Consent & Privacy Signals on Google Pixels - MeasureCamp Amsterdam 2024

ANALYTICS
DEBUGGER
David Vallejo
@thyng
Consent & Privacy Signals
on Google *Pixels*
20TH APRIL 2024 - AMS - NL

Who I
am
David Vallejo
Analytics Debugger :: ES/PV
@thyng

What
I do
● Technical Analytics
Implementations
● Consultancy
● I build tools used by hundred of thousands
fellow analysts across the world :) .
Thank y’all
● Write about Analytics/Data
● Complain/Vent on social networks

We'll be diving into how Google passes
consent and privacy-related details via their
Pixel payloads.
( Google Analytics, Google Ads, Floodlights, etc )
WHAT WE’LL BE LEARNING
TODAY
www.analytics-debugger.com
MEASURECAMP AMSTERDAM - 20TH APRIL 2024 - NETHERLANDS

- GOOGLE CONSENT
- Mode v1
- Mode v2
- TCFv2 (Transparency and Consent Framework)
- IAB CCPA Compliance
Framework
- DMA (Digital Markets Act)
- OTHERS
WE’LL WALK THROUGH:

GOOGLE
CONSENT
MODE V1

- &gcd
- &gcu
- &gcs
- &gcut
Google Consent: Default
Update
Status
Update Type
CONSENT MODE V1
PARAMETERS

CONSENT MODE V1
(gcd & gcs)
“-” NOT DEFINED/NOT APPLICABLE
“0” DENIED
“1” GRANTED

CONSENT MODE V1
(gcu)
This parameter was holding “1” value if the there was a
consent.update defined.

CONSENT MODE V1
(gcut)
That was the Update Type. This parameter was holding
“1” o “2” value. I never looked much into it.

BUT THEN ON
NOVEMBER
2023

CONSENT
MODE V2

- &gcd
- &gcu
- &gcs
- &gcut
Google Consent: - Declaration
CONSENT MODE V2
PARAMETERS

Actual Look

HOW THE CONSENT IS SET
Actions:
“default”
“update”

CONSENT SETTING LOGIC
FLOW
UPDATE DEFAULT CURRENT

FLOW
UPDATE DEFAULT
DEFAULT
CURRENT

FLOW
UPDATE DEFAULT
UPDATE
CURRENT

SADLY IS
NOT JUST
THAT
SIMPLE

I did some reverse engineering over ALL
the code in a GTAG Container

I did some reverse engineering over ALL
the code in a GTAG Container
- Code if minified, hard to read
- Google Started to
obfuscate/mangle the variable
names
- Many switches are coming
hardcoded on the code ( your
container code is dynamic ), for
example depending on your
country some features may be
enabled or not, this makes really
hard to guess the behaviour
since you only see a if(true)
value

AND THIS IS
WHAT I
FOUND…

DISCLAIMER: The upcoming info is based on my
reversing work and testing, things may change anytime
or not be 100% accurate due to the impossibility of
checking everything
AND THIS IS
WHAT I
FOUND…

FLOW
UPDATE DEFAULT
CURRENT

FLOW
UPDATE DEFAULT
CURRENT
UPDATE DEFAULT
CURRENT
DECLARE
(country based?)

FLOW
UPDATE DEFAULT
CURRENT
DECLARE
(country based?)
IMPLICIT/DELEGATED
(Based on the current user
detected country/region and
legislation)

Some other people did some research on this:
https://www.markus-baersch.de/blog/consent-mode-2-0-faq/
https://www.simoahava.com/analytics/consent-mode-v2-google-tags/
CONSENT STRING

WE’LL LEARN
TO READ ALL
THE DETAILS

CONSENT STRING
This is a fixed value. It has not known usage at the moment.

CONSENT STRING
Then we have 4 groups of 2 characters ( [A,Z,0-9,-,_] ) , that will define each
of the current applicable consent categories.

CONSENT STRING
The characters are assigned using a The left shift ( << ) operator , basically each consent type granted
/ enabled value are assigning a value in a binary int.
0000 0000 0000 0000 > Ad storage Granted 0000 0000 0000 0001 (1) Ad Storage denied 0000 0000
0000 0011 ( 3) , and this gives a different number for each consent we keep adding, then GTAG takes
this number and returns the position over a safe.base string

CONSENT STRING
The First Character. Indicates how the consent can be defined.
“1” - Not Defined
“2” - Implicit Consent Definition Denied
“3” - Implicit Consent Definition Allowed

CONSENT STRING
If you have been working on the configuring Google Consent Mode before the 6th of March, you
may have noticed that the ad_personalization used to report a 3X. ( or 1 if not set ). Since the DMA
went into scene, if the user is browsing within Europe, a 2X will be reported
This means that ad_personalization state can not be longer implied in EU ( if you visit your site from a non EU
country you will see that a 3 will being reported on the ad_personalization. )
What happened is that since 6th march, Google is not longed allowed to say, you didn’t provide a consent, I’m
gonna to say it’s granted because the new regulation asks the ad_personalization to be explicitly defined. And
this is why they have been pursuing people the last month to report the consent on the hits. Because if they
werent’ the wouldn’t even be able to use “pings” to model the data …

CONSENT STRING

CONSENT STRING
“2” - Implicit Consent Definition Denied
“3” - Implicit Consent Definition Allowed
“P” - Delegated ( ad_user_data consent set via the ad_storage )

CONSENT STRING
The First Character.
“2” - Implicit ( The consent was not
“3” - Defined

CONSENT STRING
The Second Character indicates indicates the current consent state and the state for the current
consent commands.
To the data it will report the “default” and “update” states.
*** Likely to get new “letters” when the “declare” command it implemented. ???

CONSENT STRING
1 - Consent Not Defined + Ads Signals Not Defined
2 - Consent Not Defined + Ads Signals Set True
3 - Consent Not Defined + Ads Signals Set False
4
5 - Consent Defined + Ads Signals Not Defined
6 - Consent Defined + Ads Signals Set True
7 - Consent Defined + Ads Signals Set False

API TO CHECK THE CONSENT
“1” - Consent Explicitly Granted (via default, update or
declare )
“2” - Consent Explicitly Denied (via default, update or
declare )
“3” - Consent Implicitly Granted
“4” - Consent Explicitly Denied

● The Consent String may have any [A-Z,a-
z,0-9,-,_] pairs values
● The Current active applied consent may be slightly
different from that we are defining in our code (
because it may had been set implicitly or by delegation
● Beware that Privacy and Consent needs are
regulations will keep evolving.
RECAP

CONSENT
MODE
SHARED

&npa
Non Personalized Ads
Expected Values: 1 or 0
Value inherited from ad_personalization consent state.
Tells if non-personalized should be used.
Non-personalized ads are ads that are not based on a user’s past behavior. They are targeted using contextual
information, including coarse (such as city-level) geo-targeting based on current location,

DIGITAL
MARKETS
ACT

&dma
Digital Markets Act
If the user is visiting from the EEA will be opted-in
For the Digital Market Act
This can be set on GTAG code based on the current user location or because
the Integrare il supporto IAB TCF 2.0 is implemented by the CMP and
gdprApplies values is true.

&dma_cps
Digital Markets Act / Core Platform Services
https://twitter.com/thyng/status/1742243233017524245/

IAB CCPA
Compliance
Framework

&us_privacy
US PRIVACY STRING
Expected Values: 1YNN, 1– - -
https://github.com/InteractiveAdvertisingBureau/USPrivacy/blob/master/CCPA/US%20Privacy%20String.md

&us_privacy
US PRIVACY STRING
Expected Values: 1YNN, 1– - -
https://github.com/InteractiveAdvertisingBureau/Global-Privacy-Platform
The US Privacy
signal has been
deprecated as of
January 31, 2024.
We strongly advise
all users of the US
Privacy String to
transition to the
Global Privacy
Platform.

IAB / Transparency
& Consent
Framework (TCF)
v2

&gdpr
IAB / Transparency & Consent Framework (TCF) v2
If the tcfapi is implemented by the CMS and it reports that gdprApplies

&gdpr_consent
TC String Reporting
https://github.com/InteractiveAdvertisingBureau
/GDPR-Transparency-and-Consent-
Framework/blob/master/TCFv2/IAB%20Tech%2
0Lab%20-
%20Consent%20string%20and%20vendor%20l
ist%20formats%20v2.md

OTHER
PARAMETER
S

&pscdl
Privacy Sandbox Cookie Deprecation
Label
https://developers.google.com/privacy-
sandbox/setup/web/chrome-facilitated-testing

&gcsub
Collecting Subregion
Expected Values: region1
Used on server-side hits. It will be precede by “sst.” prefix.
It reports the current subregion collection endpoint

&ude
User Data Enabled
Related to 1P data collection by Google Tags
ie: 0,1
***newly added

&are
Attribution Reporting Enabled (Conversion API)
Expected Values: 1
Will report 1 if the Attribution Reporting is Enabled.

&pae
Protected Audience Enabled
(Formerly – FLEDGE)
Expected Values: 1

&gse
Google Signals Enabled
This is used on the server side tracking parameters,
meaning it will prefixed with “sst.”
Ie: 1,0

&ecid
Enhanced Client ID
This is a random integer that gets saved on the Google
Analytics Stream Cookie, as the last part of the value
Ie: 888127762

&ecid
Enhanced Client ID
P.D. Got no more specific details about the usage. Sorry

Consent and
Privacy
Checking
Tool

https://consentcheck.analytics-debugger.com/

CREDITS: This presentation template was
created by Slidesgo, including icons by
Flaticon, infographics & images by Freepik and
illustrations by Stories
david@analytics-debugger.com
Follow me at: @thyng
Let’s Link In: https://www.linkedin.com/in/david-
vallejo-sanz/
www.thyngster.com
Thanks

Consent & Privacy Signals on Google Pixels - MeasureCamp Amsterdam 2024

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Consent & Privacy Signals on Google Pixels - MeasureCamp Amsterdam 2024

Similar to Consent & Privacy Signals on Google Pixels - MeasureCamp Amsterdam 2024 (20)

Recently uploaded

Recently uploaded (20)