What does EU GDPR means for Adsense?

Question about GDPR and Adsense.

[hwint]

Question: What does EU GDPR means for Adsense?

Most of the Adsense income is from interest based ads. Will this be affected by the EU GDPR?
I'm concerned because today with the latest update for my Android Phone, I got asked for permission related to interest based ads. (Maybe it is because I did disable it before. This is to see the normal ads on my pages with Adsense. But I'm still concerned.)

[SmallP]

If you turn your Adsense settings to non-personalised for EU visitors, you might notice this at the bottom of the page:

Google will show only non-personalised ads to users in the EEA. You're required to obtain your users’ consent to the use of cookies for this purpose, where applicable. For more information about his policy, see the Google EU User Consent Policy.

The link takes you here:

[google.com...]

and it is well worth reading carefully.

I think Adsense publishers need to take this very seriously.

Remember that we must

1. get consent for cookies set
2. record and store consent
3. provide a means for them to change their mind later
4. disclose processors who have access to any personalised information (including IP addresses)
5. be very sure that those processors are complying with GDPR themselves.

Google states:

If you fail to comply with this policy, we may limit or suspend your use of the Google product and/or terminate your agreement.

[steviec79]

Cralamarre, that looks a good option to me. Or have the instructions on your privacy page, so people don't need to leave your site.

[steviec79]

SmallP, then they'll be suspending thousands upon thousands of accounts then.

[Cralamarre]

@steviec79 The Cookies and You site will open in a separate browser window, so people can visit it if they want without leaving my site. I'm also including links to the Privacy Shield website, my web host's privacy policy page, and anything else I can think of.

[SmallP]

steviec79 - yup, if that's what they expect. It's frightening.

[QuaterPan]

SmallP, then they'll be suspending thousands upon thousands of accounts then.

Isn't it what happened with Youtubers? ... Of course they didn't get their adsense accounts suspended, but the result is the same ...

[steviec79]

Not used Adsense with Youtube - what happened?

[Cralamarre]

I'm a YouTuber. Did something happen that I don't know about?

[ember]

Google changed the requirements for showing ads on YouTube videos a few months ago. Raised the minimum views or something. It was in response to that idiot Logan Paul showing a dead teen in a forest. People didn't lose their accounts, though, at least as I recall.

The deep pocket the EU will likely go after is Google. Guess who will get thrown under the bus if Adsense accounts become an issue?

A little common sense has to come into play here. Most Adsense account holders are mom and pop shops without teams of lawyers. I doubt the Europeans are going to push Google into ruining their livelihoods if they are at least trying to comply, at least not right away.

[Cralamarre]

Google changed the requirements for showing ads on YouTube videos a few months ago.

Ah yes, I do remember that. But as you said, no one lost their accounts, and it has nothing to do with this.

[steviec79]

A little common sense has to come into play here.

This is what worries me. Common sense is not common. Not at all. The larger the company, the less they have.

[BoredMeteor]

If Google wants to go all ban happy because of GDPR, so be it.

I absolutely don't think they will, and specifically referring back to their FAQ ([google.com ]), they straight up say:

In the meantime, for those customers not seeking consent to personalized ads, we will continue to apply national standards for cookie consent, and we are not requiring changes to current cookie consent implementations.

So I'm happy to continue on with non-personalized ads and abiding by the ePrivacy Directive. Until the next regulation, anyway. Or the one after that.

That said, I think it's pretty clear at this point that the Internet is being shape-shifted into something that will, in the future, only be viable for huge corporations. It's how they want it. Smaller operations are getting squeezed left and right, and it seems like everybody's cheering it on.

[MayankParmar]

I won't be surprised if Google bans thousands of small publishers. Probably the best excuse to get rid of small players.

[Cralamarre]

@MayankParmar Google doesn't need an excuse. They can ban anyone they want, any time they want to. A small publisher may be small, but thousands of small publishers is still a lot of money.

[ember]

What do you mean by small? Pageviews, RPM, monthly revenue?

They could suspend ad delivery, but I'd think they'd give you a chance to come into compliance like they are doing with the Chrome filter. BTW, whatever happened to that? But it won't be in one fell swoop. I still think this is going to take time to sort out.

[fretfull]

QuaterPan, there's a call you can make before the visitor consents that will keep Google from dropping any cookies. So you are supposed to do that first, ask for consent and if the visitor agrees then drop cookies. But as you point out, if a visitor later rescinds consent, you can't remove the cookies. Google needs to do that. So I'm back to a point I made earlier. Google is really dropping the ball on this and letting us all down. It's them setting the cookies, it's their cookies and it's them that's using any PII. They should be giving us a little bit of javascript to insert on our sites to ask for and manage consent just like they give us a little bit of javascript to display ads and set those cookies in the first place.

BoredMeteor, thanks for posting that. I read that all before and let myself be persuaded that simply setting the non-personalized ads for the EU and anonymizing IPs for Analytics is enough. It's not as I originally said. Many people in this thread and others say that simply setting a cookie to note a visitors consent is enough. It's not. We need to maintain a log forever if for no other reason that we get audited.

MayankParmar, there is absolutely no reason for Google to drop it's small publishers. None whatsoever. They don't need an excuse to do that because they don't want to.

So I'm back to where I was days ago. My choices are drop Google, geoblock Europe or do nothing. As I've said, what do I think the EU or Google will do to me. Nothing. I'm 99.999999999999999% sure if I do nothing that nothing will happen to me or the vast majority of small websites. Look at their history. The cookie law has been in place for 2 years and there has been no action against people that don't comply large or small. As far as I know, not a single website from mom and pop to the biggies has even had a complaint lodged against them.

I'll say it again, Google has really dropped the ball on this. They have no excuse. This is their bread and butter business. It's not like they lack resources. They need to roll out a simple bit of code to take care of consent for us. They kind of say they will. Sometime in the future. That's poor timing. At a minimum, Google could easily provide contextual ads with no cookie drops. That's easy. They don't. So I also think that Google doesn't think anything is going to come of all this. Adsense partners are not going to run away, big or small, and that the this reg is more bark and than bite.

So I think I'll drop Google for now. If Google comes up with a complete GDPR solution I'll be back. Analytics I won't miss much since the only thing I looked at was unique users, I can keep track of that myself quite easily. As for Adsense, is there an ad network that doesn't drop cookies?

[Cralamarre]

Google has really dropped the ball on this. They have no excuse.

I think Google is doing what all of us are doing in this situation, which is trying to protect our own interests. Google isn't just going to lie down and lose money because someone told them to. They have the financial resources and the legal power to push back and see what happens. And maybe nothing will happen, in which case lying down and losing money would have been pretty dumb. Personally, I'm glad they're not just rolling over and playing dead. This back and forth until things get ironed out is how it should work.

[steviec79]

As I've said, what do I think the EU or Google will do to me. Nothing. I'm 99.999999999999999% sure if I do nothing that nothing will happen to me or the vast majority of small websites

I tend to agree with this. I remember the cookie law which I think was more than 2 years ago - wasn't there something in 2015? I remember one of my colleagues putting the cookie banner on his site. I started and then didn't bother and took it back off again.

[MayankParmar]

Monthly revenue. They didn't ban YouTube publishers, but blocked ads on small accounts, it's more or less a ban for a certain period of time.

Just tried Cookiebot. It is perfect, and it has consent report feature too it seems.

[fretfull]

Cralamarre, so Google is counting on people ignoring the consent requirement so as not to reduce ads?

Like I said, it will be years to decades before it will be decided in court whether any of GDPR is even legally enforceable. Unfortunately if it is and the hammer does come down, if people don't comply from day one then they have some risk, albeit tiny, since there will be a history of whether they did or not. Much of that history will come from the Google's records of people's Adsense accounts.

No I don't think even in a worst case situation that the EU will go after every website no matter how big or small. There's no point to it. What will happen is that 1 or 2 big players will get their hands slapped as an example to everyone else. Although if anyone's website comes under scrutiny for any reason, GDPR will give the EU a big lever.

[Cralamarre]

@MayankParmar Did you configure Cookiebot to display a simple cookie consent banner, similar to the one from Silktide?

[BoredMeteor]

I'll say it again, Google has really dropped the ball on this.

I don't blame Google at all. The EU has dropped the ball on this nonsensical regulation.

[fretfull]

I agree about the reg. I support it in spirit but it's current implementation is deeply flawed. But the way Google has dealt with it I most definitely do blame.

[fretfull]

MayankParmar, nothing against Cookiebot or any other cookie consent including people writing their own. But with Google Adsense in it's current state, is it even possible to be GDPR compliant? One of the big stipulations about GDPR is that a user has to be able to say "forget me". Unless I missed it, Google doesn't provide us the means to delete the Google cookies. So if a user rescinds consent and says "forget me", how can you do that if you can't delete the Google cookies which are considered PII?

[ember]

Just tried Cookiebot. It is perfect

I think it is a good option, too. It goes a little further than silktide, and I like that you just have to tick a box to show the banner to EU folks only. The banner can be as simple or indepth as you want. I think the fee is worth for now. If this whole thing turns out to be a lot of hype, then go with free cookie banner. No, I do not work for cookiebot.

is it even possible to be GDPR compliant?

Maybe not. I think the thing to do now is at least show them that you are trying to follow the rules. Good faith attempt, and all that.

[MayankParmar]

@Cralamarre Yes, there are different themes in paid version, and we can code and customize it the way we want. Free version is very limited but paid plan is a great option, and Google recommends it.

[MayankParmar]

Very few companies are going to be 100 percent compliant on May 25th - [theverge.com...]

Are you kidding? If we told them how we were using their data, they’d never give it to us in the first place.

[SmallP]

It’s ironic that the only way I (in the UK) can read that article is if I accept all the cookies that website wants to set. There’s a huge banner blocking 2/3 of my mobile screen and the only option I have is “I Accept”.

This is the third website I have visited today doing this.

That’s not GDPR compliant. It’s definitely not in the spirit of GDPR. It isn’t cookie consent. It’s bullying.

I won’t visit websites that do that in future.

[engineerqasim]

Dear Mayank,

What do you recommend provided that I am using non-personlized Adsense ads option for eu users. Cookiebot or Iubenda?

[engineerqasim]

Iubenda shows this message:

"This website or its third-party tools use cookies, which are necessary to its functioning and required to achieve the purposes illustrated in the cookie policy. If you want to know more or withdraw your consent to all or some of the cookies, please refer to the cookie policy.
By closing this banner, scrolling this page, clicking a link or continuing to browse otherwise, you agree to the use of cookies."

So provided that if I am using non-personilized ads for Eu users, does that make it compliant with Adsense GDPR policy? Does that come under explicit consent?