Open workspace

Guide · Amazon Ads

Amazon Consent Signal, no mystery

To receive personal data from visitors in the EEA and the United Kingdom, Amazon Ads requires a valid consent signal. It can come through the TCF, through the GPP or through the Amazon Consent Signal itself. Here is what each path requires and how to avoid mistakes.

Check the Amazon signal on my siteRead the guide
  • ✓Based on Amazon Ads' official policies
  • ✓Explains the TCF, GPP and ACS side by side
  • ✓Read-only scan, no changes to the site
3types of signal accepted by Amazon Ads: TCF, GPP and Amazon Consent Signal
2parameters of the Amazon Consent Signal: amzn_user_data and amzn_ad_storage
2regions named in the requirement: European Economic Area and United Kingdom
1signal is enough; if several arrive, Amazon uses the TC string

What it is

Amazon's way of receiving the visitor's choice

The Amazon Consent Signal, or ACS, is Amazon Ads' own format for advertisers and other companies to report their customers' privacy choices. It tells Amazon whether the person accepted the use of personal data and the use of ad cookies.

The rule applies when the site or partner sends Amazon Ads personal data coming from the European Economic Area or the United Kingdom. In these cases, Amazon requires a valid consent signal along with the data.

The ACS is not the only option. Amazon also accepts the TC string from the IAB Europe TCF and the GPP from IAB Tech Lab. One signal is enough. If several arrive, Amazon gives preference to the TC string.

In practice, anyone who already has a well-configured TCF CMP is usually covered. The ACS is useful when the site does not use the TCF or when the data is sent by tools that do not carry the TC string.

Checklist

What you need to meet

If the site sends visitor data from the EEA or the UK to Amazon Ads, these points need to be working.

  1. Send a valid consent signal

    When personal data from the EEA or the UK goes to Amazon Ads, a valid signal must go with it. The TCF TC string, GPP or the Amazon Consent Signal all work.

    amzn_user_data:  GRANTED | DENIED
amzn_ad_storage: GRANTED | DENIED

  2. Clear opt-in from the visitor

    Amazon requires a clear opt-in before it processes the visitor's personal data.

    Example

    An Accept button on the banner, with Amazon in the partner list.

  3. CMP certified by Google for ads

    For Google personalized ads, the EEA and the UK have required a TCF-certified CMP since January 16, 2024. Switzerland has required it since July 31, 2024.

    Example

    Amazon Ads is a registered TCF vendor, so the certified banner can include Amazon among its partners.

  4. Let visitors withdraw consent

    Visitors must be able to withdraw their consent later.

    Example

    A fixed Privacy preferences link in the footer that reopens the banner.

  5. Clear privacy policy

    Publish a clear, short and transparent privacy policy on every site where data is collected.

    Example

    We use Amazon Ads for ads. It may read and write ad cookies on your device if you accept.

  6. Do not send prohibited data

    Do not send Amazon names or other data that identifies a person, sensitive data, or data from sites aimed at children under 13.

  7. Keep records

    Keep a record of acceptances, refusals and withdrawals. Give these records to Amazon as soon as possible if it asks for them.

  8. Hold third parties to the rules and report problems

    Third parties that collect data for you must agree to the same rules by contract. If you find data collected outside the policy, stop right away and tell Amazon in writing.

In practice

Right and wrong

Official tools

Certified CMPs and official links

Amazon accepts the TCF signal, so a CMP registered with IAB Europe and certified by Google can cover both.

The paths

Three ways to send consent to Amazon

Choose one. Amazon only needs one valid signal per transmission.

IAB Europe TCF

The TC string generated by the CMP. Amazon Ads is a registered TCF vendor and reads the visitor's choices through this standard.

IAB Tech Lab GPP

The privacy signals envelope that can carry the visitor's choice to several partners at once.

Amazon Consent Signal

Amazon's own format, with two simple granted-or-denied parameters.

TC string priority

If the site sends more than one signal, Amazon uses the TC string. That is why it needs to be correct.

Definitions

The terms that appear in Amazon's policy

The official policy is short, but it uses a few terms that are worth understanding well.

amzn_user_data

Says whether the person accepted Amazon processing their personal data, such as ad identifiers, for advertising.

amzn_ad_storage

Says whether the person accepted Amazon reading or storing ad cookies or similar technologies on the device.

GRANTED and DENIED

The two possible values of each parameter: granted or denied.

Country code

It is through the country code sent along with the data that Amazon identifies whether the transmission comes from the EEA or the United Kingdom.

Personal data

Any information linked to a person, including ad identifiers and cookies. Sending this kind of data is what requires the signal.

Third parties

Sites, apps or companies that collect data on your behalf. Amazon requires them to accept the same rules by contract.

Who it applies to

Who needs the signal and where it does not apply

The requirement applies to any company that transmits personal data to Amazon Ads or makes it available to Amazon. This includes advertisers who use the Amazon tag on the site, companies that send conversions from the server and partners who operate on their behalf.

For publishers, Amazon is also an ad buyer. European sites that sell inventory to Amazon through the TCF need Amazon to be in the CMP's vendor list so the visitor's choice reaches it.

The policy speaks of data from the European Economic Area and the United Kingdom. Switzerland does not appear in the current text. For visitors from Brazil and other countries, local laws such as the LGPD, and Amazon's other rules, apply.

If your site sends no data to Amazon, for example because it does not use an Amazon tag, pixel or demand, this rule does not apply to you.

Consent and rights

What Amazon expects from consent

Amazon asks for affirmative consent, that is, a clear action by the visitor to accept. Silence, a pre-ticked box or simply continuing to browse do not count.

The visitor also needs an easy way to withdraw consent later. A permanent link to privacy preferences in the footer covers this on most sites.

The site must keep a record of the choices, both acceptances and refusals, and hand those records to Amazon if it asks. Reputable CMPs keep this history automatically.

The site's privacy policy must clearly explain the use of cookies and the data processing done by Amazon. A generic text that does not mention Amazon does not meet the requirement.

Site obligations

What to do to comply with Amazon's policy

  1. Choose the signal pathIf the CMP already uses the TCF, add Amazon to the vendor list. If it does not, set up the GPP or the ACS in the CMP or in the tool that sends the data.
  2. Update the privacy policyExplain the cookies used and the data processing done by Amazon Ads, with how to withdraw consent.
  3. Ask for real consentUse affirmative acceptance before loading the Amazon tag for visitors in the EEA and the United Kingdom.
  4. Do not send prohibited dataThe policy prohibits sending Amazon information that directly identifies the person, children's data and sensitive personal data.
  5. Keep the recordsKeep the history of acceptances and refusals and hand it to Amazon if asked.
  6. Hold partners to itIf third parties collect data on your behalf, they must accept the same rules by contract.
The two Amazon Consent Signal parameters and their values
amzn_user_data:  GRANTED | DENIED
amzn_ad_storage: GRANTED | DENIED

TCF or ACS

Which signal to use on your site

Both are accepted. The choice depends on what the site already has and which partners need the signal.

IAB Europe TCF

The same TC string that Google, Microsoft and hundreds of partners already read. It is the natural path for sites with a certified CMP.

  • A single banner serves all partners
  • Takes priority when there is more than one signal
  • Required by Google in the EEA, United Kingdom and Switzerland
  • Amazon must be on the vendor list
  • Errors in the TC string affect all partners at once

Amazon Consent Signal

Amazon's own format, with two simple parameters. Useful when the TCF is not available at the point where the data is sent.

  • Easy to understand and to map from the banner
  • Works in tools that do not carry the TC string
  • Serves only Amazon
  • Must be maintained in parallel with the signal sent to other partners

Enforcement and AdSense

Who enforces it and how that fits with Google

The first enforcement is contractual. If the company finds that it collected, stored, used or passed on data in breach of the policy, it must stop the processing and sharing immediately and notify Amazon in writing as soon as possible.

The second is legal. Sending personal data of European visitors without a valid basis can be targeted by GDPR data protection authorities, like any other data processing.

For people who monetize with AdSense or Ad Manager, Amazon is one more partner on the same page. The TCF-certified CMP that Google requires can serve Amazon too, as long as Amazon is included among the vendors.

Google's Consent Mode does not talk to Amazon. If the site uses an Amazon tag, it must receive its own signal, whether through the TC string, the GPP or the ACS.

Common errors

What makes the Amazon signal fail

Almost always the banner looks right, but the signal does not arrive the way Amazon expects.

Amazon missing from the CMP list

The CMP uses the TCF, but Amazon is not among the vendors. The TC string never gives it permission.

Tag before consent

The Amazon tag loads and stores cookies before the European visitor clicks the banner.

Contradictory signals

The ACS says granted and the TC string says denied. Amazon uses the TC string, and the site thinks everything is cleared.

Server-side sending with no signal

Conversions leave the server without the consent attached. The browser tag is right, but the parallel sending is not.

Generic privacy policy

The text does not mention Amazon or explain the use of ad cookies.

Partners without a contract

An agency or tool sends data on the site's behalf without having accepted Amazon's rules.

In practice

What is and is not allowed with Amazon Ads

Practical examples for sites and stores with European visitors.

Allowed

  • Use only the TC string, if Amazon is on the CMP list
  • Use the ACS when the TCF is not available
  • Send a single signal per transmission
  • Load the Amazon tag only after acceptance in the EEA and the United Kingdom
  • Keep a permanent link so visitors can change their choice

Not allowed

  • Send European visitors' data with no signal at all
  • Leave acceptance boxes pre-ticked
  • Send sensitive data or children's data to Amazon
  • Send different signals in the browser and on the server
  • Let third parties send data without a contract with the same rules

In ConsentMode

What the audit checks about Amazon

  • Detects Amazon tags and calls on the page and opens the site as a European visitor and as one from outside.
  • Identifies the CMP and checks whether Amazon appears among the TCF vendors.
  • Checks whether Amazon cookies and calls happen before or after the click on the banner.
  • Looks for the ACS parameters and the TC string in the code and flags whether they contradict each other.
  • Checks whether the privacy policy mentions Amazon and delivers screenshots with the fix path.
Run an auditSee everything that is checked

Frequently asked questions

If I already have the TCF, do I need the Amazon Consent Signal?

Generally, no. Amazon accepts the TC string and gives it preference. Just confirm that Amazon is among your CMP's vendors.

My site is Brazilian. Do I need this?

Only if you send Amazon Ads data from visitors in the EEA or the United Kingdom. For your Brazilian audience, the LGPD and Amazon's other rules apply.

Does Google's Consent Mode work for Amazon?

No. It only talks to Google's tags. Amazon needs its own signal, through the TC string, the GPP or the ACS.

Does Switzerland fall under the rule?

The current policy text names the EEA and the United Kingdom. If you have a lot of Swiss traffic, treat consent there with the same care and check with your legal team.

What happens if I get it wrong?

The policy says to stop processing and sharing the irregular data and notify Amazon in writing. In addition, the case may interest data protection authorities.

How do I check what my site sends?

Open the site in a private tab as a European visitor and watch in the browser when the Amazon tag fires. Or run a ConsentMode audit, which does this with screenshots.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

Find out whether Amazon is receiving the right consent

The audit opens the site as a European visitor and shows what to fix, without changing anything.

Start the audit