Why do you need Consent Mode in GTM and GA4?
Introduction
In the modern world, it is difficult to find a person who has never seen a consent banner for data collection or the use of cookies. The bigger challenge is to find a business that has not considered compliance with GDPR or CCPA. It is obvious, because potential fines for violating these regulations can be significant — just google it. Regarding facts, there is an important question: How can data be collected while respecting users’ rights?
No one can better inform whether a specific website complies with the law than a professional lawyer or a dedicated data privacy team. However, the configuration of the data collection process and its control is often a responsibility of a web analyst. Fortunately, privacy engineering is becoming more accessible every day. And there are already possibilities to collect data for more general aggregation level than the individual user scope.
Google, the leader in web analytics tools, has been testing a beta version of a solution for over a year. It can meet the needs of businesses, website users, and intermediaries, such as web analysts. This solution is called “Consent Mode,” which is a conditional system that allows collecting user consent for the use of cookies for various purposes.
Privacy compliance is not just a responsibility but also an opportunity to demonstrate respect for users. The implementation of Google’s Consent Mode should eventually become a popular solution that provides transparency and control over data for users, complies legislative requirements and meets the analytics needs of businesses.
In the following article, I will provide overview about the implementing Consent Mode and its key benefits. My goal is to help you understand how you can utilize this tool to enhance privacy on your website and also illustrate the data you can obtain as a result.
Consent Management Platform
To configure Consent Mode, it is necessary to implement a Consent Management Platform (CMP) on the website. This tool enables users to control the usage of their data and cookies on websites. There are various ready-made solutions available for implementing a CMP, and I would recommend choosing from the list mentioned in Google’s documentation, particularly if you intend to use Google Analytics or Google Tag Manager. This approach will simplify the setup and management of tags in the future. The consent banner that we frequently encounter when visiting a website for the first time is generated by the CMP.
A user visiting a website is presented with the option to grant or deny permission for storing and using different types of information in cookies. There are five standard consent types for cookie storage: ad_storage for ad-related information control, analytics_storage for analytical data, functionality_storage for basic website functionality, personalization_storage for personalized settings, and security_storage for authentication or security-related data. By using a Consent Management Platform, users can assign either “granted” or “denied” values to each of these storage types. These assigned values are considered by future tags during the execution, if the configuration is correct. To ensure proper retrieval of user consent values for each storage type, a Consent Initialization trigger is available. This trigger is specifically designed to activate standard consent values (usually “denied”) before other tags and allows users to modify these values through the consent banner. For example, this trigger can be utilized when setting up a tag based on the Cookiebot template in Google Tag Manager.
Consent engineering inside GTM
It is interesting to note that the basic configuration of Consent Mode is pretty popular. Basic Consent Mode is a config when an analyst or website owner simply blocks the firing of tags if user consent is not given, especially for ad_storage and analytics_storage cookies. This approach respects the visitors’ desire to remain anonymous, but limits utilizing valuable features in analytics tools. Google’s marketing is effective, and many have heard about the magical capabilities of GA4 to model missing data. However, if you want to enable these features in your property, you need to have the correct implementation of Consent Mode and not just tag blocking. The documentation provides an excellent screenshot that illustrates this comparison.
In addition to modeling, one of the most valuable feature, in my opinion, that an analyst may miss out by not configuring Consent Mode correctly is the collection of cookieless hits in BigQuery. I will revisit this topic later on.
In this overview, I am eager to share with you the most comprehensive configuration of Consent Mode. It begins with the container settings, where you need to enable “Enable consent overview”.
Once you enable this setting in your container, you will notice the appearance of the Consent Overview icon.
If you click on it, a popup will open, through which you can track which tags are functioning under Consent Mode and identify any tags that may still require configuration, if needed.
Every GA4 tag template (as well as GA Universal Analytics) includes a basic configuration option that enables easy transition to the consent awaiting mode for specific types of permissions. For example, in the provided screenshot, choosing “No additional consent required” will trigger the tag to verify if the user has given consent for ad_storage and analytics_storage. It is crucial to note that the Consent Management Platform must be configured correctly.
Benefits
So, what does this configuration offer us in the context of using Google Analytics 4? If we are utilizing the GA4 property through the regular interface accessible to all users, we gain the ability to view enhanced reports enriched with modeled data. This modeling covers the portion that could have been lost due to user refusal to store cookies. In Google’s documentation, this aspect is presented as Behavioral Modeling for Consent Mode. To enable this functionality, along with properly configuring tags and the consent banner, you need to have sufficient traffic: a minimum of 1000 events per day for a week with analytics_storage=’denied’, and the property must have at least 1000 users per day for 7 days within the last 28 days. Approximately 7 days of analytics are required to train the model and update the data. However, it is noted that there can be exceptions and the data volume requirements may increase.
It is important not to forget to enable blended settings; otherwise, the reports will only be generated based on data from users who have provided consent for data collection. Furthermore, if you delve into the documentation or explore your own property with sufficient data amount, you will realize that modeled data is incorporated into a limited number of reports. Conducting complex and in-depth analyses or constructing intricate visualization types in Explorations are not feasible.
In this context, the most important and powerful functionality of Consent Mode, in my opinion, for businesses and analysts, is the ability to store cookieless hits in BigQuery. If you have properly configured Consent Mode in all your tags, and for example, a user visits your site and does not give consent for storing cookies, you will not see that user’s actions in the interface of GA4 property reports. Moreover, you will not see their actions in the live table (events_intraday_) in BigQuery if you are collecting such data. However, approximately two days after the hits are fired, Google will process the data, and events will appear in the regular table with all GA4 data in BigQuery. Each of these hits will have a null value in the user_pseudo_id field, while the analytics_storage and ads_storage fields will contain the value “No”.
Hence, we won’t be able to attribute events from users who have not consented to storing cookies to specific individuals. However, we still have remarkable opportunities for aggregating and conducting a thorough analysis of site activity.
In my upcoming article, I will dive into how we can influence the content added to the GA4 interface reports independently of user consent, highlight some manipulation techniques of hit data, show the possibility of accurate tracking even with cookies disabled, and define the role of server-side Google Tag Manager in these processes. I will not be addressing the ethical or legal aspects of data collection. Instead, I want to do a creative exploration of privacy engineering possibilities. It is an intriguing subject, and I hope that shedding light on certain aspects will prove valuable.
If you find value in this article and it helps your work, I would deeply appreciate your applause.
Such support inspires me to create more valuable content.
