What does EU GDPR means for Adsense?

Question about GDPR and Adsense.

[hwint]

Question: What does EU GDPR means for Adsense?

Most of the Adsense income is from interest based ads. Will this be affected by the EU GDPR?
I'm concerned because today with the latest update for my Android Phone, I got asked for permission related to interest based ads. (Maybe it is because I did disable it before. This is to see the normal ads on my pages with Adsense. But I'm still concerned.)

[dolcevita]

Rasputin, surfagtinho...So you guys gonna for interest based ads for EU with implicit consent?

It means a bit modify PP and cookiebar but without any explicit consent regarding interest based ads for EU visitors?

Im just wonder because i have still.not any idea what to do.

Thanks

[Cralamarre]

For anyone using WordPress, have you tried any plugins for getting consent and making your site GDPR compliant? I've noticed a few that look like they would do the job. The one I'm thinking of using is Cookiebot. I'm just not sure how to tie it in with AdSense, or if it's possible.

[SpookyFairy]

Cookiebot is very easy to implement, with just a few modifications of code, you can implement a cookie consent method. I am opting for contextual ads and showing adsense only when user consent to marketing ads. I also give up a big chunk of my revenue, but it's more important for me to comply with Adsense terms and not taking any risk of having my account get banned of not complying. If this topic wasn't serious, you wouldn't see all the Internet and large corporations going crazy about it and doing everything to comply in time. It's very easy to report a website that is not complying with adsense terms of use, so why take any risk. This is how I see it and I've already implemented it in most of my websites, Working on the others.

[SpookyFairy]

I also have a feeling that this move with push the ad prices up because there will be less impressions and ad spaces being utilized so there will be more competition on squiring the less available advertising space/impressions. In a way, it might balance itself in some degree.

[surfgatinho]

@dolcevita - No, I'll be running contextual ads for now, not interest based. I looked at the RPM on my account and it is around 15% less for contextual, which I can live with (just).

I will look into ways of running interest based ads at some point, once things are a little clearer.

[surfgatinho]

Cookiebot is very easy to implement

It should be! If I used this it would be my single biggest outgoing, that includes my massively overpowered dedicated server!

If this topic wasn't serious, you wouldn't see all the Internet and large corporations going crazy about it and doing everything to comply in time. It's very easy to report a website that is not complying with adsense terms of use, so why take any risk.

I will comply with the spirit of the law, which is a lot more than many small / medium website owners will. I frankly don't think a lot will either grasp the ramifications, or be able to implement a solution.

Personally, I may link cookie consent to ad serving but I will be looking for a free solution.

[Cralamarre]

@SpookyFairy, thanks for the info about Cookiebot. I think what I'll end up doing is showing non-personalized ads for EU users, and using Cookiebot for the consent form (since non-personalized ads still use cookies). EU users make up only 10% of my AdSense revenue to begin with, so even if I lose a bit with non-personalized ads, it shouldn't affect me that much.

[SpookyFairy]

I also don't put all the eggs in one basket. By the way, i checked another website of mine, 360 opted-out, 6 opted-in, good luck for anyone counting on the good will of people opting-in.

[Cralamarre]

I am opting for contextual ads and showing adsense only when user consent to marketing ads.

@SpookyFairy, you're saying you won't show ads at all unless the visitor says it's okay? I thought it was okay to show non-personalized ads as long as you have the consent form in place.

[SpookyFairy]

@Cralamarre Maybe my bad English doesn't make things clear. contextual I mean non-personalized. I am turning personalized ads off because I am implementing different consent tool in different websites, and you can't tell adsense to use it per-domain. So I am showing non-personalized ads for all EU visitors, still I ask consent to display those ads because they do omit cookie(s). So yes, the user won't see any ads until he gives his consent for marketing cookies, whether this is non-personalized or personalized ads. I just decided not to show personalized ads for my websites in general.

[SpookyFairy]

I am planning to use iubenda.com for one of my websites. However, they don't have an option to just show the banner to EU visitors. This of course will eliminate most of the revenue from that website. However, at least I can no risk of losing revenue from people browsing outside the EU. So to tackle this, I will use a ip2country database (I'll buy one), install it on MySQL. Whenever a user visits the page, I will send an SQL query to the server, checking if that IP is from the EU, then render the iubenda script on the page. This way, people from the US for example won't see that banner at all nor anything else that the scripts generated. I think it's a good idea.

Many of those GDPR scripts, IN MY OPINION, have very negative impact on the revenue if you use them for all visitors. I've already checked the opt-in stats, and for my websites, they signal that if I use it for all visitors, I can start searching for a job on the 25th of May.

[edited by: SpookyFairy at 4:23 pm (utc) on May 10, 2018]

[Cralamarre]

@SpookyFairy So if users won't see any ads, including non-personalized ads, unless they give consent to cookies, that seems to mean that the GDPR is an ad blocker, since no one will give consent to show ads.

If the fine for not being GDPR compliant is up to 4% of your revenue, but being GDPR compliant will remove a lot more than 4%, maybe it's better to just pay the fine.

[SpookyFairy]

@Cralamarre this is exactly the point. Just imagine a website that most of his revenue comes from EU visitors viewing ads, I don't even want to think what happen to all those small websites, I think they need to search alternative monetization solutions. I think that many small businesses that rely on ad networks that omit cookies might say goodbye to their businesses. This is how severe that it is. I think that most people don't even understand that implications. If you don't have lots of EU visitors, Just implement those GDPR compliant tools like cookiebot and check the starts for yourself. Who knows, maybe your visitors will be nice and most of them opt-in, but I don't think so.

[SpookyFairy]

It's also not "PAYING THE FINE" your ad network can close your account which means no revenue from them. I think your most concern should be regarding not being GDPR compliant and those ad networks stop working with you, not getting a fine.

[dolcevita]

Surfgatinho but do you gonna to use implicit consent with option to opt-out / opt-in within your Privacy policy page?

[vegasrick]

Spooky is confusing two different directives. For non-personalized ads, the eprivacy directive applies - where you have to obtain consent. For personalized ads, GDPR applies and you have to obtain "explicit" consent - big difference. The eprivacy directive can use implied consent with the whole "if you continue to use this website, that means you agree" - where with GDPR for personalized ads, the user has to make a choice one way or the other or be given a very easy way to opt out.

[SpookyFairy]

@vegasrick Thank for that information, do you have an official link to that information regarding non-personalized ads. Thanks.

[Cralamarre]

The only ad network I use is AdSense, and I've been a publisher with them for 12 years. I just can't believe that after 12 years, my only options as of May 25 will be to lose some of my earnings or have AdSense terminate my account and lose all of my earnings. What a nightmare. And how many small website owners who rely on AdSense don't even know that any of this is happening? They're all going to get terminated? That can't be right.

[edited by: Cralamarre at 4:36 pm (utc) on May 10, 2018]

[Cralamarre]

@vegasrick So you're saying that as long as people click the "Continue" button on the consent form (which is what I always do), it's okay to show non-personalized ads. That makes more sense, otherwise AdSense would be finished.

Hasn't the original e-privacy law been in place for years now? I ask because I've never done anything about it, and I've been fine. AdSense continues to show ads in the EU with no issues.

[SpookyFairy]

@vegasrick It's important to check the official documents for that. I am searching but if @cralamarre knows about it, he or she can save me time.

[ember]

Just don't show personalized ads to EU visitors - turn them off in your Adsense account - and show the implicit consent banner that everyone should have been showing since 2014/2015 for non-personalized ads. Link to your privacy policy where visitors can opt out of cookies. If that is not enough, then the web's ad model is probably dead.

my only options as of May 25 will be to lose some of my earnings or have AdSense terminate my account and lose all of my earnings.

I seriously doubt that is going to happen. Google is pushing compliance responsibility onto us to cover their rear ends. They can say that they told us what to do. They are not going to come after us if we do not comply. They will leave that up to the EU (which will not come after small sites with little EU traffic anytime soon). And if Google did decide to shutter all accounts that do not comply on May 25, they would lose a huge chunk of revenue. Half of webmasters have no idea this is coming.

[edited by: ember at 4:45 pm (utc) on May 10, 2018]

[Cralamarre]

@SpookyFairy I'm not aware of the official documentation, but my original understanding was the same as what @vegasrick was saying, that only personalized ads require explicit consent, and that non-personalized ads are fine as long as the visitor clicks "Continue".

[SpookyFairy]

From my understanding, you need to pause ad serving before you get consent, "explicit" or not. If what Cralamarre is saying it correct (still checking this..), this means that implied consent can be used, which as far as I understanding it, if the user click continue, scroll the website, click on a link, this might be implied consent and then you can unpause the ad serving, but I am not a lawyer nor an expert to know if will work nor if this works for every country in the EU. I am going over the GDPR official documents again, hopefully to find the right answer.

[SpookyFairy]

LOL, all month I am just working on this GDPR thingy It's insane how unclear all that information is and they want us to have a clear privacy policy :)

[Cralamarre]

@SpookyFairy, if your understanding is correct, then online advertising is finished as of May 25, 2018. It makes more sense that only personalized ads would need explicit consent.

[ember]

And there is so much confusion around this. No one really knows what to do. I think it will be tied up in the courts for years.

[SpookyFairy]

@cralamarre I agree, if it was like that, many EU small businesses will close the doors, Adsense can close its doors and this EU rule will actually do a lot of damage to the EU economy. LArge companies will benefit from it as close businesses that rely on this revenue model will shut down. SO yes, I think this might sound that indeed what you are saying is correct.

[Cralamarre]

@ember I agree, I don't believe that AdSense is going to send out mass account termination notices. Google has put the responsibility on us (the publishers) to wipe their hands of it so they can continue to display ads and earn money from sites that don't comply, which at least in the short term will probably be the majority of sites. Like I said, and I know this is my bad, but I don't even show the eprivacy consent banner on my site and nothing at all has happened. I haven't even received a single email from a visitor about it, probably because most internet users don't have a clue about eprivacy laws, much less the GDPR.

[surfgatinho]

I think (hope) @ember has the only sensible interpretation of this - although it is probably easier to say this if you are based outside of the EU and 90% of your revenue doesn't come from there...

I'm not worried about the EU coming after me though. I don't think they would just for running Adsense, even if it was personalized ads without consent. I am fairly confident I wouldn't be the first to be hauled up if that ever happened...
As I've said, my only concern is doing the minimum Google's ToS require...

[surfgatinho]

Now, here is a thought to worry our non-EU based cousins.

If you are running a site which can be browsed in the EU by EU citizens, and you are, for example, based in the US. Then unless you fully implement GDPR compliance in line with what Google require, you are just as much in breach of any terms stipulated (whatever they may be) as anyone based within the EU...