Google Consent Mode
Google Consent Mode (GCM) is a new API (currently in beta), which helps you to adjust the behaviour of some Google services based on the consent status of your users.
Overall, it helps to run your website’s marketing and advertising, while respecting users' consent choices.
Google Consent Mode was launched on September 3rd, 2020. It is another big step in the direction of a more privacy-focused Internet. GCM builds a more sustainable future - where advertisement and data collection are still possible, but much more based on user consent.
So, it is a win-win: websites can still access some data and generate revenue and at the same time respect user privacy.
For example, with the help of Google Consent Mode, you can indicate whether consent was granted for Analytics and Ads (marketing) cookies. If there is no consent, some basic data will still be passed to Google products, but ads will be much less targeted.
To make Google Consent Mode work with Openli is not too difficult.
Be aware that this only works if you are using GA4. This will likely not work with UA (the old Google Analytics).
You simply need to make sure the google datalayer is initialised and that it sets the consent states as "denied" before the Google analytics and the Openli scripts are loaded. You can do this by adding this HTML to the
head block of your site:<script>
// Initialize the data layer for Google Tag Manager (this should mandatorily be done before the Cookie Solution is loaded)
window.dataLayer = window.dataLayer || [];
function gtag() {
dataLayer.push(arguments);
}
// Default consent mode is "denied" for both ads and analytics, but delay for 5 seconds until the Cookie Solution is loaded
gtag("consent", "default", {
ad_storage: "denied",
analytics_storage: "denied",
wait_for_update: 5000 // milliseconds
});
// Improve ad click measurement quality (optional)
gtag("set", "url_passthrough", true);
// Further redact your ads data (optional)
gtag("set", "ads_data_redaction", true);
</script>
Secondly you will need to unblock the GA script in your Google Tag Manager if you already blocked it using the Openli triggers, as GCM is used instead of those, and they conflict with it.
If you set up GA using a script directly in the code and blocked it manually, you will need to remove this blocking.
Once this is done you are good to go.
Openli pings the data layer to change the settings for
ad_storage and analytics_storage and either grant or deny data-storage and -collection, so our widget will take care of the rest. If done correctly, you should start to see data coming in.
To check if the cookies are now not being set, you can open a private session in your browser ("Incognito mode"), and open the developer tools (F12 or ctrl+shift+i). Without giving consent, browse your website a little. If set up correctly, you shouldn't see the _ga, _gid, or _gat cookies being set in the cookie or storage related section of the developer tools.So at this point you've taken the steps above, and everything looks to be doing what it should, but you do not see the data you expect.
Unfortunately, because Google Consent Mode is just an API which Openli uses to pass consent data to Google Tag Manager, the specific details of how the different tags are meant to respond to this data is beyond our control.
We have no insight into what tags do with these settings due to the relatively black-box approach Google has taken, which means that we can't say anything about how Google Analytics (or another tag) should behave when it receives the Consent Mode instructions.
If you want to learn more, you can visit Google's developer documentation here.
Be aware that there are a few important caveats to keep in mind when using Google Consent Mode.
- 1.Google Consent Mode is still in Beta from Google, meaning it is still subject to change and issues with the method can be unsolved. Openli has set it up to specification, but we cannot guarantee functionality if Google makes changes or if consent is not collected due to issues with GCM.
- 2.Based on the information provided by Google, it looks like using GCM is compliant, however, we cannot know for sure if Google is following GDPR rules completely, hence using GCM might not be GDPR compliant.
With those caveats in mind, it does look like it is safe to use GCM from a compliance perspective, but until any real information is available on the matter from the data authorities, no guarantees of compliance can be made.