Your Google Consent Mode questions, answered by experts
We recently hosted brunch panels in London and Brighton, assembling industry experts to explain and answer questions about Google Consent Mode and what it means for your digital marketing strategies.
If you couldn’t make it, don’t worry! We’ve written up key moments from the Q&As below. Don’t miss out next time — subscribe to our newsletter to be the first to know about our free industry events.
July 2024 update: Google no longer abandoning third-party cookies
Google are keeping them running, with a view to balance user privacy with the needs of the advertising industry. Read the update →
Our audiences asked the questions which every online marketer will certainly be curious about. But before we get to the answers our panels gave, here’s a quick recap that data expert Lisa Chittenden shared at the start of our London event, looking back at the origins of internet cookies.
Cookies: the story so far
To start the conversation about cookies, we actually need to go back to 2003. The original ‘cookie law’ was part of the Privacy and Electronic Reguations. Now, a lot of people know about GDPR. But PECR, as it’s called, is a law that sits alongside GDPR. So if you need to talk about privacy, that is the law that you’re working with.
It was implemented in 2003. And that’s when we got used to seeing cookie pop-ups. That expanded into the more sophisticated pop-ups, which allow you to select your preferences. There are four preferences that we’re used to seeing now:
necessary cookies
analytics cookies
performance cookies
advertising cookies.
Where the original Google Consent Mode comes in is 2020. It enabled your your website to communicate the outcome of those pop-ups to Google. It was asking the consumer for the analytics data itself, plus storage of the data and the use of the data for advertising.
Lisa Chittenden speaks at our Google Consent Mode brunch in London
In the meantime, the Digital Markets Act was introduced by the EU commission in 2023. And this requires the ‘gatekeepers’ of ‘big data’ to be responsible for personal data.
All of the big data players are now being made responsible in Europe for ensuring that users have the ability to define their privacy and their preferences.
The Google Consent Mode Version 2 officially became operational as of the end of March 2024. The difference here is they’ve added two additional tags to that process of carrying through the cookie preferences.
‘Ad User Data’, which means that data from your site — your preferences — can be sent to Google.
‘Ad Personalization’, which means that the user gives their permission to use their data for personalised communication.
The reason that it is now an issue is that, if you don't implement Consent Mode V2, the data will not be carried through to Google Analytics or Google Ads. Any of your subsequent measurements and reporting will be inaccurate, because it won’t have full data. And some organisations are saying that, if you don’t implement Version 2, they will actually cancel your account. So it’s pretty serious.
Now that we’re up to speed on where all this started, let’s look at some of the questions our audiences asked, starting with the basics: do you actually need to set up Google Consent Mode?
“I've set up a new business using a no-code builder. I’ve got some HubSpot forms on there. I’ve got some Google Ads and Google Analytics running. Can you lay out, in layman’s terms, what the obligations are for someone like myself?”
Dani Herrmann, our very own senior paid media specialist at Trapeze Media, replied: “If you run Google ads, you need to implement Consent Mode, and if you open Google Analytics, there will be a reminder saying you need to implement it.
“You’ll need a privacy policy and a consent banner, too, and there might be one within the web builder you’re using, but there are also ready-made solutions that seamlessly integrate with Consent Mode, like CookieYes.
“Some of them have a free trial or free basic service. Others, you have to pay a small amount a month for.
“GA4 will provide you with some steps to follow for setting up basic or advanced Consent Mode in Google Tag Manager, so you can still run personalised ads and not get suspended or penalised.”
Daniel Perry-Reed, analytics consultant and trainer at Measurelab, elaborated: “There’s two things you need consent for when processing personal data. For things like Google ads and Google Analytics, it’s setting a user ID in a cookie — that’s personal data you’re processing. And second, accessing someone’s device — that’s the act of setting a cookie, which is just a text file, in someone’s browser. You’re basically asking the user: Am I able to set something on your browser, and can I process your personal data to do something with it? If you don’t process personal data, and if you’re not using any cookies, then you don’t need consent.
Daniel Perry-Reed from Measurelab breaks down Google Consent Mode at our Brighton panel
“Not every website or app needs a consent banner. You don’t need consent for the fundamental structure of your website. You don’t need to get consent to set a cookie that remembers you’ve added something to your basket and you’ve got a cart going.
“Google Analytics and Google Ads are not mandatory, right? They’re not essential for your business to operate, to sell the services or to provide the information. So your forms, for example, you might not have any cookies or tracking on that. That’s all essential.
“But if you are dropping the Google Analytics cookie or Google Ads stuff or Meta or TikTok, these aren’t essential, and that’s where you need to start thinking about consent.
“So if you’re running campaigns, if you’re doing any paid marketing, I would bet my house on the fact that you’re setting cookies and you should look to implement Consent Mode. Most no-code website builders will have an option for you.”
Our second question came from someone wondering: couldn’t I just get away with sneakily not implementing Google Consent Mode?
“If you were to take a more cavalier attitude, what are the chances of getting caught? I've seen a few headline fines dished out. Is the biggest risk just Google saying you can’t run ads?”
Daniel took this one: “Google got fined literally a couple of hours after GDPR was introduced in 2018, because they had their ‘sign up to email newsletter’ form box pre-ticked. They just waited for midnight, saw Google still doing it, and went straight after them.
“The ICO — the Information Commissioner’s Office, which is the UK governing body of things like GDPR — they’ve got literally a form to report any business you like. So if someone finds you’re not respecting their rejected consent, you can report them. And I can only imagine those systems will become easier to use as people become more and aware of them.
“So the risk isn’t zero, but I would say that there’s low risk for a small business. You can still do marketing. It’s just, you can’t do remarketing. It’s not about running ads. It’s about the measurement of those ads or targeting specific users. You can’t target an ad to someone without asking their permission first. You can still do contextual advertising on Google, Facebook, etc. but if you’re feeding in lists of people to target, that's where you need to make sure you’ve got consent.
“If you’re targeting everyone in a geographic region, or if you’re doing it based on demographic interests, you don’t need cookie banners or consent for that because you don’t know anything about them. You’re relying on Google to get the consent to have all that information.”
Dani added: “And beyond just thinking of “will I get caught out?” — it’s in your own interest to have the best data available, which Consent Mode helps with.”
Dani Hermmann, paid media specialist at Trapeze Media, answers Google Consent Mode questions
Next up: a question about whether analytics drop-offs are a casualty of Google Consent Mode V2.
“We’ve been seeing a few discrepancies with our tracking. We’re trying to work out if this is a result of Google Consent Mode. At the moment, I feel like a lot of our Google data is being dumped under ‘organic social’, where before we used to have that really important spit where we could more specificity.”
Dani started: “If you saw this kick in around the start of March 2024, this will mainly be because of Google Consent Mode, yes. A lot of things that have had tracked touch points before are no longer being tracked all the way through. If you only have the last-click attribution, you’re going to lose where visitors have been coming from.”
Lisa Chittenden, who had first-hand involvement with the introduction of GDPR legislation, continued: “There’s been some mentions of Google’s AI attribution. Google historically has just been doing ‘last click’ — very simple attribution models. They’re now swapping that to a data-driven model, and it’s in its very early days. We’re hoping it’s going to be able to fill in the gaps. But you can’t necessarily trust that entirely, because it’s using AI to fill in missing gaps.”
On the matter of legislation, another audience member asked about the future of GDPR in the UK, now that Britain is no longer part of the EU.
“I heard a while ago that the UK government thinks wants to do something slightly different to GDPR. Relaxing the rules a little. Is anything happening there?”
Lisa responded: “They’re still drafting what it might look like. There is no significant change. Whether the change in government will alter that is unknown. There is, I think, a sense that if Labour get in, they will relax it more. But until then, we don’t know for sure.”
Our next question took a technical turn, with an attendee pondering: do we really need third-party trackers when a lot of user behaviour can be tracked with first-party server-side logs?
“Is there an argument for a new kind of approach where we move away from the standard content management system and the no-code builders that is really optimised for the backend data? And if we presume we’re going to lose third-party cookies, which current systems are most likely to suffer?”
Daniel’s reply: “Third-party cookies won’t affect any of those. Third-party cookies is only cross-site tracking. So it’s only going to affect advertising platforms like Google, Meta, etc. It’s only third-party cookies being phased out. They’re already gone. Except for Chrome. Chrome have delayed it to 2025.
“With what you're referring to — why am I deploying third-party code cookies on my website when I’ve got all the information already and I’m doing it five times now because each platform is doing their own version of it? — if you don’t have someone that knows it very well inside and out, then you’re not ready for server-side version.
“Google Tag Manager has a server version, which you could deploy on a server and you can manage all of your marketing tags — that way, you can build your own solution. But all of these come with costs: software licenses, server personnel, agency fees.
“Saying “no” to a cookie banner is not saying “no” to tracking because tracking happens all the time. Like you mentioned, server logs. Google Analytics still tracks you. It just doesn’t have a cookie, because that’s what you’re consenting to.”
Audience members asking questions at our Google Consent Mode brunch in Brighton
The next question was answered by Gemma Barton, senior marketing manager at Honest Burgers Ltd.
“I’m coming from an email marketing background and trying to bridge the gap and disconnect between all the data. Do you have any advice to help assist with that?”
Gemma said: “Try to have 360º integration — your website data, CRM data, and purchase data all feed into each other and match it up as much as possible. Have one place where your data’s stored. Set up rules based on actions, so it’s less manual and resource-heavy.”
Trapeze Media founder and director Kitty Newman headed the panels
And then, the final question: have we seen brands do anything interesting or unique with cookie consent banners?
“The cookie banner has become sort of habitual to people. If we thought outside the box, what could we be doing to make it less “big brother is watching,” and more a part of the user journey?”
Dani highlighted one of our recent favourites: “IKEA’s approach was good — it wasn’t just a barrier to get to the actual content. It was weaved and threaded throughout their website and made people understand what they’re actually consenting to.”
Daniel agreed: “The reason the IKEA example was so interesting is, it integrates consent into the user journey. So rather than a cookie banner popping up when you land on the website, it’s actually like: okay, here you go, have the website. And then when you go to a page with, let’s say, an embedded YouTube video, if you click ‘play’, it’s like: Oh, by the way, we need a bit of consent to do this. Are you happy with that? And you say “yes” and move on. And then it’s like: We added something to basket, we need another cookie to do this.
“It’s saying at each point that you’re only consenting to what you need and what things you’re engaging with rather than setting 15 different trackers and 30 cookies.”
Contributors:
Dani Herrmann
Senior Account Manager at Trapeze Media. Dani has been working with our clients to navigate Consent Mode conversations with the board and stakeholders.
Lisa Chittenden
Director of The Data Gym. Lisa was directly involved in passing the legislation on GDPR
Daniel Perry-Reed
Principle analytics consultant and training at Measurelab. What Daniel doesn’t know about GA4 simply isn’t worth knowing.
Gemma Barter
Senior Marketing Manager at Honest Burgers Ltd. Has implemented Google Consent Mode for 39 restaurant sites.
