Consent requirements for the European Economic Area (EEA)

This article is for customers who use Google's online and offline solutions and receive data from end users in the European Economic Area (EEA).

As a part of Google’s ongoing commitment to a privacy-centric digital advertising ecosystem, we are strengthening the enforcement of our EU user consent policy.

These requirements and our enforcement action apply to data from:

• Websites: Tags that send data to Google.
• Apps: SDKs that send data to Google.
• Data uploads: Tools to upload data from non-Google sources, such as offline conversion imports or store sales.

To keep using measurement, ad personalization, and remarketing features, you must collect consent for use of personal data from end users based in the EEA and share consent signals with Google.

How to collect end user consent

Google recommends working with a Consent Management Platform (CMP) partner to collect end user consent. The CMP partner will help implement consent mode or the IAB Transparency & Consent Framework (TCF) v2.2 for your tags, and create a banner that’s compliant with local regulations. Learn more about Google’s CMP Partner Program.

If you already have a method for collecting consent without a CMP partner, make sure that you have a consent banner that complies with the EU user consent policy.

How to pass end user consent to Floodlight tags

Depending on the type of Floodlight tag, you can share consent signals with Google in the following ways:

• For Google Tag or Google Tag Manager, use consent mode or the TCF v2.2. Review the next steps.
• For iframe or image tags, use the TCF v2.2, or the npa and ltd parameters. Review the next steps.
• For Floodlight GET/S2S requests, use the eea, ad_user_data, and npa parameters. Review the next steps.

Important milestones

• Starting today – Upgrade to Google tag or use Google Tag Manager

  If you have any iframe or image tags, Google strongly recommends updating your tags to the Google Tag format or use Google Tag Manager. This allows you to use consent mode and optimize conversion measurement without third-party cookies.

• Before March 2024 – Ensure that all your data has consent labels
  If you already use consent mode for measurement and don’t engage in personalized advertising, such as remarketing, you don’t need to take any action.
  If you engage in personalized advertising, implement the new consent mode parameters: ad_personalization and ad_user_data.
  For guidance based on your current tagging setup, review the section Next steps.

• Starting March 2024 – Ad personalization features will require end-user consent to function
  Ad personalization features require end-user consent to both ad_personalization and ad_user_data. To continue using personalization capabilities beyond March, implement the new consent mode parameters.

Next steps for Google tag or Google Tag Manager

If a user from the EEA is using your website or app and you measure user behavior with Google tags, you need to pass through end-user consent choices to Google. Consent mode allows you to adjust how your Google tags behave based on the visitor's interaction with the consent banner on your website.

To support you with collecting granular user consent, Google has updated the consent mode API to include two additional parameters:

Name	Type	Description
ad_user_data	string	Sets consent for sending user data to Google for advertising purposes.
ad_personalization	string	Sets consent for personalized advertising. Note: Disabling personalized advertising using allow_ad_personalization_signals, yields the same results as using ad_personalization. If you set both parameters with conflicting values, personalization is disabled. To honor user choices, implement ad_personalization.

See the consent mode reference for an overview of all consent mode parameters.

Pass consent signals

If you have a consent banner and use consent mode

• If you already use consent mode and don’t engage in personalized advertising, such as remarketing, you don’t need to take any action.
• If you currently use consent mode and need to engage in personalized advertising: 
  • If you use a Google-certified consent management platform (CMP), your CMP provider will automatically update to the newest version of consent mode. Please work with your provider to ensure you are using the latest consent mode update.
  • If you maintain your own banner, implement consent mode v2.

If you have a consent banner and use TCF v2.2

• TCF v2.2 captures consent for ads personalization. You don’t need to take any action at this time. 

If you have a consent banner and do not use consent mode

If you load the Google tag and haven’t implemented consent mode, implement consent mode to use the full range of Google's advertising capabilities:

• If you use a Google-certified consent management platform (CMP), enable consent mode in your banner settings. 
• If you prevent your Google tags from loading until a user interacts with your consent banner, Google will not be able to verify user consent choices and this may lead to loss in data.

If you don’t have a consent banner and do not use consent mode

1. Learn why it’s important to manage user consent.
2. Set up a consent banner on your website. If you choose a banner provided by a Google-certified partner, make sure you enable consent mode in the banner settings.

   If you decide to build your own banner, implement consent mode manually.

   Or, enable the TCF v2.2 for your Floodlight tags. Ensure that you add window ['gtag_enable_tcf_support'] = true; to the global header portion of your tags.

 

Next steps for iframe or image tags

If you have any iframe or image tags, Google strongly recommends updating your tags to Google Tag or use Google Tag Manager. This allows you to use consent mode and optimize conversion measurement without third-party cookies.

If your iframe and image tags are not served through Google Tag Manager, then consent mode is not supported. Instead, integrate with the TCF v2.2 or use parameters to pass consent signals. 

Pass consent signals with the TCF v2.2

The TCF is an open-standard technical framework that enables websites, advertisers, and ad agencies to obtain, record, and update consumer consent for web pages.

You can integrate with TCF v2.2 in one of the following ways:

• Use a CMP partner that supports TCF v2.2. Learn more about integrating with the IAB TCF v2.2.
• Implement the TCF v2.2 framework yourself. Make sure you follow the IAB’s implementation guidelines.

Pass consent signals with parameters

If you are unable to use TCF v2.2, you can pass consent signals using the limited ads and non-personalized ads parameters:

Parameter	Description
ltd	Sets the consent for use of cookies.  A value of 0 indicates that the end user consented to the use of cookies. A value of 1 indicates that the end user hasn't consented to the use of cookies. This means the conversion won't use or create cookies.
npa	Sets the consent for personalized advertising. If ltd=0, then the npa parameter can be used to pass personalization consent. A value of 0 indicates that the end user consented to ads personalization. A value of 1 indicates that the end user opts out of remarketing and ads personalization. If missing or unpopulated, the npa parameter defaults to a value of 0. After March 2024, the npa parameter will default to 1 for users in the EEA if TCF v2.2 or consent mode is not implemented.

Next steps for GET/S2S Requests

GET or server to server (S2S) requests can track app conversions by making Floodlight calls directly from your app or server code. GET/S2S requests do not support consent mode.

Pass consent signals

For the Floodlight GET/S2S spec, the following parameters will be added to support consent collection:

Parameter	Description
eea	Sets if the end user is in the EEA.  A value of 0 indicates that the end user is not in the EEA. A value of 1 indicates that the end user is in the EEA.
ads_user_data	Sets consent for sending user data to Google for advertising purposes.  You only need to set the ad_user_data parameter if eea=1. A value of 0 indicates that the end user has not consented to sending user data to Google for advertising purposes. A value of 1 indicates that the end user has consented to sending user data to Google for advertising purposes.
npa	Sets consent for personalized advertising.  A value of 0 indicates that the end user consented to personalization A value of 1 indicates that the end user has not consented to personalization