Under Google's EU user consent policy, you must make certain disclosures to your users in the European Economic Area (EEA) and the UK, and obtain their consent for the use of cookies or other local storage where legally required and for the collection, sharing and use of personal data for ads personalisation. This policy reflects the requirements of the EU ePrivacy Directive and the General Data Protection Regulation (GDPR).
Using Privacy & messaging, you can create and display a message to your users to help gather consents required under the General Data Protection Regulation. The message you create with Privacy & messaging lists the ad technology providers your site or app uses and asks users to consent to the use of data to show personalised ads and for other purposes. You can also request consent for the use of data by your own site or app. Review the Guidelines for using Privacy and messaging for more information.
Structure of a message
A GDPR message contains multiple 'screens' (or 'pages') that are shown to users depending on which buttons and links they click in your messages. The button options presented to users are based upon your selections in the 'User consent options' section during message creation.
GDPR messages with two buttons (Manage options, Consent)
2-button GDPR messages include the following elements:
- Main consent page: The main screen of your GDPR message. Displays two buttons based upon the formatting and settings that you selected. It explains to users why your site is requesting their consent and what it's requesting.
- Logo: Your site or app's logo. To include a logo here, add a logo to your message.
- 'Manage options' link: Allows users to manually select the purposes for which they want to grant consent. If users click 'Manage options', the 'Manage your data' screen opens and displays the list of purposes for which you're requesting consent or disclosing legitimate interest.
- 'Consent' button: Allows users to consent to all of the purposes and vendors that you selected when you created the message in Privacy & messaging. Closes the message.
-
Manage your data: When users click 'Manage options', the 'Manage your data' screen opens and displays the list of purposes for which you're requesting consent or disclosing legitimate interest. Users can select the specific purposes for which they want to grant consent or opt out of legitimate interest. The IAB requires all purposes to be deselected by default when the screen loads.
- 'Accept all' button: Allows users to accept all of the purposes and vendors for which you're requesting consent. Closes the message. Clicking this button is equivalent to the user clicking 'Consent' on the Main Consent page.
- 'Confirm choices' button: Allows users to confirm and consent to the purposes that they've manually selected or opt out of purposes that the publisher has disclosed as legitimate interest. Closes the message. If the user has made no changes to this page, all purposes where the publisher was requesting consent will remain unconsented and any purposes that they were disclosing as legitimate interest will remain opted in.
- 'Vendor preferences' link: Allows users to manually select the vendors for which they want to grant consent. If the user clicks 'Vendor preferences', the 'Confirm our vendors' screen opens and displays a list of the ad partners (vendors) for which you're requesting consent or disclosing legitimate interest.
-
Confirm our vendors: When users click 'Vendor preferences', the 'Confirm our vendors' screen opens and displays a list of the ad partners (vendors) for which you're requesting consent or disclosing legitimate interest. Users can select the specific ad partners with whom they want to allow their data to be shared. Vendors must be deselected by default when the screen loads.
- 'Accept all' button: Allows users to accept all of the purposes and vendors for which you're requesting consent or disclosing legitimate interest. Closes the message.
- 'Confirm choices' button: Allows users to confirm the purposes that they've manually selected. Closes the message.
GDPR messages with three buttons (Do not consent, Consent, Manage options)
Three-button GDPR messages include the following elements:
- Main consent page: The main screen of your GDPR message. Displays three buttons based upon the formatting and settings that you selected. It explains to users why your site is requesting their consent and what it's requesting.
- Logo: Your site or app's logo. To include a logo here, add a logo to your message.
- 'Do not consent' button: Allows users to choose not to grant consent. Closes the message.
- 'Consent' button: Allows users to consent to the purposes and vendors you selected when you created the message in Privacy & messaging. Closes the message.
- 'Manage options' link: Allows users to manually select the purposes for which they want to grant consent. If users click 'Manage options', the 'Manage your data' screen opens and displays the list of purposes for which you're requesting consent or disclosing legitimate interest.
-
Manage your data: When users click 'Manage options', the 'Manage your data' screen opens and displays the list of purposes for which you're requesting consent or disclosing legitimate interest. Users can select the specific purposes for which they want to grant consent or opt out of legitimate interest. The IAB requires all purposes to be deselected by default when the screen loads.
- 'Accept all' button: Allows users to accept all of the purposes and vendors for which you're requesting consent. Closes the message. Clicking this button is equivalent to the user clicking 'Consent' on the Main Consent page.
- 'Confirm choices' button: Allows users to confirm and consent to the purposes that they've manually selected or opt out of purposes that the publisher has disclosed as legitimate interest. Closes the message. If the user has made no changes to this page, all purposes where the publisher was requesting consent will remain unconsented and any purposes that they were disclosing as legitimate interest will remain opted in.
- 'Vendor preferences' link: Allows users to manually select the vendors for which they want to grant consent. If the user clicks 'Vendor preferences', the 'Confirm our vendors' screen opens and displays a list of the ad partners (vendors) for which you're requesting consent or disclosing legitimate interest.
-
Confirm our vendors: When users click 'Vendor preferences', the 'Confirm our vendors' screen opens and displays a list of the ad partners (vendors) for which you're requesting consent or disclosing legitimate interest. Users can select the specific ad partners with whom they want to allow their data to be shared. Vendors must be deselected by default when the screen loads.
- 'Accept all' button: Allows users to accept all of the purposes and vendors for which you're requesting consent or disclosing legitimate interest. Closes the message.
- 'Confirm choices' button: Allows users to confirm the purposes that they've manually selected. Closes the message.
Additional information
Support for the IAB TCF specification
GDPR messages created in Privacy & messaging have been updated to support the IAB TCF v2.2 specification.
Use of Google’s Additional Consent technical specification
Privacy & messaging GDPR messages that you create using the IAB Transparency and Consent Framework utilise Google’s 'Additional Consent' technical specification. This is how Privacy & messaging transmits consent decisions to vendors that are not tagged with the 'TCF' icon in the IAB Europe Transparency and Consent vendor list (Ad Manager, AdMob, AdSense).
The Additional Consent specification sends transparency and/or consent signals to vendors that have not yet registered on the IAB Europe Global Vendor List (GVL) (these vendors do not have the 'TCF' icon in the vendor list). This specification enables publishers, Consent Management Providers (CMPs) and partners to gather and propagate additional consent – alongside their TCF v2.2 implementation – for companies that are not yet registered with the IAB Europe Global Vendor List but are on Google's Ad Tech Providers (ATP) list.
Learn more about 'Additional Consent' in Ad Manager, AdMob or AdSense:
Request consent for your own use of data
You can also use the European regulations message to establish transparency and consent for a set of IAB TCF data purposes – with a basis of either consent or legitimate interest – for your own use of data. Learn how to request consent for your own use of data.
Consent revocation
When a user resurfaces the European regulations message via a revocation link on your site, the European regulations messages with three buttons (Do not consent, Consent, Manage options) will always be shown.
