Introduction to user consent management

This article is for anyone that sends data to Google and is collecting and managing user consent. 

Learn why and how you might need to manage user consent for Google Analytics, Google Ads, or Ads Data Hub.

Why manage user consent

Consumers increasingly expect to control the data they share about themselves, and Google provides tools for you to respect your users’ choices. Websites and apps that use Google Analytics or Google Ads gather and store information about website visitor and app user behavior. Google also lets you upload data from other sources into Google Ads, for example by uploading store sales data.

Many countries and regions have laws that require advertisers to get users’ consent to store and share information about them. These laws vary by jurisdiction and change over time. It is your responsibility, as an advertiser, to understand the laws that affect you and to implement consent management solutions for any data you share with Google.

Websites use cookies to store information, while apps use app identifiers rather than cookies. However, many people refer to all stored information as cookies. Hence, you might see the shorthand term cookie consent to talk about getting user consent for both websites and apps. Similarly, the term cookie banner is often used to refer to all consent management solutions.

How to manage consent

Managing user consent requires the following:

1. Obtain the user’s consent choice to grant or deny consent for storing information about their behavior. You are responsible to obtain users’ consent on your website or app or any data you upload to Google.
   For websites and apps, you can implement a consent banner or other custom consent solution, or use a Consent Management Platform (CMP). Learn more about setting up your consent banner with a Consent Management Platform (CMP) or a Content Management System (CMS).
   For data uploads to Google, please consult with your legal department on a consent management solution that fits your business needs.
2. Communicate the user’s consent choice, or consent state, to Google. Many CMPs handle sending the consent state to Google. If you implement a custom consent solution, you must implement a method to send the consent state to Google, see Choose a framework to manage consent.
3. Ensure that Google tags and third-party tags behave according to the user’s consent choice.

Choose a framework to manage consent

To communicate user consent from websites and apps, your consent solution needs to use a consent framework to send consent data to Google. You can choose between Google consent mode and the IAB Transparency & Consent Framework.

If you upload data to Google, for example, store sales data, make sure you include consent signals to continue leveraging ad personalization features like Customer Match with store sales data. Learn how to send consent for uploaded data.

Consent mode

Consent mode lets you communicate your users’ cookie or app identifier consent status to Google. Tags adjust their behavior and respect users’ choices

Tags with consent checks adjust cookie storage behavior. If a user denies consent, tags no longer store cookies but instead send pings to the Google server, as described in Consent mode behavior. This means that not all information about visitors who deny consent is lost. Pings allow Google Analytics 4 properties to model data, as described in About modeled key events and Behavioral modeling for consent mode.

IAB Europe Transparency & Consent Framework (TCF)

The IAB Europe Transparency & Consent Framework (TCF) is an alternative way of obtaining and tracking consent state. If your custom implementation or CMP uses the TCF to obtain consent, it passes the consent state to Google as a special TCF string. The Google tag or Tag Manager can read this string and set measurement behavior for tags with consent checks. See Implement the Transparency and Consent Framework for more details. For those who are not yet registered on the IAB Europe Global Vendor List (GVL), Google provides Additional Consent Mode as described in Google’s Additional Consent Mode technical specification.

When your users deny consent with a consent solution that uses the TCF, GA4 properties can’t model data to fill in the missing information.

Ways to get started with managing user consent

Your data source	1. Obtain user consent	2. Send user choice to Google	3. Ensure Google tags comply with consent choice
Website	Set up a consent banner	Set up consent mode	Verify consent mode implementation
App	Set up a consent banner	Set up consent mode	Verify consent mode implementation
Data uploads to Google	Obtain user consent for data uploads to Google	Send consent for data you upload to Google	N/A

Other customer privacy controls

Consent mode is only one tool in the box when it comes to privacy-safe measurement. To find out about other solutions offered by Google, use the Ads Privacy Planner or take a look at the settings below:

• Set how to share collected data with Google. See Data sharing settings for details.
• Set whether Google masks IP addresses. See IP masking in Google Analytics for details.
• Set the amount of time before user-level and event-level data stored by Google Analytics is automatically deleted from Analytics servers. See Data retention for details.
• Request manual deletion of data from Google Analytics servers. See [GA4] Data-deletion requests for details.
• Set which accounts, products, and services an account administrator links together. Everyone with account view permissions will have access to the data from all linked accounts. See Google Analytics linking overview for details.