The General Data Protection Regulation¹, applicable from May 25, 2018, sets global data protection standards aimed at providing citizens with more control over their data. As a consequence of this regulation, online businesses receiving traffic from the European Union must track visitors’ and users’ behavior and collect data about them more carefully, responsibly, and — above all else — with consent.
I’m not going here into the details of what GDPR is and what it says, but I’ll get straight to the practical side trying to explain how to make your Google Tag Manager GDPR compliant.
What is Google Consent Mode?
Google Tag Manager² is a free tag management service provided by Google that allows website managers to create and monitor tags through an interface so that you don’t have to write code any time you need to create a tag.
Tags are bits of code embedded in your website’s script that can extract certain information. This information is usually about your visitors’ behavior: how long they stay on a web page, which links they click on those pages, where they have landed on your page from…
As you may already know, all this data are important to optimize and improve your website, and to offer the best service/experience possible to your visitors. But this also means that you are managing and collecting data from and about your users: you must respect their privacy and be GDPR compliant. Let’s find out how.
Google Tag Manager: privacy and consent
To understand how to make your Google Tag Manager GDPR compliant, you need to understand a couple of things about tag manager and GDPR first:
- If you are deploying tags and cookies to track your visitors’ behavior and preferences, you need consent to do so. Consent must be given from the users. This implies that you need to make users aware that you are collecting their data, and you need to give them the chance to consent to the collection of that data. Furthermore, you can only collect data and drop your cookies after the user has given their consent.
So, how do you make your Google Tag Manager GDPR compliant? Now we can answer:
- By making sure that your tags only get into action after the user has given their explicit consent.
Google Consent Mode
Let’s now move on to an even more practical step. We’ve said that, if you are using tags to track users’ behavior, you need to get consent first. This means that, if a user doesn’t provide their consent, you can’t track their behavior and your tags need to be, in a certain way, disabled.
You need a feature, that is, that allows you to adjust the behavior of Google tags based on user consent preferences: Google Consent Mode³ is a beta feature, introduced — of course — by Google, that allows you to do so. Let’s find out how it works.
Google Consent Mode: What it is (and what it isn’t)
Consent Mode has been introduced by Google to help publishers manage their tags and cookies for advertising and statistical purposes.
Google Consent Mode is a beta feature that does exactly what you need to be GDPR compliant with your tag management as we’ve explained above: it adjusts the behavior of Google tags based on user consent preferences.
Google Consent Mode currently supports the following products:
- Google Ads
- Google Analytics
- Conversion Linker
Google Consent Mode isn’t a Consent Management platform. To use Google Consent Mode, you must already have implemented a system to collect and handle personal information (a CMP, Consent Management Platform). Consent Mode doesn’t collect any data: it only taylors the behavior of Google tags to each user’s consent status.
Google Consent Mode: How does it work?
Google Consent Mode is built on two major pillars:
- User Privacy: tags are consent-aware, respecting user preferences for and storage and analytics storage;
- Modeling: Google can use those consent signals to model for lost conversions resulting from consent changes.
How does Google Consent Mode respect users’ privacy by adjusting tags’ behavior to their choices? It does so by introducing two new tags settings: analytic_storage and ad_storage.
With the analytic_storage tag setting, Consent Mode adjusts the behavior of statistics cookies on your website according to the consent state of users.
- if the user doesn’t give their consent to the collection of cookies, Google Analytics won’t read or write ads or analytics cookies; furthermore, optional features relying on Google signals will be disabled;
- if the user gives their consent, Google tags will work normally.
Does it mean that, when the user doesn’t give their consent to statics cookies, you won’t be collecting any analytical information?
No. When consent isn’t given, you’ll still be collecting some information anonymously. Anonymous data that are collected are:
- timestamps of visits to your website;
- User-agent: information about the user’s browser and device;
- Referrer: how users landed on your page;
- whether the current or prior page in the user’s navigation includes ad-click information in the URL;
Does it mean that if the user doesn’t give consent to the use of marketing cookies you can’t display advertising on your website? No, it means that — if the user doesn’t give consent — an advertisement will be shown based on anonymous data instead of being targeted and based on personal data tracking.
Sometimes, when consent preferences are changed by the user, it becomes impossible to observe the path between ad interactions and actual conversions.
Google Consent Mode fills this gap using machine learning to analyze data and trends to quantify the relationship between consented and unconsented users and then fill in missing attribution paths.
With Google Consent Mode, therefore, you can recover more than 70% of ad click-conversion paths lost due to users’ consent changes.
Benefits of making your Google Tag Manager GDPR compliant
Respecting your users’ privacy should be one of your priorities, and not only because you must.
The web is also a place where competition is extremely high: to stand out from the crowd, you need to provide not only the best quality service but also the most transparent. You need to gain your users/clients’ trust.
Clear management of personal data is an important aspect of transparency. So, this is why you want to respect your users’ privacy — not only because your website must be GDPR compliant — but also to improve the quality and transparency of your website, online business, e-commerce.
Google Consent Mode is key in making your website GDPR compliant. You can think of it as a bridge between users’ choices in terms of cookies’ consent and your tags’ functions.
Therefore, Google Consent Mode won’t replace Google Tag Manager, but it’s an addition — an improvement — to it. Now, your tags will work according to each user’s specific preferences in terms of data collection, and everything will be automated.
Your website will be GDPR compliant and it will also benefit from an improvement in terms of quality and transparency.