Data PrivacyAdapting to Privacy Changes: Google Tags and Consent Mode

INTRODUCTION

Google recently made implementing Google Consent Mode v2 mandatory starting from March, 2024 to continue using ad-personalization features and other audience targeting and tracking solutions within the Google ecosystem. Businesses that use audience and user data tracking in services such as Google Ads and Google Analytics are now required, under Google’s data privacy policies and Terms of Use Agreement, to collect user consent before tracking personalized data.

As online users become increasingly concerned with privacy and data protection, data privacy laws such as the European Union’s (herein referred to as “EU”) General Data Protection Regulation (herein referred to as “GDPR”), ePrivacy Directive, and Digital Market Act (herein referred to as “DMA”) have evolved to protect individual’s rights. These evolving regulations significantly impact how companies conduct business online, necessitating the adoption of responsible data practices to comply with these regulations.

When users visit websites, they have the option to grant consent for their personal data or browser information to be accessed for data collection purposes. Many users choose not to provide consent, which creates tracking challenges for businesses.

Google Consent Mode is a crucial mechanism that helps businesses collect additional data signals from users who did not grant consent. These signals are then used to model conversions and visitor behaviour, allowing businesses to obtain necessary identifiers without relying on unconsented data.

UNDERSTANDING PRIVACY REGULATIONS

In recent years, numerous countries have enacted laws regulating the collection, storage, and use of data. The EU’s GDPR implemented in May 2018, has been pivotal in shaping the global conversation about privacy. It grants EU residents greater control over how companies manage their data. The GDPR is distinct in its comprehensive restrictions, governing not only data collection but also its storage and transfer outside the European Economic Area.

In the United States, state legislatures have followed this trend, with California leading the way by enacting the California Consumer Privacy Act (herein referred to as “CCPA”) in 2020. Other states have since introduced similar legislation, aiming to enhance consumer data protection.

India has also taken significant steps with the introduction of the Digital Personal Data Protection Act, 2023 (herein referred to as “DPDPA”). The DPDPA mandates that businesses obtain explicit user consent for using cookies and other forms of data processing. Subsequently, businesses in India now will no longer be able to use cookies freely to collect data from website visitors. The DPDPA is a robust data protection law that transforms the privacy regulatory framework in India, imposing stringent new requirements on businesses and substantial penalties for non-compliance.

In light of increasing awareness around data privacy, companies that collect user data have regularly updated their privacy policies and terms of service. These updates aim to avoid fines and minimize exposure to risky data practices. As a global leader in data services, Google has been significantly impacted by these evolving privacy laws. Consequently, Google has taken proactive measures to mitigate its liability.

One such measure was the transition from Universal Analytics to Google Analytics  in 2023. This shift coincided with the phasing out of third-party cookies across the web, thereby providing users with more control over the types of data businesses can collect.

Similarly, the release of Google Consent Mode v2 seeks to further mitigate liability related to the collection, storage, and use of data from EU residents. This updated consent mode reflects Google’s commitment to adapting to stringent privacy requirements and ensuring compliance with global data protection standards.

WHAT ARE GOOGLE TAGS?

Google Tags are snippets of code that businesses add to their websites to track user interactions and gather data for analytics and marketing purposes. These tags are crucial for collecting data on how users engage with a website, what actions they take, and how they navigate through different pages. Common examples of Google Tags include:

• Google Analytics Tags: These tags collect data on website traffic, user behaviour, and interactions. They provide insights into how users find your website, what pages they visit, how long they stay, and what actions they take.
• Google Ads Tags: These tags track the performance of advertising campaigns. They help businesses measure conversions, such as purchases or sign-ups, and optimize ad spending based on performance data.
• Google Tag Manager: This is a tag management system that allows businesses to manage and deploy marketing tags (like Google Analytics and Google Ads) without having to modify the code directly on their website.

INTRODUCING CONSENT MODE

Google Consent Mode was first introduced in September 2020 as a means of addressing measurement challenges resulting from the ePrivacy Directive and related cookie laws. This has evolved due to GDPR and DMA requirements for Google to document and add controls around the processing of personal data for advertising use cases.

Consent Mode is now a means of indicating to Google what data and for what purposes they can process the data sent to Google Analytics and Ads platforms. The introduction of Consent Mode V2 in November 2023 added additional parameters to facilitate these requirements.

Google Consent Mode is a method that allows Google tags to communicate and respect the consent preferences of consumers. It does so by passing an additional parameter within Google tags, such as Google Ads, Floodlights, and GA4. Consent Mode modifies the behaviour of Google Tags based on the consent signals provided by users. If a user grants consent, tags can operate normally and collect data. If consent is denied, tags adjust their behaviour to respect the user’s privacy preferences, ensuring that no personal data is collected without permission.

Consent Mode helps businesses comply with various privacy regulations by ensuring that data collection practices respect user consent. This reduces the risk of legal penalties and enhances user trust.

Further, by using Consent Mode, businesses can ensure that they collect accurate and reliable data from users who have given their consent. This allows for better decision-making and more effective marketing strategies.

CHALLENGES AND CONSIDERATION

One of the key challenges organizations face is when European consumers do not provide consent for the setting of cookies and/or the processing of personal data for analytics and advertising purposes, resulting in a complete halt in data collection. The “advanced” implementation of Consent Mode addresses this issue by modifying the tagging behaviour of GA4 tags to collect core interaction data without the use of cookies or user identifiers.

Instead of storing cookies when consent is denied, the GA4 tag will instead collect anonymous interaction data and utilize conversion and behavioural modelling techniques to fill in data collection gaps. This ensures the continued collection of core interaction data while adhering to privacy regulations. There are other challenges which have been mentioned below:

a. Technical Challenges

Implementing Consent Mode may present technical challenges, such as integrating with existing systems and ensuring that all tags respect user consent. It is essential to work with experienced developers to address these challenges effectively.

b. User Experience Considerations

Obtaining user consent can impact the user experience. It is crucial to design consent prompts that are clear, non-intrusive, and easy to understand, ensuring that users can make informed decisions without disrupting their browsing experience.

AMLEGALS REMARKS

The evolving landscape of privacy regulations, exemplified by GDPR, CCPA, and India’s DPDPA, necessitates that businesses adapt their data collection practices to ensure compliance and maintain user trust. Google Tags and Consent Mode serve as critical tools in this adaptation. By implementing the Consent Mode, businesses can adjust their data collection based on user consent, thus aligning with legal requirements and reducing the risk of non-compliance.

In a rapidly changing regulatory environment, businesses must remain vigilant and adaptable. Continuous monitoring of legal updates and integrating robust data protection measures are essential. Implementing Consent Mode should be part of a comprehensive strategy to maintain compliance and build a trustworthy relationship with users.

Ultimately, Consent Mode balances the need for data-driven insights with the imperative of privacy compliance, contributing to sustainable business practices and long-term success.

– Team AMLEGALS assisted by Ms. Pragati Agarwal (Intern)