The Age of Consent: Google Consent Mode v2, Third-Party Cookies and GDPR – The Definitive Guide

Every day we give thousands of consents as we open just as many web pages. And of all that, probably only 1% of people actually read what they are approving. But all of this is changing right in front of us and, while some grab the popcorn to see what will happen to websites, their owners find themselves urgently needing to comply with privacy rules that change from one week to the next. We have decided to compile the key terms and create a definitive guide to the age of consent.

What is user consent? User consent is the free, specific, informed and unambiguous authorisation a user gives for their personal data to be collected, used or processed.

In the online context, this consent applies to actions such as:

• Using cookies to track user behaviour.
• Sending emails for promotional purposes.
• Sharing personal data with third parties.

Characteristics of user consent

Consent must be:

• Free: The user must be able to give consent without coercion or pressure.
• Specific: The user must know exactly what they are consenting to.
• Informed: The user must receive clear, understandable information about how their data will be used.
• Unambiguous: Consent must be a clear, affirmative action, such as clicking a button or ticking a box.
• Reversible: The user must have the opportunity to withdraw their consent.

As we have said, the user data privacy landscape has become a central axis of digital transformation. In this context, the removal of third-party cookies, Google Consent Mode v2 and the responsible management of personal information are key for websites not to lose tracking of user behaviour insights and not to be fined up to 4% of the company’s global annual turnover.

The removal of third-party cookies

Third-party cookies, used to track user behaviour across different websites, have for years been a fundamental tool for online advertising. However, growing privacy concerns have driven changes in regulations and in browser practices. Google, for example, announced the gradual phase-out of third-party cookies in Chrome by the end of 2023.

Why are third-party cookies being removed?

Third-party cookies have been criticised for:

• Invading users’ privacy: They allow intrusive tracking of user behaviour without their explicit consent.
• Making it harder for users to control their data:
  Users are not always aware of how their data is tracked or how they can control its use.
• Creating an opaque ecosystem: The lack of transparency makes it difficult for users to understand how their data is used and who has access to it.

How will the removal of third-party cookies affect online advertising?

The removal of third-party cookies will have a significant impact on online advertising, since it:

• Will reduce the effectiveness of behaviour-based advertising: Advertisers will no longer be able to track users across different websites to show them personalised ads.
• Will increase the importance of first-party data: Advertisers will focus on collecting data directly from their own users.
• Will drive innovation in online advertising: New ways of targeting and personalising advertising without relying on third-party cookies will be sought.

What should advertisers and website owners do?

Faced with the removal of third-party cookies, it is important that website owners take care of:

• Implementing a Consent Management Platform (CMP) to manage user consent.
• Adapting their advertising strategies to rely less on third-party cookies.
• Exploring alternatives such as contextual advertising or interest-based targeting.

GDPR and data protection

The first important point for your website is to follow the European Union’s General Data Protection Regulation (GDPR), which has redefined the online consent landscape. This regulation sets out clear rules for the collection and use of personal data, including the obligation to obtain explicit consent from the user. GDPR compliance is the fundamental first step for any website operating in the European Union or collecting data from European users.

What does GDPR mean for your website?

It means your website has user consent enabled for using their personal data and using it to analyse their behaviour and make personalised offers. To this end, the website has to provide clear and understandable information to the user about how their personal data will be used. But we must bear in mind that under GDPR the user must have the possibility of withdrawing their consent and controlling the use of their data.

How to comply with GDPR?

• Review your privacy policy: Make sure your privacy policy is up to date and meets GDPR requirements.
• Implement a CMP: You can use a Consent Management Platform (CMP) to manage user consent efficiently. >>>
• Carry out a data audit: Identify what personal data you collect and how you use it.

Benefits of GDPR compliance:

• Protecting users’ privacy: You demonstrate your commitment to protecting users’ privacy.
• Greater trust: You build trust among your users and customers.
• Avoid fines: You protect yourself from fines for GDPR non-compliance.

GDPR compliance is not only a legal obligation, but also a way of building trusting relationships with your users and customers. By protecting users’ privacy and being transparent about how their data is used, you can strengthen your brand and improve your reputation.

Here at Impactiq that is how we see it and, as partners of Iubenda, the best provider of privacy solutions, we offer a wide range of privacy protection services for all businesses.

The professional CMP for online interaction

“Consent” has become the cornerstone of the web experience. As we discussed earlier, users must have control over how their personal information is used, and businesses must offer clear, transparent options for managing this consent. To avoid having to worry about configuration and to comply with all the laws, the best solution is to have a professional CMP.

What is a Consent Management Platform (CMP)?

A CMP is a platform that makes it easier to manage user consent on a website. It lets users choose which types of cookies they want to accept or reject, and makes it easier for businesses to comply with privacy regulations.

CMPs are essential tools for:

• Ensuring compliance with GDPR and other privacy laws.
• Offering a transparent, personalised user experience.
• Protecting users’ privacy and building trust.

Since a few days ago, when Google launched its new consent mode, a CMP has to be verified by Google if it wants to keep collecting data from Google products. The main challenge here: websites can no longer use free open-source CMPs if they are not verified by Google, and they need professional tools if they want to keep tracking and analysing their users’ behaviour. Without consent, advertisers risk losing between 30% and 60% of their data, with variations across sectors. Here you can access the full list of Google-certified CMPs.

That is why implementing or upgrading your CMP to Consent Mode v2 is essential for businesses that want to keep using Google Ads in their marketing strategies within EEA markets.

Google Consent Mode v2 is designed to integrate user consent preferences with Google’s advertising and analytics tools. It allows websites to:

• Obtain accurate information about user consent.
• Adjust the behaviour of Google tags based on consent.
• Measure the impact of consent on website performance.

But implementing Google Consent Mode v2 is only the first step on a road at the end of which cookies will disappear and the reign of first-party data will begin.

How do you implement it on your website?

5 steps to implement a CMP:

1. Choose a CMP:

• Features: Assess the functions you need (cookie management, consent banners, etc.).
• Integration: Make sure the CMP integrates with your web platform and other tools.

2. Sign up with the CMP:

• Create an account: Provide basic information about your company and website.
• Configure the CMP: Select the consent options, customise the banner and the policies.

3. Integrate the CMP into your website:

• Option 1: Add the CMP code:

  • Insert the JavaScript code: Copy and paste the code provided by the CMP into the header or footer of your website.

  Example code:

  HTML

  <script src="https://cdn.cmp.example.com/cmp.js"></script>
  
  <script>
  window.cmp.init({
   "consent": {
   "categories": ["necessary", "analytics", "marketing"],
   "default": "necessary"
   },
   "banner": {
   "position": "bottom",
   "text": "This website uses cookies. By browsing this website, you accept the use of cookies."
   }
  });
  </script>
  

  Use this code with caution.

  Option 2: Use a plugin or extension:

  • Install the plugin/extension: Some CMP providers offer plugins or extensions for popular web platforms such as WordPress or Drupal.
  • Configure the plugin/extension: Follow the provider’s instructions to configure the plugin/extension and connect your website to the CMP.
• Customise the design: Adjust the appearance of the consent banner to match your brand.

4. Configure the consent options:

• Define cookie categories: Classify the cookies used on your website by category (for example, analytics cookies, marketing cookies).
• Set consent rules: Specify which cookies may be used depending on the user’s consent.

5. Publish the CMP on your website:

• Activate the CMP: Make the CMP visible to users visiting your website.

First-party data: the key to a cookieless future

The removal of third-party cookies will boost the importance of first-party data, that is, the information businesses collect directly from their users.

In this new context, first-party data becomes an even more valuable asset for businesses. First-party data refers to the information businesses collect directly from their own customers or users through their own channels and platforms.

This information can include data such as:

• Contact information: names, email addresses, phone numbers.
• Behavioural data: web pages visited, products purchased, interactions with the brand.
• Preferences and interests: demographic information, purchasing habits, etc.

To get the most out of first-party data, businesses can consider implementing data collection strategies such as sign-up forms, surveys and on-site behaviour analysis. They could also use data analysis tools such as marketing automation platforms, CRM and web analytics. It would also be useful to create segmentation and personalisation strategies, identifying specific audience groups and developing relevant content and ads for each group. Finally, it is essential to ensure data security and privacy by implementing measures to protect customers’ personal information.

To manage and collect first-party data, businesses will need to draw on imagination and creativity, because users are increasingly tired of filling in forms and surveys.

On the other hand, non-personalised advertising, which is therefore useless and irritating, will push users to share their data in order to receive ads that match their profile.

In this case the strategies are as simple as:

• Create a loyalty programme: Offer customers incentives to share their data, such as discounts or access to exclusive content.
• Use sign-up forms: Request information from customers when they subscribe to a newsletter or create an account on the website.
• Run surveys and questionnaires: Ask customers to share their opinions about products, services or the brand in general.
• Analyse on-site behaviour: Monitor the web pages customers visit, the products they view and the actions they take.

The removal of third-party cookies represents a challenge for digital marketing, but also an opportunity for businesses that adapt to this new scenario. Investing in the collection and strategic use of first-party data will be key to success in the future of online marketing

So what do I do now to comply with all this?

Navigating the age of consent requires a deep understanding of the new regulations and the tools available. Adopting a CMP, managing first-party data responsibly and being transparent about the use of personal information will be key to building an online future where user privacy is a priority.

[button link=”https://impactiq.es/en/contact/” type=”big” color=”purple”] Contact us![/button]