Configuration requirements for data collection have never been more confusing. Differing EU laws, patchwork privacy in the United States, differing feature support based upon regions within Google Analytics—where is an organization supposed to start?
While the landscape can seem very complex, with Google Analytics 4 there is a fairly straightforward decision process to take.
Let’s dive into the decision tree, the reasoning for the recommendations, and how to configure each of the various options for your website.
Consent & Opt-Out Requirements
We won’t dive into all the nuances of global privacy regulations as they pertain to consent and opt-out here (if curious, you can see our deep-dive here for this larger discussion). What we will do, however, is provide a very brief summary:
EU Consent Requirement Summary
- Consent must be a “freely given, specific, informed and unambiguous indication of the data subject’s wishes”.
- Consent must be given for the storage and accessing of cookies from a user’s device (ePrivacy).
- Consent may be used as the lawful basis of processing a user’s personal data (GDPR).
In summary, you need consent for the placement/accessing of cookies in a user’s browser and also for the processing of any user’s personal data for purposes of advertising.
U.S. Consent Requirements Summary
- U.S. laws follow an “opt-out” model and do not require prior explicit consent for most activities.
- U.S. laws do not concern themselves with cookies but rather how and for what purposes you are processing/using personal information/personal data.
- U.S. laws allow for the opt-out of using user’s information for purposes of advertising but do not extend to the usage of information for purely analytics purposes.
- U.S. laws have explicit exceptions for the processing of personal information/personal data for purely measurement use cases.
In summary, unlike Europe, consent is not necessary as a prerequisite for the processing of personal data/information nor the usage of cookies. Instead, users must be provided information about the personal data/information that is being processed and given the ability to opt out of the usage of their personal data/information for targeted advertising purposes.
Options Available to Restrict Data Processing in Google Analytics 4 (GA4)
Disable Signals
Google Signals was introduced in 2018 as the method used in Google Analytics for cross-device reporting. It has evolved from there to encompass the underlying functionality which drives these reporting aspects, as well as many of the advertising features in GA4.
When Google Signals is enabled, aggregate data from users that have allowed “Ads Personalization” within their Google Ads accounts supplements data in Google Analytics to provide interest group and demographic reporting. It also allows for the identification of users for audience creation and activation within the Google Ads ecosystem.
By disabling Signals, you remove the possibility of a user being included in an audience group for targeting and for their personal information to be used for cross-context behavioral advertising or personalized targeting. In addition, when disabled, Google Analytics will not collect information about these users from other Google advertising cookies placed in their browser. As a result, demographic and interest data will not be available for these users, nor will they show up in DV360 or Google Display Network Impression reporting within GA4.
Signals can be disabled at the entire GA4 Property level, by region, or on a per-user basis. Details for the configurations are below.
Disable Ads Personalization
Ads Personalization is a feature component of Signals in GA4. The feature is enabled by default when Signals is turned on but you do have the ability to disable Ads Personalization separately while still having Signals more broadly enabled for reporting use cases. From Google’s documentation, Ads Personalization allows you to “collect data for ads personalization purposes, in addition to measurement, in connection with your use of such features as Google signals, User ID, ads integrations, and/or if you enable data sharing with Google”. Put simply, it is the component within Signals which provides functionality related to leveraging GA4 data for personalized advertising to users.
When Ads Personalization is disabled, reporting/measurement in Google Analytics is not impacted (including functionality related to Signals), but some activation abilities are limited:
- Users indicated as not eligible for use for ads personalization (either due to region disabling or dynamic user disabling) will not be added to any lists that may be exported to linked ads accounts.
- When ads personalization is disabled for locations and events, all specified events collected will be marked as not eligible for use for segmentation and audience creation.
Put simply: Users or events with this disable indication and/or users from disabled regions will be indicated in the GA backend. Any user with this indication cannot be included in audience lists when they are shared across linked Google Ads platforms for targeting. User actions, demographic information, and interest information associated with these users will also be excluded from consideration when creating lookalike audiences for use in linked Ads Platforms. These users, however, will still show up in reporting within Google Analytics. They can also still be included in audiences that can be exported to platforms (such as Google Optimize) for on-site content personalization and A/B testing.
Ads Personalization can be disabled at the entire GA4 Property level, by region, or on a per-user basis. Details for the configurations are below.
Consent Mode
Consent Mode is a technical configuration which Google introduced in 2020 that controls the behavior of Google tags on a page—modifying the tag behavior based upon the consent selection of the user. It is important to note that Consent Mode is only currently supported in the EEA and UK. When implemented, Google tags will listen for an indication via Consent Mode of the user’s consent selection. Based upon the user’s consent state (if they have or have not consented to advertising or analytics cookies/data processing), the Google tags will modify their behavior accordingly.
There are several options available with Consent Mode which we detail in this full explainer. To summarize, if a user has not consented to defined options, Google Ads and Analytics tags will still load and collect anonymous interaction data but will not place nor access cookies aligned with the consent preferences of the user. When a user has consented, the tags will behave normally.
This functionality provides two key benefits for websites in Europe and the UK:
1. Increased visibility to conversions and user interactions
Traditionally, when explicit consent is being respected on a site, Google Analytics would be blocked from loading until a user has granted consent. Sites configured in this way have a huge gap in reporting and measurement because they have no data from users that do not consent. This means no conversion data, no traffic data, no transaction data. For many organizations, they have experienced a 50-70% reduction in observable traffic as a result. Worse, it is impossible to know exactly what proportion of the overall user base this gap represents.
Consent Mode provides a solution for this gap in observable interaction data by offering a means to only collect anonymous interaction data for all users and then collecting full data (with identifiers) for users who do consent. This contributes to much more visibility to what is actually happening on the site, what content is most effective, how many conversions are occurring, and which campaigns are most effective in driving traffic.
2. Foundation for advanced modeling capabilities
In addition to the greater visibility to conversion and event counts that Consent Mode provides, the data collected from the full user set also provides the basis for Google’s Conversion and Behavioral Modeling functionality within GA4. This helps to provide a realistic picture of how users are interacting with your digital properties and which campaigns are driving the most conversions. This modeling is only possible once Consent Mode has been configured.
Consent Mode is a tagging configuration, with additional scripts needing to be added to all pages along with tag and firing condition modifications. Configuration details are detailed below.
Recommendations
EU and UK Websites
Configure Google Consent Mode
The traditional method of configuring Google Analytics to not load for users that have not granted consent leaves a massive gap in measurement for the website. Consent Mode allows for the cookieless and anonymous collection of interaction data to help close this gap. The fact that no cookies are set nor accessed until the user has consented helps address compliance concerns related to ePrivacy laws in Europe. In addition, because identifiers are not collected until the user has explicitly granted consent, GDPR concerns can also be addressed. This is the best way in the EU to execute a privacy-centric data collection architecture in Europe and the UK.
United States – Option A – Disable Signals – More Conservative
In the United States the concern for user choice is not the usage of cookies or the collection of personal data in the context of web analytics, but rather how that data is being used. Specifically, users have the right to opt out of the selling/sharing of their personal information (California) and the right to opt out of the processing of their personal data for targeted advertising (Virginia, Colorado, Utah, Connecticut). There are explicit exceptions for the processing of this data for first-party measurement use cases. Disabling Google Signals for users who opt-out of said processing activities removes the ability to include users in audience lists for targeted advertising while still allowing for full interaction data collection and usage. This option is the more conservative approach due to no advertising identifiers being collected or used by Google Analytics—including for measurement use cases—due to Signals being turned off. You will still have behavioral reporting, conversion reporting, and campaign reporting for actions observed on-site but will not have access to aggregate user insights from Google Ads nor Google Ads reporting within GA4.
You have the ability to disable Signals at the GA4 Property level, region level (specific states), or conditionally for individual users. We recommend disabling conditionally at the user level to respect the user’s privacy preferences while still optimizing the platform’s utility as much as possible.
United States – Option B – Disable Ads Personalization – Moderately Conservative
The second option for restricting data processing in the United States is to keep Signals enabled more broadly, but to disable Ads Personalization upon user opt-out. In this scenario, advertising cookies set by Google platforms will still be read and identifiers collected by GA4, but the user will be ineligible for inclusion in audiences for targeted advertising. This approach maximizes the utility of data for measurement purposes but limits the processing for targeting, which is what is required by U.S. state regulations. In most cases, organizations see this as sufficient for compliance—but the more conservative option (disabling Signals entirely) is also available.
Ads Personalization can be disabled at the GA4 Property level, region (state) level, or conditionally at the user level. It can also be disabled for defined events—making those events ineligible as a segmentation option for audience creation. We recommend disabling Ads Personalization at the user level conditionally for specific users who opt-out to respect their privacy preferences while optimizing platform utility.
Configuration Details
Consent Mode
Consent Mode is a more technical lift and requires a few different steps. Depending upon the Tag Management System as well as the Consent Management Platform that you are using, the implementation can vary.
Here is a link to Google’s documentation for how to configure.
Need help in configuring Consent Mode?
Disable Signals and/or Ads Personalization
Signals and Ads Personalization can be enabled/disabled at the Property/Region level (see here for Google’s documentation on how to do so) or for individual users. For individual users, disabling requires the conditional modification of a field within the GA4 configuration tag (see here for Google’s documentation on how to do so).
The first principle of privacy-centric marketing is to respect the privacy of your users. A core component of this is properly configuring GA4 to respect their privacy preferences while still allowing your organization to get the most utility as possible from the platform. Follow this guide and take a big step forward towards privacy-centric GA4 usage!
