Help with the EU user consent policy

Why does this policy exist and where does it apply?

This help page is for ParkingHawker visitors and for anyone reviewing how this site uses Google advertising and measurement. The rules come from two European privacy laws — the General Data Protection Regulation (GDPR) and the ePrivacy Directive — and from matching UK law. They apply to people located in the EEA, the UK and Switzerland. The EEA is the EU Member States plus Iceland, Liechtenstein and Norway.

Google first issued its EU User Consent Policy in 2015. It was updated on 25 May 2018 when the GDPR took effect, and last expanded on 31 July 2024 so that users in Switzerland are covered as well. ParkingHawker follows that policy because this site uses Google AdSense and Google Analytics.

Do I need to follow this policy for all users if I’m an EEA, UK or Swiss-based publisher or advertiser?

No. Google’s EU User Consent Policy is about the location of the end user, not the location of the company. It applies to people in the EEA, the UK or Switzerland. ParkingHawker is not treated as “in scope for every visitor worldwide” just because a visitor or a publisher is based in Europe.

How will Google ensure compliance with this policy?

Google reviews websites and apps that use its advertising services. Reviewers open a site the way a visitor would and check the notice, the choices offered and the consent that was collected. That review process has been in place since 2015.

Google’s usual first step is to contact the partner and work through a fix. Sites and apps are given a reasonable time to change the banner or the tags. If the partner does not engage or does not make a good-faith effort, Google may switch off audience tools such as ad personalization (including remarketing) and conversion measurement for advertisers. For publishers, only Limited Ads / programmatic limited ads may remain eligible if that feature is turned on.

Publishers that serve ads to users in the EEA, the UK and Switzerland are also expected to use a Google-certified Consent Management Platform (CMP). Google can still audit a site after a certified CMP is installed.

Advertisers with EEA traffic who measure behaviour with Google tags or SDKs, or who use audience / ad-personalization features, must pass the visitor’s consent choice to Google (Consent Mode or the IAB Transparency and Consent Framework). If the Google tag is loaded without the current Consent Mode, Google recommends a CMP from its CMP Partner Program. That list is not every CMP in the market, and advertisers are not required to pick one from the program.

What disclosures to end users do I need to make?

Each party that receives a visitor’s personal data because a Google product is used must be identified. Information about that use has to be easy to find. Google publishes how it uses information; publishers and advertisers must link to that explanation. Other ad-technology providers that sit inside Google’s products are asked to publish their own use of personal data as well.

On ParkingHawker that link is: How Google uses information. Our own notice is the Privacy Policy. App developers should ask users to install the latest app build so disclosures stay current.

Checklist for partners to avoid common mistakes when implementing a consent mechanism

These checks are examples, not a complete legal list. The live banner still has to meet Google’s full policy.

1. Consent mechanism / banner implemented. Is a consent banner in place? For publishers, is that banner from a Google-certified CMP? Does it appear for visitors from every EEA country, plus the UK and Switzerland?
2. Personal data use disclosure. Does the first layer of the banner say that personal data may be used for ads personalization, and that cookies or mobile ad identifiers may be used for personalized and non-personalized advertising?
3. User affirmative action. Can the visitor actively agree — for example by tapping OK or I agree? Silence is not consent.
4. Data sharing disclosure. Are Google and other third parties who receive the data named?
5. Link to Google’s Business Data Responsibility site. Is there a link to how Google uses personal data — on the banner itself, under More info, or visibly on the first screen of the privacy policy?
6. Consent signal set up correctly. For advertisers with EEA users, is a validated consent signal sent to Google (current Consent Mode or TCF)?
7. Consent for setting cookies. Are cookies that need consent withheld until the visitor agrees? Non-personalized ads on websites still use cookies to work.
8. Consent management platform set up correctly. Have publishers adopted a Google-certified CMP that follows TCF? If Additional Consent is used, is that integration correct?

Google publishes separate troubleshooters for advertiser audits and publisher audits on its own help centre.

What are Limited Ads?

When a publisher monetizes only with Limited Ads, Google turns off the collection, sharing and use of personal data for ad personalization. Features that need a local identifier — such as frequency capping — are also off. If programmatic Limited Ads are enabled, only invalid-traffic / fraud-defence cookies and local storage may still be used. Ad-serving JavaScript or SDK code can still be cached by the browser or the device. Local law still decides what notice and consent are required. Google’s Ad Manager, AdMob and AdSense help centres describe the feature in more detail.

What instructions do I give to end users for withdrawal of consent?

Visitors must be told how to take consent back. Withdrawing has to be as easy as giving it. At minimum they need a clear path to the site’s or app’s ad / cookie controls so they can change the choice. On ParkingHawker use the cookie or consent control when it is shown, Google’s ad settings, or your browser’s cookie tools. Clearing this site’s data will usually show the banner again on the next visit from an affected region.

What are the other Google products that incorporate this policy?

Besides ads and measurement, the same policy is referenced in the Google Maps Platform Terms of Service, the YouTube API Services Terms of Service, the reCAPTCHA Terms of Service, and in Blogger. If ParkingHawker loads any of those products, the same regional consent rules apply before cookies or identifiers are used where the law requires it.

What types of ads are considered “personalized” for purposes of this policy?

Personalized advertising uses previously collected or historical data to pick or influence the ad. That includes earlier search queries, activity, visits to sites or apps, demographic information or location. Examples are demographic targeting, interest-category targeting, remarketing, Customer Match lists and audience lists uploaded in Google Marketing Platform. Ads that do not use that history are treated as non-personalized or limited.

My consent banner was flagged as non-compliant as part of the audit. What is the best way to resolve this?

Google’s audit team normally sends the details of the failure and the steps needed to bring the site or app back into line. Advertisers should work with their CMP (if they have one), check Consent Mode or TCF integration, and use Google’s advertiser troubleshooter. Publishers should work with their Google-certified CMP and use Google’s publisher troubleshooter. ParkingHawker will use those same steps if Google flags this site.

Why does the policy require consent for cookies, even if used for purposes other than personalization, such as ads measurement?

Cookies and mobile identifiers also support non-personalized ads, frequency capping and aggregated ad reporting. Where local law requires consent for that storage, Google’s policy requires it as well — even when the ad itself is not personalized.

What if I’m an advertiser using Google’s products on my website/app?

If you place Google Ads or Google Marketing Platform tags on a site or app, you must obtain consent from EEA, UK and Swiss users. That covers cookies, mobile identifiers or other local storage where the law requires consent, and the use of personal data for personalized ads — including remarketing tags.

What should I say in my consent mechanism/banner?

Use the checklist above. Google does not dictate one fixed sentence. The notice has to match the data uses on that site — ParkingHawker’s own features plus Google ads, analytics and any other partners named in the banner or the Privacy Policy.

Does Google require a particular form of consent message for apps?

For publishers, yes: a Google-certified CMP is required when personalized ads are served to users in the EEA, the UK and Switzerland. For advertiser partners with EEA traffic, the requirement is to send signals that match the user’s choice (Consent Mode or TCF). The CMP Partner Program exists to help advertisers build those banners. It is not a complete list of CMPs, and advertisers are not forced to use a program CMP.

How should partners choose which Consent Management Platform (CMP) provider to adopt?

Advertisers can use the Google CMP Partner Program for Consent Mode or TCF support, or another CMP that can send a valid signal. Installing any of those tools does not automatically mean the site complies — the message and the buttons still have to be right.

Publishers that serve personalized ads to users in the EEA, the UK and Switzerland must adopt a Google-certified CMP that is integrated with IAB Europe’s Transparency and Consent Framework (TCF).

What other parties collect end users’ personal data, and how should I identify these third parties?

Many advertisers and publishers use extra vendors to serve ads and measure campaigns. The policy requires each party — not only Google — that may collect, receive or use personal data because of those Google products to be clearly identified. ParkingHawker names advertising and analytics partners in the consent notice and the Privacy Policy.

My website/app is not based in Europe. Does this policy apply to me?

Yes, if you use Google products that incorporate the policy. It still only applies to end users located in the EEA, the UK and Switzerland. ParkingHawker’s company location does not remove the duty for those visitors.

As a publisher, none of my campaigns are targeted to EEA, the UK or Switzerland. Does this consent requirement still apply to me?

Yes, for any visitor who is actually in the EEA, the UK or Switzerland. The requirement drops away only if Google services are removed for users in those countries.

Our organization has a different view of the law, and would like to apply a different approach to disclosure and consent. Can we do that?

Google requires partners who use its European advertising services to meet this policy even if they read the statutes differently. The policy follows GDPR (including as carried into UK law) and guidance from European data-protection authorities. Google says it will keep reviewing the law and industry practice. ParkingHawker follows that policy for Google products on this site.

Why do we need consent to ads measurement?

Google uses cookies and ad identifiers to measure ads. Existing ePrivacy-style laws require consent for those uses in countries where local law says so. The policy therefore asks for consent to ads personalization and, where legally required, consent to ads measurement.

Do I need the consent before the Google Advertiser tags fire or can the consent come afterwards?

Before. Consent for personalized ads, and for cookies or other local storage where legally required, must be collected before Google advertiser tags fire on the page or in the app.

What about using click trackers?

If an ad click sends the browser through a third-party measurement vendor on the way to a landing page, that hop must still follow applicable law. Google’s publisher vendor controls are not built to cover click-tracking technologies.

What records do I need to keep?

A record of consent is required. At minimum that is the text and choices shown in the consent mechanism, plus the date and time of the visitor’s affirmative yes. ParkingHawker and/or the CMP keep that record.

Why has my publisher CMP been deemed as non compliant, I use a Google-certified CMP which has also been certified by the IAB?

A certified CMP is not an automatic pass. Compliance still depends on how the CMP is configured and on the exact message shown to users. Recheck the checklist above.

Why has my website/app been deemed as non compliant, I use a Google Partner CMP?

The advertiser CMP Partner Program helps teams build banners and wire Consent Mode. Using any of those CMPs still does not guarantee compliance. The implementation and the wording matter. Use the checklist and speak to the CMP vendor.

Do I need to follow this policy if I am using products that are using Privacy Sandbox APIs?

Yes. Topics, Protected Audience, Attribution Reporting and similar Privacy Sandbox APIs access local storage. ePrivacy rules do not treat that as optional just because the data may not look like classic personal data. Valid consent is still required in the same way as for ads personalization and other non-essential local storage, to the extent the law requires it. Google publishes more on the Privacy Sandbox on its own site.

For advertisers, is a valid consent signal (via TCF or consent mode) required for users in the UK and Switzerland?

Google does not currently require advertisers to send a verified consent signal for UK or Swiss traffic. The verified-signal requirement applies to advertisers with traffic from end users in the EEA. A Google CMP Partner can still help with implementation. Advertisers are not required to use a program CMP, and the list is not exhaustive.

What types of local storage does the EU user consent policy apply to?

The obligation is not limited to cookies and mobile IDs. It covers other local storage where consent is legally required. In the EEA and the UK that can include using IP addresses or fingerprinting for ads personalization or ads measurement. If those methods are used, the banner should say so. Legal counsel should confirm the local rules. TCF documentation can help if TCF is how consent signals are sent to Google.

Does Google use IP Addresses for ads measurement and ads personalization in the EEA, the UK, and Switzerland?

Google has stated that from August 2026 it will start IP-based ads measurement and personalization in these regions, using IP addresses received through customer tags, SDKs, HTTP calls, uploads or similar means, and that it will register TCF Feature 3 (“Identify devices based on information transmitted automatically”). See Google’s privacy documentation for the live description of how it uses IP addresses.

What transparency obligations apply to this change?

Disclosures must include a prominent link that explains how Google processes end-user data, including IP addresses. ParkingHawker’s link is How Google uses information. Local data-protection advice should be used if the legal team needs more than this summary.

Updates to this policy

Google’s original EU User Consent Policy was updated on 25 May 2018. Minor UK-related edits were made on 31 October 2019. In July 2024 the policy was expanded to include Switzerland. Google has said no further change is planned at the time of that update, but it will keep watching the law and industry practice. ParkingHawker will refresh this page when those requirements change.