actual consent response from your users. You can have one developed yourself, but for the most part, there are already many third-party services in the market that offer this. At 1902 Software, for example, we use Cookiebot for cookie compliance.

What Consent Mode is not

Consent Mode is an undeniably great tool that helps fill in the gaps in website data due to the lack of cookies. But before you have it implemented in your site, it’s important to set your expectations about what it really is and does:

1. It’s by no means stable yet. As we’ve said, it’s still in beta and is subject to change. We’ve also seen differing reporting results even as we confirmed that the proper tags are in place, so there are definitely discrepancies to be expected at this point.

2. Consent Mode will probably not measure everything 100%—although it is able to get aggregate-level data on users who don’t provide consent, it may still miss out on other things due to factors such as the user’s personal settings (e.g., third-party blocker plugins, etc.)

3. It only works for Google products like Ads and Analytics (i.e., if a user does not provide consent, Google may be able to record conversions from Google Ads, but not from other platforms like Facebook, etc.)

4. It’s not a workaround for retargeting—while Consent Mode helps in measurement and attribution for conversions, it doesn’t provide a way to retarget users because this is something that really involves the use of third-party cookies. If ad cookies are not accepted by the user, Google will only be able to detect parameters (i.e., GCLiD from Google Ads) but won’t actually be able to leave the third-party cookies that are necessary for retargeting into the user’s computer.

Should you implement Consent Mode?

Considering all these inevitable limitations, is Consent Mode still worth implementing in your site? Yes. This is clearly a project that Google is dedicated to improving as time goes. While it’s still in beta, you can start implementing it in your site so that you can at least start gathering the data that are otherwise missed without it.

How to implement Consent Mode

Consent Mode can be used either with Google Tag Manager or using the global site tag (gtag.js). You can ask for your developer for technical assistance in adding Consent Mode to your websites: Consent Mode developer guide.

If you need help, you can also contact our team.

Next: Get started with Google Analytics 4 »