Consent Mode and user privacy best practice

User privacy considerations are firmly in the spotlight at the moment as UK businesses attempt to get to grips with current best practice and regulation. The ICO’s recent statement on the fair use of cookies and Google becoming a gatekeeper under the Digital Markets Act (DMA) are very recent high-profile examples.

The requirement for gatekeepers to comply with the DMA comes into effect in March 2024 in Europe and there’s a likelihood of similar practices being adopted in the UK before long. In support of stronger consumer privacy protections, one of the changes Google will apply is making Consent Mode implementation for Google analytics and ad platforms cookies via your Consent Management Platform (i.e. the cookie banner on your website) a prerequisite for advertising activity to run as normal.

A reminder on where things stand with cookies…

Current PECR requirements and the UK GDPR combine to give the best practice on how to deal with user privacy in respect of use of cookies for your website. Users must consent to cookies being stored or used on their device, there must be clear information available about what those cookies do, and you must give users control over their consent choices.

Therefore, it’s highly likely your website has a cookie banner that allows users to accept or reject cookies that aren’t strictly necessary to the functioning of the site. As well as just ‘accept’ and ‘decline’ all options, some CMPs will allow users to turn cookies on or off by specific categories – such as for analytics or advertising.

Even with Google also announcing a renewed effort to block third-party cookies in Chrome (with over 60% market share for browsers) by the end of 2024, collecting and transferring first-party data in a privacy-first and secure manner to help understand audiences for reporting, targeting and optimisation will grow in importance for effective marketing, so these best practices will remain vital.

What is consent mode?

Consent Mode is a solution that allows Google tags – for Google Ads, Floodlights (Programmatic / DV360 activity) and Analytics to react to user cookie preferences. A website needs a consent management platform (such as OneTrust or CookieBot) in place that is already dealing with preventing tags for measurement from firing should a user opt-out of tracking.

As well as ensuring Google tags are being privacy compliant in their use of cookies, Consent Mode introduces some additional tags that allows Google to continue to collect anonymous interaction data whilst respecting user choice not to be tracked. The key is not being able to identify an individual user and not storing any identifiable information. As an example, having Consent Mode in place means that you can still track conversions from ad campaigns based on aggregated and modelled data, rather than just blocking everything.

There is news of a new version of Consent Mode coming that will make getting explicit user permission for what Google’s ad platform cookies can do more involved – so split into whether they can be used for transferring interaction data, ad targeting and personalisation. This will mean, even if you have Consent Mode set up to current best practice regarding cookie storage, there’s the prospect of needing to update the tags that trigger those first-party cookies based on user selections and updating your Consent Management Platform and cookie policies accordingly.

What solutions do S&T offer?

Our Consent Mode solutions are flexible depending on your current CMP usage and the level of involvement your web developers have with it.

As a starting point, we can offer checks to make sure your CMP works correctly alongside Google Tag Manager (e.g. blocking cookies when requested by a user via your cookie banner) and assess its suitability for Consent Mode. This is primarily for businesses that want an audit but have developers or their own Tech teams to carry out resulting actions.

Beyond that we can implement tagging for Google Ad Platforms (Google Ads, DV360 etc) and Google Analytics and support in making sure platforms are collecting data correctly and carry out and required work to control other site tags and platforms in response to user privacy preferences (correctly blocking where required).

Over the coming months these regulatory changes and platform-specific developments will spotlight a sizeable functionality gap for many advertisers, emphasising the need to tighten up process and implement changes to data collection and processing in order just to stay abreast with the bare minimum requirements.

Naturally, we can help. Our ongoing proactive audits and technical expertise in tag management, consent management platforms and analytics will enable you to make the most of your data in a variety of platforms for effective marketing and ensure you’re conforming to best practice for the privacy of your customers and for the efficacy of your marketing activity.

Get in touch: [email protected]