What does EU GDPR means for Adsense?

Question about GDPR and Adsense.

[hwint]

Question: What does EU GDPR means for Adsense?

Most of the Adsense income is from interest based ads. Will this be affected by the EU GDPR?
I'm concerned because today with the latest update for my Android Phone, I got asked for permission related to interest based ads. (Maybe it is because I did disable it before. This is to see the normal ads on my pages with Adsense. But I'm still concerned.)

[bgweb]

@bhukkel that's interesting. However it's not clear to me how the display personalised ads option will work in practise. Do you have to:

1) do a server side check to see whether a cookie has been set by the user which authorises personalised ads
2) if yes then inject the javascript into the ad tag/s to enable personalised ads

[CommandDork]

Hehe - Googs is like a six-year-old - very good at avoiding any sort of blame (in their case by way of carefully chosen keywords in the fine print)...

"Implementing a consent mechanism like this for your eu visitors CAN help you meet the requirements of Google’s own policies. It SHOULD also help towards your compliance with European cookie and data protection laws."

But no guarantees apparently.

[dolcevita]

Just try to see choices from Google and options ut I do not see still anywhere option or link to " EU user consent." within my 'Click Allow & block ads and then All my sites'

[support.google.com...]

Get started
Sign in to your AdSense account.
Click Allow & block ads and then All my sites and then EU user consent.
The “EU user consent” page appears. Update the settings for the sections on this page as described below.

[CommandDork]

@dolcevita

At the top of the page you linked...

"The functionality described in this article is not yet available, and this article is subject to change."

It hasn't been implemented yet.

[Travis]

One difference with the previous cookie consent "thing". Is that, before, it concerned only EU sites with EU visitors. Whereas non EU sites, didn't have to show the consent banner to EU visitors.

Now, with the GDPR, ALL sites have to show the cookie consent / information banner to EU visitors.

[dollarsound]

Although these ads don’t use cookies for ad personalisation, they do use cookies to allow for frequency capping, aggregated ad reporting, and to combat fraud and abuse. Consent is therefore required to use cookies for those purposes from users in countries to which the ePrivacy Directive’s cookie provisions apply.

So, we'll still need to get the cookie consent banner :/

So, we will need to get explicit consent to store a cookie or the "if you continue browsing...you accept" method is enough?

[bhukkel]

So, we will need to get explicit consent to store a cookie or the "if you continue browsing...you accept" method is enough?

There are two examples here [cookiechoices.org...]

- one for personalized ads with yes/no button for consent
- one for non-personalized ads with only agree button

[LuckyLiz]

I fully intend to block all EU countries.

You probably should get input from a legal expert on the GDPR before doing that. I believe blocking the EU by IP number is forbidden under the law. Even if it's not forbidden, people from the EU might access your site from a proxy or from some IP that's not in the EU.

[bgweb]

So, we will need to get explicit consent to store a cookie or the "if you continue browsing...you accept" method is enough?

I'm not an expert but legitimate interest may cover that use case and mean implicit consent remains adequate.

[ember]

It looks like you should link to their privacy page [google.com ], because "Doing so will meet the requirement of our EU User Consent Policy [google.com ] to give your users information about Google’s uses of their personal data." Then disable personalized ads for EU users under Allow/Block ads in your account, although you still have to gain consent from them. But it looks like Google will provide a tool for that [support.google.com ] but it is not set up yet.

[Travis]

There are two examples here [cookiechoices.org...]

- one for personalized ads with yes/no button for consent
- one for non-personalized ads with only agree button

In fact, I am not sure. I thought at first too, but the two banners, seem to be for the explicit consent for interested based ads. The first banner shows, then if you click "no", you are shown the second banner.

I "guess" that, if you choose the option at Adsense to disable interested based ads for EU visitors, you are not required to obtain the explicit consent from the visitor. Because the cookie that Adsense drops, is not for tracking, and is not recording/storing personal data. In that case, a banner informing the visitors of the use of cookies, with a link to your privacy policy should be enough. But I would suggest offering the possibility to visitors to refuse too. In that case, refresh the page, and do not display Adsense ads. (display something else).

[nubchai]

@Azlinda how do you block EU visitors. I know Wordfence Premium has that option, but is there a way to do it through Adsense? Thanks!

[Travis]

is there a way to do it through Adsense?

No.

To block visitors based on their IP, it means that you are forbidding the access to your site. So it has nothing to do with adsense. To to so, you need to use some of the geo ip tools which exists. This can be configured at your level of our server software (apache, nginx, etc...), or at the level of your scripting language, (php for example). Or , may be cloudflare has some kind of options, I don't know.

[nubchai]

@Travis Thanks for the information.

[steviec79]

Perhaps one method is to give people a yes/no option for them to continue looking at your site.

If they don't accept/click yes, they go to a page on your website saying they have to accept first, before seeing any other page.

This is one option for people who don't get any benefit, from people seeing your site with ads turned off.

[bgweb]

I'm UK based so obviously won't be blocking EU users! However if I was based in the US (or elsewhere outside the EU) I'm not sure I would go down that route. It sounds fraught with potential issues such as SEO impact and the risk that not all EU visitors would be blocked.

[steviec79]

Not getting why people would block EU visitors anyway - surely giving people an accept - yes or no option is better than blocking them. Even if only 50% accept, then that's better than 0%.

[ember]

Anyone know how to show the cookie banner to just EU visitors?

[Travis]

Anyone know how to show the cookie banner to just EU visitors?

It depend your skill. You can use the PHP Geoip extension from Maxmind. If you are using wordpress, I guess there are plugins doing this, etc... Or you can also check sites like : [cookieconsent.insites.com...]

[ember]

Thanks, Travis. What happens if they see the cookie banner but ignore it? They do not choose Yes or No but just go on through the site being tracked all the way without ever giving consent. Wouldn't that count as us having legally done our part?

[vegasrick]

@ember, the way I read it, the banner has to keep popping up at the end of the day until a choice is made.

You dont need a Yes or No answer. You can have Yes, Ok, I agree, etc. and then have "no" or "change settings", etc.

Again, most website will ignore all of this, especially outside the EU, and most inside the EU will have different compliance methods all over the place.

[ember]

I agree about the ignoring, especially when Google is saying that they are asking (not requiring) that we seek (not obtain) consent for ad products on our sites and that they are providing a range of optional (not required) tools for gathering consent. If they were loudly threatening to disable adsense on sites that do not comply, then Google's adsense revenue would plummet since most webmasters would have no clue what to do. Instead, they are encouraging us to comply. If we don't, then it is up to the EU, not Google, to come after us. For U.S. sites, the chances of that are slim to none.

[Travis]

For U.S. sites, the chances of that are slim to none.

We'll see...

[steviec79]

So what's wrong with this sort of cookie message?

[cookieconsent.insites.com ]

[steviec79]

In fact, I am not sure. I thought at first too, but the two banners, seem to be for the explicit consent for interested based ads. The first banner shows, then if you click "no", you are shown the second banner.

I "guess" that, if you choose the option at Adsense to disable interested based ads for EU visitors, you are not required to obtain the explicit consent from the visitor. Because the cookie that Adsense drops, is not for tracking, and is not recording/storing personal data. In that case, a banner informing the visitors of the use of cookies, with a link to your privacy policy should be enough. But I would suggest offering the possibility to visitors to refuse too. In that case, refresh the page, and do not display Adsense ads. (display something else).

So you mean it's one of these choices:

1) Disable interest-based ads for EU visitors inside Adsense console (presumably that means Google will be doing the IP tracking) and you don't need to bother with any cookie popup message when people enter your site, or
2) Do not disable interest-based ads, but if you don't do it, you need some sort of cookie consent popup message to EU visitors. Meaning it's the website owner who will need to sort out the IP tracking, to see where the visitor is coming from

Have I got that right?

[Travis]

"my" understanding (I can be wrong)

1- if you DISABLE interest-based ads for EU visitor => show a banner informing the User that third parts are using non tracking cookies. ( I would add an option to agree or not, and if the user choose "not" , to stop displaying adsense to this user)

2- if you KEEP Interest-based ads for EU visitor => you must obtain the explicit consent BEFORE loading the ads.

[Travis]

In Adsense is there a way of seeing the percentage of revenue that is currently generated from "targeted ads"?

in the reports you have this, and you can also customize the report to show this information per country.

[Travis]

Things would be so much simpler if all this was done at the level of the browser. This could have been easy to force, by the law/regulation, sites to obey the "do not track" header field. If a site receives it, then they disable the interest based ads, and tracking things.

[steviec79]

"my" understanding (I can be wrong)

1- if you DISABLE interest-based ads for EU visitor => show a banner informing the User that third parts are using non tracking cookies. ( I would add an option to agree or not, and if the user choose "not" , to stop displaying adsense to this user)

Hmmm. A non-tracking cookie, isn't really being used for anything then. Google uses a cookie to display interest-based ads. If they aren't showing interested-based ads, then why do they need to use any cookie? Therefore, wouldn't that mean nothing needs to be shown?

[Travis]

If they aren't showing interested-based ads, then why do they need to use any cookie?

This is Google saying it:

"Although these ads don’t use cookies for ad personalisation, they do use cookies to allow for frequency capping, aggregated ad reporting, and to combat fraud and abuse. Consent is therefore required to use cookies for those purposes from users in countries to which the ePrivacy Directive’s cookie provisions apply. "

So "my understanding" is that this kind of cookie does not require an "explicit" consent. (note that Google use the word "consent" here and there, for not taking risks). But, it should still require a clear information of the user, which would mean a banner clearly visible, and offering the possibility to refuse/disable.