MeasureCamp Europe 2021 - Phil Pearce - GTM consent mode (lessons learned so far)

uh so presentation on which screen right so hopefully you can see my screen actually if i move that okay so great uh all right so this is a bit of us of general discussion about uh sort of consent mode and just some slides that i threw together quickly um so uh i um it used to be um part of accelerate and now split off into my own agency called measureminds so we're uh based in in bristol just near near to london uh doing so people pay analytics uh google tag manager and um it's a day studio um for a large number of international uh and enterprise sites um we are obviously uh we're looking for sort of new candidates at the moment so if you're a senior implementation specialist insight specialist or crx expert please reach out to me um we've got a crazy amount of funding at the moment so uh just just ping me a message if that uh if that's you um the in terms of what i'm going to just go through um in here so this is my experience of using gtm's consent mode some sort of lessons learned and um hopefully a few useful sort of takeaways for you if you're trying to use it at the moment um that's a rough kind of agenda so i'm just going to walk through each of these these these kind of bits um my experience with this has mainly been on um either using cookie botch one trust or a sort of custom consent banner which was originally it was the silk tied one that got made open source so i'll just share my experience of that um just kind of before we dive into gtm's consent mode i want to just explain this of the legacy or the previous way of doing that just for background so normally the the method i would use would be a setting google analytics to to on by default although changing the remarketing uh will allow add features to off by default um but i would allow users to opt out by using in effect a blocking rule which meant that they could uh if they clicked opt out on the privacy policy page um or within a banner um then they would store a cookie and thus google tag manager would check for the existence of that cookie or base layer value and then then stop firing the analytics pixel if if that was detected so the reason i used a blocking rule was just that's more robust because there could be events uh or like on click events as well as on load events and that blocking rule was was marked on all events and just whether it detected that status of opt-out and so that method worked and um uh there was also a separate blocking rule for remarketing tags so in this case you can see there's a facebook tag here um which is uh using the same sort of method a blocking rule uh and this one's firing on all pages or uh if they click the banner link to to allow cookies obviously facebook was off by default because it's uh you know used for remarketing and retargeting so uh necessarily more risky to have that on so hence off by default um the uh the remarketing one just looks like this so obviously the blocking rules down here with that exception for allowing marketing and that would only that would meant that they would only get uh remarketed to or that facebook tag would only ever invoke if they've either accepted uh the the uh the cookie box uh the banner um yeah it would not be on by default uh and uh you can check out how that setup looked that's in one of my templates here so that was the the old way of doing it which is in that gdpr uh template from the past uh obviously now um google has introduced a new way of doing this and in essence those uh blocking rule methods have been superseded by gtm's new consent mode so uh it's uh there's a better or new way to do this um so i haven't got a template for the new uh consent mode yet but i will update it in this list once i've saved saved it and also the the two main types which are either analytics cookies or remarketing cookies have been expanded into five new types so um you might have when previously if you've been doing kind of uh gtm setups or sort of cookie audits you're probably familiar with your analytics remarketing and functional cookies functional ones are normally things like live chat or language selection or video of loudness so google being google they thought i know how can we make this even more complicate complex than it is i know let's have five different types just because we can so there's now five different types of category when previously there are four so where previously we had remarketing analytics and functional there's now these new ones for personalization and security storage personalization that would be if you're using let's say google optimize and you're using some of the cookies or functionality within that to change an a b testing experience based off what you know about a particular person the security storage that could be things like uh ad frequency capping uh or google recapture so generally that's gonna fall into this necessary category with when i've been doing this with cookiebot cookiebot automatically maps a security score storage into a necessary category and it changes personalization storage into analytics so that that's just cookie bots kind of logic for doing that so thanks google for making it even more complex cheers um uh so um and um i don't know i've got another picture of dogs and cats on him no idea anyways so you're probably thinking well that's okay well i can use this new kind of date layer for for consent and and build these the logic around these uh these new five different categories uh for security functionality as storage personalization etc etc um obviously i need to be careful and make sure these are i'm using the word denied or allowed on here not true or false and i should be able to push that to the data layer and monitor the output of it shouldn't i in theory um that's how it should work um but again google being google they decided let's not use a standard data there let's kind of use a slightly different one so in this instance here uh instead of doing this they actually use arguments um which um are actually uh sent in using the g tag so this method here doesn't work you actually have to send in the defaults using this method which is g tag and that then gets converted into a data layer output so and you can see that g tag running here and then the data layer function above it which in effect reads that gtag value the uh the reason i mentioned this is if you're trying to kind of right view the output of the uh this new consent mode you have to use a little bit of a workaround to access those values as data values just to help with your qa testing process and then validation so what you actually have to do is because these are you can't use the standard data layer to read these values because they're actually they're set as arguments so instead you have to read the last value in the data layer and then extract um the the the the in this case analytic storage so it is possible to read those values uh using a bit a little bit of a fiddly work around um and just looping through the the last values of the the data layer and getting in this case analytic storage or it could be allowad storage that will give you that true that denied or granted value and then you can use that for testing and validating um in here where i was checking uh the google consent mode versus that blocking rule method i could use this this this to do that um so on that kind of testings of um mode i i created these a bunch of new variables using this similar method just to sort of double check and validate the output of those values because obviously because we're dealing with compliance here i don't want to risk um rolling out a change and then accidentally having remarketing on by default that would be a huge kind of headache so hence this method was allowed me just to validate these outputs and you know grab them and push them into the console window and double check that stuff is working as expected uh so in here this one here as i said i was kind of going through that double checking process and i just converted where previously i had a blocking rule for uh let's say rejected analytics i changed that over to read the new gtm consent mode uh method in this case analytic storage which was looking at that granted or or denied this method um worked but there are a few nuances that i noticed when i was doing this so i'm just going to go into those unknown issues and i'm telling you this so that you're aware of it and it doesn't sort of catch you out so um bear in mind that gtm consent mode is is pretty new so there is likely to be kind of issues but we'll start with with the kind of obvious so kind of gotchas so gtm consent mode with with the most of the google tags google actually picks the category that they fall into so you don't actually have any control over that so let's that's fine if you're using let's say the adwords remarketing tag where it's obvious but in areas where it gets a bit gray such as the adwords conversion pixel it's a bit of a pain um because uh in this case you might say well hold on the adwords conversion pixel that's actually used to remove people from a remarketing list so it actually probably should be better to treat that as analytic storage rather than add storage because in effect that's we don't want to remarket to people that have already purchased the product and that that's good for users because they don't see these remarketing banners as well so um google has unfortunately kind of forced the hand there and said i'm just going to treat all adwords conversion pixels as as ads as ad storage and there's no way to override that which is really really annoying i say there's no way to override it there is a workaround which would be instead of using an adwords template tag you can use an adwords custom html tag and then you can set the the built-in storage to anything that you want but that does seem a bit of a backward step really because obviously trying to move away from template tags is is this of aim here so um um it's unfortunate that they've kind of set that and obviously this is in a beta mode so that's kind of potential sort of feedback another thing just to be aware of is with ad storage with the google analytics pixel and also g4 that also has ad storage automatically applied on it that may not always be the case though for for example if you turn off allowad features then potentially there is no ad storage on that google analytics pixel and you can do the same with j4 so in this case technically it shouldn't be add storage but again there's no way to override that setting which again is not not ideal and they have however google has calf got it right on the call tracking so instead of putting call tracking in as an ad storage they've actually left that the default empty on that so that one you can sort of put into either uh performance um of tags or into remarketing they've and i think my personal preference would be if they did the same on on the adwords conversion just so then the users can decide if they want to be white as white or slightly gram the other one um was um okay hold on just give me uh 0.25 seconds right um sorry about that um so why did i do that well it's because you need to wait for an update um so uh the what's as part of google consent mode is google was kind of saying i'm going to try and capture some stuff about you straight away but i'm going to give you a chance to kind of uh for the banner to load and for you to answer uh whether you accept or deny let's say analytics pixels so that's why they've got this wait for update um however it does mean there's going to be a slight loss in in tracking because of that but we need to kind of give the users enough time to be able to answer that question and for the banner to render so um the reason why google have done the wait for update not not just for um to allow the banner to to load is also because there will be a new feature at some point in time which will uh capture like an anonymous tracking pixel let's say with browser and um browser so with a device signature let's say and without any ip address and without any cookies so a cookie list tracking pixel and which files for all users regardless if they've accepted or not and then after they then see the banner and press accept then that's obviously it's got that data if they then deny google in theory can then do upscaling to for those people that have opted out so that there's ways of doing uh a widening on on page views or conversions similar sort of thing to what google does with clicks to store where they use the data from android to estimate how many people have clicked to store from from safari or apple devices so uh with that in mind you're probably wondering why on earth have i got a picture of a cup of tea in front of me um and on the screen well uh it's because there is no spoon um so what on earth am i going on about here um well it's because that anonymous tracking pixel doesn't yet do anything so um the uh on this kind of quote here so that pixel which potentially is is sent before any uh acceptors is granted and before any cookies are set um that is a potential feature in the future but as it stands at the moment there's no way in google analytics to run a report on um what are the number of kind of uh all users regardless of whether they've opted in or now just using basic analytics or anonymized analytics pixels um so but maybe it will google hopefully we'll introduce that feature later down the line so there's no spoon yet but there might be in the future um one other kind of thing just to be aware of and this is a cookie bot specific thing is that uh as part of gtm consent mode uh it recommends instead of using all pages we'll use the page initialized rule which is called gtm.initialize as an event um that doesn't actually work when using cookiebot you have to instead use the cookiebot consent updated it's a minor thing but it will catch you out if you don't change it to that that mode so um that's what i normally do is i in effect create an event called initialization all pages and then set that to cookie consent updated it's just because there's a slight latency when cookie bot uh checks for the values of cookies and and checks for the consent status um cookie bot itself um they've updated their gtm template recently which is great so they now give you the ability to set your default so you can choose whether you want analytics on by default or not within this list and however they don't have the setting for uh wait uh say 0.5 seconds for tags however you can get around that by adding a tag dependency that runs after cookie bot fires and then just add that gtm initialize 2 as a possible kind of way around that if you do want to get around that or hopefully maybe they'll update the template to include wait for tags uh instead um the um it's a little bit tricky for me to read the the questions whilst presenting this so i'm gonna cover those at the end uh loop back around with with questions um the um now there's kind of in effect at the moment two ways of of adding or classifying tags on a website you've got automatic or manual so cookie bottom one truster are the two vendors that support automatic classifications personally i prefer like manual classifications mainly because of the impact on speed when you run an automatic classification script such as auto block from one trust or a similar one from um cookie bot um it basically inspects all of the javascript on on the the site well actually it crawls all of the the cookies and javascript on the site um and then it in effect puts those into those three classifications and it attaches either a class or an html5 attribute stating which class classification it's put it into now that lc takes quite a lot of kind of dom time to attach that classification and also it has to run in synchronous mode rather than async so not great given that uh google is rolling out a uh of an update for site speed and rendering time so personally i always try and go down the manual route and but in some instances that's not not possible especially if one trust or cookie bot are installed outside of gtm um or if it's a large site and they just want to be like whiter than white and have no risk of any tags falling outside of of compliance so that's the um and that's why i've listed that on here in terms of that chance of breach because in effect auto block uh we'll do that that classifications without a user going in and intervening and it's also possible that a user could put a tag in the wrong category within gtm so that's also another sort of risk kind of factor um but um yeah i mean it's good that google has at least tried to add some of those those default classifications within consent mode but yeah there are some instances where it's kind of got it either a bit wrong or is only going for a whiter than white approach rather than something in the middle and the um when using those automatic blocking methods so in this case i'm just showing a cookie bot on the screen uh because these codes um are synchronous and because they need to in effect run before any tags are fired in order to prevent uh remarketing or analytics triggering uh they generally need to um yeah be a synchronous and also when using these modes it's really important that you mark the gtm tag itself as an ignore or as a one trust call it a category a one for strictly necessary or one trust opt out for script the reason for that is then it doesn't slow down gtm when gtm is loading but the elements within gtm so the analytics or javascript and those other tags do get classified so when i tried running testing when these kind of opt out values were not present on one trust it actually resulted in about three percent drop in in reported traffic so if you're if you are using auto block on one trust or cookie bot um super super important that you add the the um the opt out to the gtm.javascript script um otherwise you miss a massive chunk um the um uh if you're if you're not using autoblock um then you it's less of a problem that you don't need to worry as much about these html5 attributes and the auto block here and also yet the additional benefit that you can load the cookie banner asynchronously as you can see on this screen here so you don't necessarily need to worry about a wordpress plugin if you are using that manual classification but if you are doing if you're using automatic you have to add update the inline code and then do it outside of gtm which is a slight sort of technical difficulty in some cases the other thing is more of a kind of an industry shift that i'm seeing so previously i would say that the floating footers are probably most common now uh apologies for the the crude uh jokes coming up i'm just warning you in advance um so yeah i know we are talking about floating footers here um so uh sorry house rock slide um uh what i mean by a floating footer um is that it's a box that slides up from the bottom um and um it's normally uh it's not obtrusive it's uh it's not stopping the user kind of being able to navigate the site and uh it's generally just used for for an opt-in for remarketing normally in these cases with a floating footer analytics would be on by default now previously i would say that uh floating footers um were more common but there's been a shift more towards uh modal pop-ups or cookie walls um the reason for this is obviously cookie walls users are getting more uh familiar with just as soon as they see a cookie wall they just close the box or accept all um and that's seen in these kind of opt-in rates so this is probably kind of the much more obvious and common route now and also it keeps the compliance officer happy because uh in effect the analytics cookie here is also kind of opted into as um in this case uh statistics is is uh pre-ticked and the remarketing is is unticked um again that's a slightly gray area with compliance but um because we're only talking about remarketing is separated out from statistics i would argue that that's kind of valid um and the other method here is the fact that because the users have to accept cookies in order to use the site then there's no real choice here really so um until at some point when the browsers introduce a consent api and then uh it will be a lot simpler and we won't have all this kind of horrible ui issues examples of what the consent api might look like would be things such as on on here this has got an html5 a a a geo geo location um kind of pop up or a push notification pop up so in essence the browser would take control of of this of consent and then you wouldn't need to worry about an injected kind of banner um so there's not um a uh um there's nothing in in uh of web kit for this at the moment it's not not publicly uh sort of available but and it will probably be a gradual switch to this but that's kind of also why gtm is in gtm consent mode have focused on the back end side and and the logic and rules rather than the front end and the banner side in the sense there's no gtm banner model because of the fact that even they realize that the browsers are going to kind of handle that bit at some point in the future so it is still necessary to have both gtm doing the back end kind of a consent mode and some sort of front-end model which potentially could be switched to a browser-based solution later down the line when the browsers eventually support that so just one other thing in terms of monitoring this uh a useful to a takeaway would be uh keep an eye on the difference between your clicks from adwords versus your sessions if that starts to drop kind of massively then obviously you've got a problem with kind of opt-out rates um on this case i am on this particular slide i am starting to see that increase in in opt-out uh and there's a difference which is a bigger problem and another reason why shift more towards server side where it's harder to sort of opt out um also these some of these cookie bot solutions will give you those kind of opt-in rates um which is is helpful uh which potentially can can be used for for uh estimating the amount that have been missed or missed conversions um so that's everything i want to cover in the slide so i'm now going to jump over to questions um just seeing how we're doing for time literally and bang on um the uh let me how do i stop showing so i'm just gonna read through the questions um i can if anyone wants uh to be put on stage just click raise your hand so reading from the top actually there's a q a one here okay um do you have a preference to fire the banner by gtm or hardcoded if you had the choice uh if you didn't have uh to load um into gtm it's anything you should be mindful of so um personally i always try and load the banner via gtm because obviously i'm mindful at some point in time the browsers are going to take over that bit and i want to make it easy for the clients to be able to switch over to a browser-based consent window when it becomes available and i don't like them being locked into a specific kind of cookie vendor the uh and and also the the other reason would be i don't like when the banners are sometimes loaded synchronously and obviously it slows down the rest of the site so always via gtm where possible and always via uh synchronous uh code asynchronous i mean um the other questions um uh yeah otherwise gtm hasn't created a new uh variable type for uh consent yeah it's bonkers that they they haven't created defaults for it yeah absolutely crazy um uh google uh google integration gtm command it has it has big problems when the user has accepted all types of cookies there is some delay between the page start and the load yeah uh yeah yes uh so that's correct i mean that's why you've instead of using the gtm initialize you have to use the cookie bar updated um which is not not ideal so if you can configure for an example for gtm page view on load you have to almost wait until the storage is nice even though to be granted yeah i mean if you wait for that event called cookie bar updated that does get around that problem um is anyone using uh using this new solution one trust uh not yet but um i've i've got one uh site that i'm gonna start playing with i mean because it's still in beta everyone's that's true and no one really wants to be the first ones to try it out um so it's kind of i've been testing this on my own site at the moment and just ironing out all the bugs first before risking it on a client site um for instance like cookie bot and one trust doesn't have a tag template at the moment and there's nothing in the public library for it so they need to kind of do that first ideally um uh i'll try next week uh what's difference between not set and no additional required good question not much the only difference is in the listing of tags that you've not reviewed it gets moved so whenever you set something on up here whenever you uh add it into an area so let's say some custom code uh down here um this one here so this one uh the this one the not set and no additional no additional just means that you've reviewed it there's no change in the actual functionality just it's where it appears on the this kind of summary report um and uh i've been pushing on trust been push i'll just wrap for dates when they'll get some place oh yeah it's on our roadmap that'd be great um i see my comments about i'll keep going in sucks okay um i don't expect right okay um anyone have um experience of migrating consent from cookie bot to one trust uh use case for that as the website has been using cookie bot for a while um and switching to one trust without having to ask some consent so just be aware that um and then this is a good thing about using gtm's consent mode um in essence by using that that g tag update uh google is is setting that storage themselves so they're standardizing the cookie or local storage in values if you're using cookie bottle one trust those two solutions use different names for cookies so if you do migrate between solutions you might end up having to ask users for consent again so there is a benefit in in gtm consent mode in that sense you can obviously cookie copy cookies um so that you get synergy when doing any migration between cookie bottom one trust or vice versa um so we're probably running out of time now um so um we'll just see if um there's any other further questions uh do you have a preference uh are there any problematic issues loading it through gtm regards to race conditions um yes in the sense that obviously this weight for tag updates um is uh isn't you know there's uh and the issues are more about regarding if you're you need to make a decision whether you're using auto block or manual block because if you're using auto block then you've got to use that the the cookie banner outside of gtm and it needs to load in synchronous mode so that removes the race condition issues but if you're using a cookie bot within gtm you'd have to load it as a tag dependency for for that wait wait for updates or initialized kind of a bit um do you have any preference to the banner cover that one um for your clients do you consider yourself a data controller or a data protection uh so um uh so this is i mean google's mo viewers always kind of hand the buck over to the the agency or the client to just do to um so um and it's worth noting that google is also trying to move all of its us servers or allow for european data centers just to get around uh some of the issues with gdpr um probably more likely data processor rather than a data controller though um do you have time time values for consent easy time frame on the certain of notification um i mean the default moment is 0.5 seconds that's what everyone seems to be kind of using um but that's still going to be dependent on how fast if someone's on a mobile connection that may be not necessarily enough time so there's a it may be necessary to use conditional kind of a set timeouts depending on your speed of connection it's still kind of in flux on that one because it's obviously still in beta beta um okay i'm gonna end this session now

Channel: MeasureCamp

Views: 966

Keywords: measurecamp, data, data analytics, analytics, unconference, google analytics, digital analytics, data studio, london, GTM, Adobe analytics, DTM

Id: X-o6-v2zYyQ

Length: 33min 21sec (2001 seconds)

Published: Mon Jul 05 2021