Don't Ghost it: Implementing the Consent Mode with Google Tag Manager (GTM)

To ensure the continued efficiency of Google Ads campaigns in the European Economic Area (EEA) from March 2024 onwards, it is essential to implement the Google Consent Mode.

In this article, I delve into the technical implementation using Google Tag Manager (GTM) in cases where there is no Integrated Consent Management Platform (CMP) or implementation via Google SDK.

It's important to note that this discussion is not intended to provide legal advice but rather to purely illuminate the technical aspects involved.

Why is the Google Consent Mode needed?

One critical directive from Google emphasizes that if you are utilizing Google's advertising products and receiving traffic from Europe, you must incorporate either the basic or advanced consent mode before March 2024. If you are already using the "advanced mode," it is essential to update to V2.

Here, as announced just a few months ago, the new parameters ad_user_data and ad_personalization will be added to the existing ones, which are analytics_storage and ad_storage. But more on that later.

Google advertisers are strongly advised to implement these measures before March 2024 to safeguard Google audience features, ensuring accurate conversions and bolstering confidence in bidding strategies.

The advanced consent mode proves beneficial in obtaining precise conversion rates and exact numbers of unconcented users, thus aiding in recovering up to 65% of ad-click-to-conversion funnels that might otherwise be lost due to unconsented users.

Additionally, artificial intelligence aids in modeling attribution paths for unconsented journeys, extrapolating insights from non-identifying signals such as device type, browser type, country, and time. This approach contributes to maintaining accuracy in conversions and provides valuable insights for strategic decision-making.

I strongly expect that Google Chrome will deprecate third-party cookies ?? in the second half of 2024, which would align well with the overall tracking strategy.

What is required for further implementation?

• Having a consent banner and sitewide tagging
• Using GTM and having migrated to GA4

Is there a way to see if Google Consent Mode is already active?

Many website operators have (partially integrated) consent tools such as Complianz, Consent Manager, or Onsao, which can request consent, block or delete cookies. In the premium version, these tools can offer a fully auditable consent solution that takes into account the Google Consent Mode. However, this is often not the case.

To determine whether the Consent Mode is being used, simply take a look at the developer console. You can use my JavaScript to get an overview:

(function (w, d, t) {
    for (const entry of w[d]) {
        const formattedEntry = JSON.stringify(entry).replace(/\"\d{1,}\":/g, "");
        t += formattedEntry + "\n";
    }
    console.log(t);
})(window, "dataLayer", "");        

Whether consent information is being transmitted to Google Ads and Analytics can be determined with a simple test like this.

For those who want to access even more information, structured and with timestamps, they can use this code.

(function(w, d, t) {
    for (let i = 0; i < w[d].length; i++) {
        const entry = w[d][i];
        const formattedEntry = {
            index: i,
            timestamp: entry.timestamp || 'No timestamp available',
            data: entry
        };
        t += JSON.stringify(formattedEntry, null, 2) + "\n";
    }
    console.log(t);
})(window, "dataLayer", "");        

Initializing Google Consent Mode

In the next step, we assume that your consent form sends appropriate events depending on the selection, for example "Functional", "Preferences", "Analytics," and "Marketing." Partially integrated consent managers already do this automatically. If you write your own Consent Banner JavaScript, you will use the dataLayer.push() command.

I leave it up to you to define these categories. We focus solely on initializing the Consent Mode in GTM. You start by enabling the Consent Mode in your GTM Container Settings.

Next, we initialize the Consent Mode. So, before any tag can be fired and the user can interact with the cookie banner, the Consent Mode should be initialized. I recommend to set the parameters as "denied."

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  
  if(localStorage.getItem('consentMode') === null){
    gtag('consent', 'default', {
      'ad_storage': 'denied',
      'ad_user_data': 'denied',
      'ad_personalization': 'denied',
      'analytics_storage': 'denied',
    });
  } else {
    gtag('consent', 'default', JSON.parse(localStorage.getItem('consentMode')));
  }
</script>        

We use the Consent Initilization Trigger to ensure the right firing sequence, with the Consent Initilization Trigger ahead of all others.

By the way: Google provides an overview of which parameters should be set. The parameters covered in our example above are the required ones for Google Ads conversion tracking: https://developers.google.com/tag-platform/tag-manager/templates/consent-apis?hl=en

Another helpful resource: As Google's Consent Mode receives your users' consent choices from your cookie banner and dynamically adapts the behavior of ads, analytics, and third-party tags, it's important to get the setup right from the start: https://support.google.com/analytics/answer/9976101?sjid=17653893811495837196-EU

Updating the consent state

However you managed in the past to ensure that your tags only fire when consent is given, we need to change that now. If the Consent Mode is configured, only those tags are getting fired for which consent has been given.

And since currently all consent is "denied," we now need to create tags that dynamically adapt to the user's selection. I recommend to create single tags for your tracking categories, for example for "Functional", "Preferences", "Analytics", and "Marketing", which fire only when your cookie banner pushes a consent event into the datalayer.

In my case, the cookie banner pushes a "marketing_consent" event into the datalayer. This triggers my "marketing_consent_tag". And this could execute following code to grant permission for collecting and processing user ads in the context of marketing:

<script>
    window.dataLayer = window.dataLayer || [];
    function gtag(){dataLayer.push(arguments);}
    gtag('consent', 'update', {
      'ad_storage': 'granted',
      'ad_user_data': 'granted',
      'ad_personalization': 'granted',
   });
</script>        

In the next step, we need to ensure that our tracking codes are only triggered when consent has been given: To configure your current workspace, select the "Tags" button, then click on the shield icon on the top right corner. Here you can configure, which Built-in Consent and Additional Consent ist required.

Practical example: Google Ads conversion tracking

In order for the EEA consent to be effectively utilized in Google Ads, I believe it is not sufficient to simply forward conversions to GA4, which are then retrieved by Google Ads via API. A more effective solution is to directly share this information with Google Ads using Conversion Linker and Remarketing.

In Google Ads at least one conversion from the source GTM / website should be configured. The consent setup in GTM for your Google Ads conversion and remarkting tag may look like this:

If we now run this configuration through the debugger, we should see the correct tags firing depending on our selection in the consent banner and our interaction with the website. Each update of the consent will result in a "Consent" event.

A few final considerations

Especially when updating the consent status, I encountered difficulties to find the right setup. I recommend firing your regular tags after DOM-ready to maintain the correct sequence. If a tag is attempted to fire before the consent mode is initialized, it will fail!

Finally, to ensure that a user's consent is indeed sent to Google Ads and GA4, it's worth taking a look at the network console. The gtm tag should contain the gcs and the gcd parameters.

Currently, only Google uses the Google Consent Mode. Other tags don't require this information. Advertisers who don't want to jeopardize their Google Remarketing Ads performance and valuable insights into their audiences, should start implementing now.