Certified CMP
The tool that shows the message and records the choice in the TCF standard. It must be on Google's list of certified CMPs.
Use case · Consent
Consent set up right, region by region
If you get visitors from Europe, you need a certified CMP to keep personalized ads. If you get visitors from the rest of the world, they should not see the European message. This guide shows how to get both right and how to test.
- ✓Based on Google's Help Centers
- ✓Test inside and outside Europe
- ✓ConsentMode is not a CMP: it only checks
16/01/2024start of the certified CMP requirement in the European Economic Area and the United Kingdom
31/07/2024start of the same requirement for visitors from Switzerland
4Consent Mode v2 signals that Google's tags read
31languages of Google's European regulations message
What is required
In Europe, a certified CMP. Outside it, each place's own rule
Since January 16, 2024, AdSense, Ad Manager and AdMob require a Google-certified CMP integrated with the IAB TCF to show personalized ads in the European Economic Area and the United Kingdom. Since July 31, 2024, the rule also applies to Switzerland.
Without a certified CMP, traffic from these regions can receive only non-personalized or limited ads. In the Policy center this appears as restricted personalization, with limited ads in the EEA, the United Kingdom and Switzerland because of missing consent or a TCF error.
Outside Europe the rules change. In the United States, for example, several state laws ask for an opt-out option, and Google's Privacy & messaging has a message of its own for them. Showing the European message to a visitor from Brazil is not required and gets in the way of browsing.
The pieces
Four pieces that need to work together
Right consent is not just a banner. It is a set that has to work together.
Consent Mode
Tells Google's tags about the choice with four signals: ad_storage, ad_user_data, ad_personalization and analytics_storage.
Regions
Defines where the message appears and where the default is denied. One way for Europe, another for the United States, another for the rest of the world.
Privacy policy
Explains in text what is collected, by whom and how to refuse, according to the law of each region where the site has an audience.
Which CMP to use
Google's own message or another company's CMP
Both options can meet the requirement. What changes is control and maintenance.
Google's Privacy & messaging
The European regulations message in AdSense, Ad Manager and AdMob is certified for the TCF requirement.
- Already lives inside the ads account
- Shows the message in 31 languages depending on the visitor's device
- Has a message for US state laws
- Changing the message in one account affects the other linked accounts
- Fewer options for look and flow
Another company's CMP
An independent consent tool, which must be on Google's list of certified CMPs.
- More control over look and texts
- Can cover tools other than Google's
- Google does not check whether the CMP meets the whole TCF or the laws
- Wrong region setup is common
How to do it
5 steps to set up and test
- Choose a certified CMPCheck the name against the list of certified CMPs in the AdSense Help Center. Google's CMP appears as Google LLC CMP.
- Show the message only where it is neededSet up the regions: a TCF message for the EEA, the United Kingdom and Switzerland, an opt-out message where the law asks for it, and nothing where there is no requirement.
- Set the default before the tagsThe Consent Mode default command must run before Google's tags. Denied where the law requires prior consent, granted elsewhere, if local law allows.
- Update the privacy policyName the ad partners, the cookies and the way to change the choice, with the content each law requires.
- Test inside and outside EuropeOpen the site as a European visitor and as a visitor from Brazil. In Google's message, a test parameter forces the display regardless of region.
https://seusite.com/?fc=alwaysshow&fctype=gdprCommon errors
Six mistakes that cost you ads
Each one shows up often on sites with international traffic.
European message for the whole world
Visitors from Brazil or the US see the TCF banner for no reason, and some refuse or leave the page.
Everything denied worldwide
A denied default with no region drops measurement and personalized ads in countries where it is not required.
Default after the tags
If the ad code loads before the Consent Mode default, the tag reads the wrong state.
CMP not on the list
A CMP that is not on the certified list leaves European traffic without personalized ads.
Two CMPs on the same site
An old plugin and Google's message at the same time produce two banners and conflicting signals.
Generic privacy policy
A copied template that does not mention ads or how to refuse does not explain what each region's law asks for.
In practice
What to do and what to avoid in the message
The message must be clear for the people who need it and invisible to the people who do not.
Allowed
- Accept and reject buttons with equal prominence
- A link to change the choice later, in the footer
- Message in the visitor's language
- Test in a private tab after every change
Not allowed
- Hiding the reject option behind several clicks
- Loading ads before the CMP responds
- Copying the CMP code in two places in the theme
- Leaving the test message published for everyone
In ConsentMode
What the audit checks on consent
- Whether the TCF message appears outside Europe, where it is not required
- The Consent Mode regions and whether the v2 signals are present
- Whether the privacy policy has the content each region's law asks for
- Duplicate tags and ad code loading before consent
- Everything read as a visitor, without clicking ads or changing anything on the site
Frequently asked questions
My site is Brazilian. Do I need a certified CMP?
If the site gets visits from the EEA, the United Kingdom or Switzerland and you want personalized ads for them, yes. For your Brazilian audience, Google's requirement does not apply, but the LGPD still does.
Does Google check whether my CMP complies with the law?
No. Google says it does not check whether CMPs comply with the whole TCF or with privacy laws. The certification focuses on the TCF criteria.
Does ConsentMode show the cookie banner?
No. ConsentMode is not a CMP. It reads the site and shows whether the consent setup is right and what to fix.
Do I need to use Consent Mode if I only have AdSense?
The requirement for personalized ads in Europe is a certified CMP with the TCF. Consent Mode completes the setup when the site also uses Analytics or Google Ads.
Library
Official sources
This guide was written from these official pages. Read them directly at the source:
- Google's certified CMP requirementsupport.google.com/adsense/answer/13554116
- European regulations messages in AdSensesupport.google.com/adsense/answer/10924669
- About Privacy & messaging in Ad Managersupport.google.com/admanager/answer/10075997
- About consent modesupport.google.com/google-ads/answer/10000067
- Serving status in the Policy centersupport.google.com/adsense/answer/15689616
See what visitors from each region encounter
The audit checks the message, the regions, the signals and the privacy policy, without changing anything.