The Interactive Advertising Bureau (IAB) Europe has established a Transparency and Consent Framework (TCF) for advertisers to acquire user consent that is compliant with the General Data Protection Regulation (GDPR). The IAB TCF 2.0 is a voluntary standard for acquiring Cookie Consent intended for use by publishers, vendors, and Consent Management Platforms (CMP). On 16 May 2023, the IAB TCF 2.0 was updated to 2.2 (IAB TCF 2.2).
Google Ad Manager is integrated with the IAB TCF 2.2. If publishers want to serve Google’s advertisement products like Google AdSense, Ad Manager, or AdMob, they should be integrated with the IAB TCF 2.2. To integrate with the IAB TCF 2.2, publishers must implement the IAB-registered CMP on their websites or apps.
The IAB-registered CMP creates and sends the Transparency and Consent (TC) string to Google Ad Manager. Then, Google’s ad tags and SDKs use the TC string they receive from the CMP to respect user choice and comply with the GDPR.
Publishers must use a CMP that has the IAB TCF 2.2 integration.
If you have implemented an IAB Europe-registered TCF CMP on your site or app, Google Ad Manager automatically consumes the TC string from the CMP without publisher configuration. IMA SDK and Mobile Ads SDK automatically obtain, parse, and respect the TC string from within local storage.
CookieScript is integrated with the IAB TCF 2.2 and is a Google-certified CMP, recommended by Google for the implementation of Google Consent Mode and Google Tag Manager. With CookieScript, you can use Google’s advertisement products like Google AdSense, Ad Manager, or AdMob.
Requirements for Personalized and Non-Personalized Ads
The IAB TCF 2.2 manages the Global Vendor List and Google ad technology providers. Vendors and Google ad technology providers need to pass the certification process by the IAB TCF 2.2 and Google to be present in the list.
See the guide on how to select Global Vendors and Google Ad Tech Providers from the list from the list.
Publishers should review the registration settings for the vendors they choose to work with through the IAB Europe TCF. The following requirements apply specifically when Google is a vendor in the publishers’ CMP.
Requirements to serve personalized ads
Google serves personalized ads when all of the following criteria are met:
- The end user grants Google user consent to:
Store and/or access information on a device.
Create a personalized ads profile.
Select personalized ads. - Legitimate interest is established (or consent is granted, where a publisher configures their CMP to use publisher restrictions to request consent for Google) for Google to:
Select basic ads.
Measure ad performance.
Apply market research to generate audience insights.
Develop and improve products.
Requirements to serve non-personalized ads
If the requirements for personalized ads are not met, Google serves non-personalized ads when all of the following criteria are met:
- The end user grants Google user consent to:
Store and/or access information on a device. - Legitimate interest (or consent, where a publisher configures their CMP to request it) is established for Google to:
Select basic ads.
Measure ad performance.
Apply market research to generate audience insights.
Develop and improve products.
Google ads when the end user didn’t grant Google user consent
Under the GDPR, cookie consent is required for both personalized and non-personalized ads. For non-personalized ads, Cookie Consent is still required because non-personalized ads still use cookies or mobile identifiers to combat fraud and abuse, for frequency capping, and for aggregated ad reporting.
This means that if you don't have the end user cookie consent for the above-mentioned purposes, Google will serve only a limited ad if you have a legitimate interest. If you don't have a legitimate interest to all of the above-mentioned purposes (and no Cookie Consent), Google will not serve ads at all.
In practice, if users press the “Decline all” button on your cookie banner, you will have neither Cookie Consent nor legitimate interest, so Google will not serve ads to your website or app. This is not related to the cookie settings. It is related to the internal rules of the IAB TCF 2.2 and Google, which follow the regulations of the GDPR.
This couldn’t be changed in a GDPR-compliant way.
If publishers want to have Google ads on their websites or apps independently of a user behavior, it is one workaround to solve it. Publishers could deactivate the “Decline all” button on their Cookie Banner. See the guide on how to activate or deactivate the “Decline all” button on your Cookie Banner.
You can also hide the cookie declaration table on your Cookie Banner. This could be done with the Custom CSS function, found at the CookieScript user account > Settings > Colors.
Note, that if you hide the “Decline all” button or the cookie declaration table, your Cookie Banner will not comply with the GDPR and other privacy laws. Therefore, we do not recommend using this workaround to serve Google ads for non-consented users.
You may be interested in the related blog article:
Google Consent Mode v2 and non-consented users
To solve the problem of non-consented users, in March 2024, Google introduced Google Consent Mode v2. Consent Mode v2 collects additional signals from users who did not grant user consent for collecting their personal data. These signals are then used by Google for conversion modeling (Google Ads, Floodlight, etc.) and behavior modeling (Google Analytics 4).
So, even if you can’t serve ads in a GDPR-compliant way for non-consented users, by using Google Consent Mode v2, behavior modeling, and conversion modeling, you can collect additional signals from non-consented users. Using this approach together with the collected and modeled data, you could better understand the behavior of users and target ads for users, who are more likely to grant Cookie Consent.
Read more about:
Frequently Asked Questions
My website doesn’t show Google ads: how to change settings of the Cookie Banner to solve the problem?
Google Ad Manager is integrated with the IAB TCF 2.2. To serve personalized and even non-personalized ads, you need to get the end user’s consent or have a legitimate interest. If you don't have Cookie Consent but have a legitimate interest, Google will serve only a limited ad. If you don't have either Cookie Consent or legitimate interest, Google will not serve ads at all. Use CookieScript CMP to collect cookie consent.
How to serve Google Ads using the IAB TCF 2.0 standard?
If you have implemented an IAB Europe registered TCF Consent Management Platform (CMP) on your website or app, Google Ad Manager automatically consumes the TC string from the CMP without publisher configuration. Simply choose an IAB Europe registered CMP like CookieScript and enable the IAB TCF 2.2.
Is the IAB TCF V2.2 necessary to serve Google ads on a website?
The IAB TCF 2.0 is a voluntary standard for acquiring Cookie Consent. However, Google Ad Manager is integrated with the IAB TCF 2.2. If you want to serve Google’s advertisement products like Google AdSense, Ad Manager, or AdMob, it is recommended to integrate your website or app with the IAB TCF 2.2. Implement the IAB registered Consent Management Platform (CMP) like CookieScript CMP to integrate with the IAB TCF 2.2 and serve Google ads.
Can I serve Google ads on my website if users don’t give user consent?
No. If you don't have cookie consent from users or legitimate interest, Google will not serve ads. However, you can use a workaround: deactivate the “Decline all” button on your cookie banner, so users can’t reject cookie consent. Note, that if you hide the “Decline all” button, your Cookie Banner will not comply with the GDPR and other privacy laws. Use CookieScript CMP to create privacy laws-compliant cookie banners and collect cookie consent.
What are the requirements to serve personalized ads?
Google serves personalized ads when all of the following criteria are met: the end user grants Google user consent to: store and/or access information on a device, create a personalized ads profile, and select personalized ads; and legitimate interest is established for Google to: select basic ads, measure ad performance, apply market research to generate audience insights, and develop and improve products. CookieScript CMP can help you to collect and store user consent.