About GDPR messages

Under Google’s EU User Consent Policy, you must make certain disclosures to your users in the European Economic Area (EEA) and the UK, and obtain their consent for the use of cookies or other local storage where legally required and for the collection, sharing, and use of personal data for ads personalization. This policy reflects the requirements of the EU ePrivacy Directive and the General Data Protection Regulation (GDPR).

Using Privacy & messaging and its integrated Funding Choices functionality, you can create and display a message to your users to help gather consents required under the General Data Protection Regulation. The message you create with Privacy & messaging lists the ad technology providers your site or app uses, and asks users to consent to the use of data to show personalized ads and for other purposes. You can also request consent for the use of data by your own site or app. Review the Guidelines for using Privacy & messaging for more information.

It is your responsibility to make sure your messages meet legal requirements.

Structure of a message

A GDPR message contains multiple "screens" (or "pages") that are shown to users depending on which buttons and links they click in your messages. The button options presented to users are based upon your selections in the "User consent options" section during message creation.

GDPR messages with two buttons (Manage options, Consent)

Two-button GDPR messages include the following elements:

1. Main consent page: The main screen of your GDPR message. Displays two buttons based upon the formatting and settings you selected. It explains to users why your site is requesting their consent and what it is requesting.
   1. Logo: Your site or app's logo. To include a logo here, add a logo to your message.
   2. "Manage options" link: Allows users to manually select the purposes for which they want to grant consent. If users click "Manage options," the "Manage your data" screen opens and displays the list of purposes for which you are requesting consent or disclosing legitimate interest.
   3. "Consent" button: Allows users to consent to all of the purposes and vendors you selected when you created the message in Privacy & messaging. Closes the message.

2. Manage your data: When users click "Manage options," the "Manage your data" screen opens and displays the list of purposes for which you are requesting consent or disclosing legitimate interest. Users can select the specific purposes for which they want to grant consent or opt out of legitimate interest. The IAB requires all purposes to be deselected by default when the screen loads.

   1. "Accept all" button: Allows users to accept all of the purposes and vendors for which you are requesting consent. Closes the message. Clicking this button is equivalent to the user clicking "Consent" on the Main Consent page.
   2. "Confirm choices" button: Allows users to confirm and consent to the purposes they have manually selected or opt out of purposes that the publisher has disclosed as legitimate interest. Closes the message. If the user has made no changes to this page, all purposes where the publisher was requesting consent will remain unconsented and any purposes they were disclosing as legitimate interest will remain opted in.
   3. "Vendor preferences" link: Allows users to manually select the vendors for which they want to grant consent. If the user clicks “Vendor preferences," the "Confirm our vendors" screen opens and displays a list of the ad partners (vendors) for which you are requesting consent or disclosing legitimate interest.

3. Confirm our vendors: When users click "Vendor preferences," the "Confirm our vendors" screen opens and displays a list of the ad partners (vendors) for which you are requesting consent or disclosing legitimate interest. Users can select the specific ad partners with whom they want to allow their data to be shared. Vendors must be deselected by default when the screen loads.

   1. "Accept all" button: Allows users to accept all of the purposes and vendors for which you are requesting consent or disclosing legitimate interest. Closes the message.
   2. "Confirm choices" button: Allows users to confirm the purposes they have manually selected. Closes the message.

GDPR messages with three buttons (Do not consent, Consent, Manage options)

Three-button GDPR messages include the following elements:

1. Main consent page: The main screen of your GDPR message. Displays three buttons based upon the formatting and settings you selected. It explains to users why your site is requesting their consent and what it is requesting.
   1. Logo: Your site or app's logo. To include a logo here, add a logo to your message.
   2. "Do not consent" button: Allows users to choose not to grant consent. Closes the message.
   3. "Consent" button: Allows users to consent to the purposes and vendors you selected when you created the message in Privacy & messaging. Closes the message.
   4. "Manage options" link: Allows users to manually select the purposes for which they want to grant consent. If users click "Manage options," the "Manage your data" screen opens and displays the list of purposes for which you are requesting consent or disclosing legitimate interest.

2. Manage your data: When users click "Manage options," the "Manage your data" screen opens and displays the list of purposes for which you are requesting consent or disclosing legitimate interest. Users can select the specific purposes for which they want to grant consent or opt out of legitimate interest. The IAB requires all purposes to be deselected by default when the screen loads.

   1. "Accept all" button: Allows users to accept all of the purposes and vendors for which you are requesting consent. Closes the message. Clicking this button is equivalent to the user clicking "Consent" on the Main Consent page.
   2. "Confirm choices" button: Allows users to confirm and consent to the purposes they have manually selected or opt out of purposes that the publisher has disclosed as legitimate interest. Closes the message. If the user has made no changes to this page, all purposes where the publisher was requesting consent will remain unconsented and any purposes they were disclosing as legitimate interest will remain opted in.
   3. "Vendor preferences" link: Allows users to manually select the vendors for which they want to grant consent. If the user clicks “Vendor preferences," the "Confirm our vendors" screen opens and displays a list of the ad partners (vendors) for which you are requesting consent or disclosing legitimate interest.

3. Confirm our vendors: When users click "Vendor preferences," the "Confirm our vendors" screen opens and displays a list of the ad partners (vendors) for which you are requesting consent or disclosing legitimate interest. Users can select the specific ad partners with whom they want to allow their data to be shared. Vendors must be deselected by default when the screen loads.

   1. "Accept all" button: Allows users to accept all of the purposes and vendors for which you are requesting consent or disclosing legitimate interest. Closes the message.
   2. "Confirm choices" button: Allows users to confirm the purposes they have manually selected. Closes the message.

Additional information

Use of Google’s Additional Consent Mode

Privacy & messaging GDPR messages you create using the IAB Transparency and Consent Framework utilize Google’s “Additional Consent Mode.” This is how Privacy & messaging and its integrated Funding Choices functionality transmit consent decisions to vendors that are not tagged with the “TCF” icon in the IAB Europe Transparency and Consent vendor list (Ad Manager, AdMob, AdSense). 

The Additional Consent Mode serves as a bridge for vendors that have not yet registered on the IAB Europe Global Vendor List (GVL) (these vendors do not have the “TCF” icon in the vendor list). This mode enables publishers, Consent Management Providers (CMPs), and partners to gather and propagate additional consent—alongside their TCF v2.0 implementation—for companies that are not yet registered with the IAB Europe Global Vendor List but are on Google's Ad Tech Providers (ATP) list.  

Learn more about "Additional Consent Mode" in Ad Manager, AdMob, or AdSense: 

• Ad Manager help center 
• AdMob help center
• AdSense help center

Request consent for your own use of data

You can also use the EU consent message to establish transparency and consent for a set of IAB TCF data purposes—with a basis of either consent or legitimate interest—for your own use of data. Learn how to request consent for your own use of data.