Google AdSense and Cookies (Cookie Law) email

EU Cookies

[Badger37]

Hi all,
I've just received an email from Google regarding AdSense and Cookies.
Cookie Law came in a couple of years ago and seems mostly to be a waste or time and just another irritation to website visitors. I was hoping that it would quietly go away!

The email from Google reads as if you now have to implement a 'consent mechanism' if you have already - are other people receiving these emails and what are peoples views (especially if they are in the UK like me).

I've put the Google email text below.
Thanks.



Google Ads Policy Team
Dear Publisher,

We want to let you know about a new policy about obtaining EU end-users’ consent that reflects regulatory and best practice guidance. It clarifies your duty to obtain end-user consent when you use products like Google AdSense, DoubleClick for Publishers and DoubleClick Ad Exchange.

Please review our new EU user consent policy as soon as possible. This requires that you obtain EU end users’ consent to the storing and accessing of cookies and other information, and to the data collection, sharing and usage that takes place when you use Google products. It does not affect any provisions on data ownership in your contract.

Please ensure that you comply with this policy as soon as possible, and not later than 30 September 2015.

If your site or app does not have a compliant consent mechanism, you should implement one now. To make this process easier for you, we have compiled some helpful resources at cookiechoices.org.

This policy change is being made in response to best practice and regulatory requirements issued by the European data protection authorities. These requirements are reflected in changes that have been recently made on Google’s own websites.
Thank you in advance for your understanding and cooperation.
Regards,
The Google Policy Team

[netmeg]

I asked support. They probably won't give a clear answer, but I asked. We'll see.

[vordmeister]

How brain dead should we assume the visitor to be? Is a Massive Flashing pop up on every page saying THIS SITE SENDS YOU COOKIES not enough? (also with a link to our privacy policy giving clear details about what cookies we offer and what they do) If the visitor does not want cookies they should have been well informed enough not to proceed any further through the site if they don't want the cookies, and the privacy policy should give them a hint about turning them of in their browser.

I have not seen any requirement for us to offer a cookie free version of our websites for anyone who doesn't want cookies. Could someone link it for me?

My sites work pretty well for people who have their browsers set to not accept cookies (apart from that they can't dismiss the big flashing cookie message obviously). Mileage may vary between EU countries.

[netmeg]

Got my answer back. Yep, if you even have one EU visitor, you gotta do it. AND you have to do it on mobile too.

Salient points:

What happens if I do not comply?

Failing to comply with the EU user consent policy would result in escalation, and ultimately in the termination of your account.

Do I need to show consent messages on mobile websites as well?

Yes. Though we appreciate that screen size may necessitate a short message.

Does this policy only affect European publishers?

No. This policy applies to all publishers that have European users. You should present consent messages to users that are visiting from the EU (though you can present the messages to all visitors if you wish).

So I told him they should probably consider sending emails and putting notifications in accounts, but nobody listens to me. You've got about eight weeks.

[dolcevita]

Right now on holidays but over 2 weeks I'm gonna to implement GEO filtering based on location of IP address and showing cookie consent message only to EU visitors. It will cover 99% of EU visitors and false positive should be 2-3% what is acceptable.

[Badger37]

@vordmeister

I have not seen any requirement for us to offer a cookie free version of our websites for anyone who doesn't want cookies. Could someone link it for me?

The email Google sent (see opening post in this thread) talks about implementing a:
"compliant consent mechanism"


Also see my earlier post in this thread - taken from Google's [cookiechoices.org...]

"So if you're using third party advertising services, such as Google AdSense, you'll need to take steps to integrate your preferred solution with the advertising tags on your pages to make sure your users' preferences are respected. Each vendor offers instructions or support services for doing this. If you don't follow these steps for all the tags on your pages, you risk misleading your users: they will think they’re switching off advertising cookies when in fact advertising cookies will still be used. Therefore, test carefully any implementation of these tools on your own site."

I'm wondering if I'm reading too much into this though now.

Perhaps Google are saying if you are using a system that has a 'no cookies' option you should make sure your code supports that. BUT if you are redirecting people to an information page (like Google does) documenting/linking to ways to manage your cookies, perhaps this is ok?

It would be easy for Google to clarify - if they wanted to...

[engine]

Badger37 I suspect Google is as confused over this as are webmasters when the original directive was set. There's no way it should be as confusing as this within the EU. And for those outside the EU, serving EU audiences, should understand that they ought to comply, too, if they are, in effect, serving ads to, and earning money from EU consumers. If the e-mail didn't go to those outside of the EU, then Google is not expecting them to comply. Confusing, or what!

[vegasrick]

Based on the websites that I've seen who recently complied with this, they are almost all using this exact format found below on this site, which Google directs them to use (among others) on their cookie policy help website. All you need is a notification to the EU users of cookie use and a page explaining cookie use, which can also be added to your privacy policy page.

[silktide.com...]

[charvel]

This is just an attempt by goolge to cover all interpretations of the law and appease the EU morons, nothing more. Nowhere does google specifically say (although please correct me if I'm wrong) that you should provide an option for a user to disagree and therefore stop cookies being applied. This is because in some countries like the UK, implied consent is sufficient.

The way I read it is that google is only asking you to do what the law in your country demands.

I have now adopted the gov.uk approach where the message is only displayed on the first page view. I have the message display above content rather than on top of it, and the bar it appears in is the same colour as my main nav below it. I'll adhere to the law but I won't let it impede on my user experience.

[zerillos]

My websites last required cookies back in 2007. Why do I need to post a disclamer? I am NOT responsible for what Google and their adsense and all their c**p do. That is third party, and I will not annoy my users with a disclamer every time they access my websites, just because google wants to use cookies! EU will not tolerate this. Google, adsense and all the others should be responsible for posting cookie disclaimers whenever someone clicks on their ads! And then be redirected to wherever the ad takes them. We are not in control of the ads that show on our websites, so, why should we warn our visitors? You are using cookies to track people! Not us! You are making fools of yourselves! Not us! Why should we take the blame?

[denisl]

Unfortunatley, I think you will find that you are responsible for the third party c**p that you put on your site.

[vordmeister]

I think Google is the problem the EU are trying to address, but they have made another badly thought out law again which won't do what they want.

A lot of the EU laws are badly thought out like this (digital sales was another). If you disagree with this sort of thing it is well worth adding more wording to the very visible pop up and perhaps include a discussion in your privacy policy about the law itself and perhaps other recent silly laws. Today the first 50% of my privacy policy is not about privacy.

In the UK we are going to get a referendum soon about whether to stay in Europe and the increased visibility of the privacy policy makes it an ideal place to prompt discussion.

[netmeg]

Personally I still think it's Google going overboard to try and raise a hue and cry against the EU policy. But I can't prove it, and they'll never admit it, so whatever.

It won't do you any good to be defiant against it - it is what it is (somewhat like AdSense) If you are not in compliance, and they check, they will escalate and they will terminate. No matter where you live.

hue and cry [en.wikipedia.org]

[EditorialGuy]

I still haven't received the e-mail. (U.S.-based site with a large EU audience.)

[netmeg]

I don't know of anyone in the US who got email. Nevertheless according to John Hudson of AdSense, it still applies.

[EditorialGuy]

Nevertheless according to John Hudson of AdSense, it still applies.

In that case, they should notify everyone via AdSense messaging (and perhaps via e-mail as well) unless they're looking to reduce the ranks of AdSense publishers by 90 percent. I doubt if there are many sites that have zero visitors from the EU.

[vegasrick]

I know this, when Google made their Mobile requirement I received an email and a message in my Adsense inbox to advise me about it.

I have NOT received anything on this and neither have any of my friends with some very high traffic sites. 99.9% of them never even heard about this until I brought it up to them, and they don't really care until Google actually reaches out in some form to notify them.

[netmeg]

I suggested that they inform publishers by email and notifications in their accounts and got no answer back. I don't think that's part of their plan.

[ember]

Nevertheless according to John Hudson of AdSense, it still applies.

They can't expect US publishers to comply if we're not told about the policy.

I'm just going to block the few EU visitors I receive.

[jpch]

I really don't think this is going to be a big issue for site visitors as come October 1st they will realize it's not specific to one site. I'm sure some people will freak out but I expect it to be a very small amount of people who use the internet on a daily basis.

[nomis5]

We are not in control of the ads that show on our websites, so, why should we warn our visitors?

What!

Of course you are, you placed them there in the full knowledge they will use cookies.

What you allow to happen on your website is totally your responsibility.

You are in control. Remove the ads if it bothers you.

[netmeg]

My dev is looking at ways to implement this with Google Tag Manager for the tiny number of EU users I get. Still think it's ridiculous.

[ember]

I think it is telling that they sent the email to European publishers but not to U.S. publishers (at least not any I know). If U.S. publishers are expected to comply, why didn't we also get an email? I think Google probably wants U.S. publishers to comply but isn't going to force the issue. I guess I'll find out this fall.

[Whatagreatdayitis]

Just to get a head start on all this, I'm using Sitebeam. It's free. And you know it really doesn't seem like such a bad thing to include on the site. Here's what it says on the bottom of the page:

"This website uses cookies to ensure you get the best experience on our website."

They make it sound like a good thing. Then you have the option of learning more about the privacy policy or you can click "got it," which is a very common thing to click on on a lot of websites these days, and then the repeat visitor doesn't see it again. No big deal.

I have a feeling the opt-out thing could become required in the U.S. as well. Most of my revenue comes from the U.S., but about a fourth of it comes from European nations.

My main concern is that if advertising doesn't support free access to my site(s) then I'll have to start charging fees because I'm certainly not giving up my time to work for free or for dwindling adsense revenue.

[IanCP]

The irony in all of this is that the majority of sites such as mine, never ever used Cookies [no need] - now you need to set a cookie to tell someone you don't use Cookies - only third party people do it.

Marvellous.

[netmeg]

Ran across this plugin for WP. I dunno if it's everything you need, but I'll probably be looking into it.

[wordpress.org...]

[Badger37]

I've gone for Siltide's Cookie Consent (v2) - the free one that Google link to.
I do hope that v2 is 'good enough' and I don't find out later that only v1 is compliant!
v2 is much more basic and doesn't allow you to offer an option to reject cookies.

I've done quite a bit of tweaking to get things as I want them.
I'm using a Grid System layout so have added a maximum width to the banner.
Some of my pages are ancient and I found that the script was clashing with an old lightbox gallery - upgrading prototype.js sorted that out.

I've also tweaked things so that the banner ONLY displays for the first page view - moving pages dismisses the banner (the same as clicking Got It).

When I get some time I'm going to document some of this - might as well use the experience to get some traffic! :)

[ken_b]

Silktide ... "Got It"

I wonder if the publishers case would be stronger if that "Got it" said "OK" instead?

[Badger37]

Sorry, yes Silktide :)
I've missed the edit time now...

Google link to them from their cookiechoices website:
[silktide.com...]

You can change the "Got It" to whatever you like - it's quite flexible.
I've gone with "EU Cookie Blurb!" in my banner at the moment.

As Google use "Got It" and this thread is all about keeping Google happy with it's AdSense publishers I've used "Got It"!

I've changed pages I had forgotten I had today they are so old!

[EditorialGuy]

"This website uses cookies to ensure you get the best experience on our website."

They make it sound like a good thing.

Yep. Sounds deceptive to me (especially on sites where the only cookies are from third parties such as Google AdSense).

[Badger37]

Yep. Sounds deceptive to me...

All I'm interested in is keeping Google happy after it's recent announcement :)
The wording of cookie banners is the easy bit.


My struggle is understanding what's 'compliant'.
Do people HAVE to have a system to block Cookies?
Are you allowed to display ads BEFORE a visitor has had a chance to choose their Cookie options?