{"id":233,"date":"2026-07-06T14:45:04","date_gmt":"2026-07-06T12:45:04","guid":{"rendered":"https:\/\/www.lukaswojcik.com\/blog\/?p=233"},"modified":"2026-10-24T01:39:03","modified_gmt":"2026-10-23T23:39:03","slug":"ads_data_redaction-in-consent-mode-v2-mechanism-legal-framework","status":"publish","type":"post","link":"https:\/\/www.lukaswojcik.com\/blog\/en\/data-privacy\/ads_data_redaction-in-consent-mode-v2-mechanism-legal-framework\/","title":{"rendered":"ads_data_redaction in Consent Mode v2: Mechanism, Legal Framework and Configuration"},"content":{"rendered":"

ads_data_redaction<\/code> limits certain advertising identifiers in Google requests when ad_storage<\/code> is denied<\/code>. It is an additional technical control within consent mode. It does not block an entire measurement pipeline or replace inspection of the data actually sent.<\/p>\n

1. Scope and limits<\/h2>\n

Google describes redacting click identifiers, such as GCLID and DCLID, from Google Ads and Floodlight tag requests. This requires consent mode, ads_data_redaction: true<\/code> and ad_storage: denied<\/code>. With ad_storage: granted<\/code>, the additional setting has no corresponding effect.<\/p>\n

The documentation also describes requests through a domain without the relevant third-party cookies. The destination hostname alone does not establish that identifiers were redacted. The actual requests and their contents are the evidence.<\/p>\n

Reduction is not complete anonymization.<\/strong> Other fields or other tags can still transmit data. This setting does not disable Meta or other third-party tags. Server logs and redirects are outside its control as well.<\/p>\n

\"Certain
Certain advertising identifiers are redacted only when the required conditions apply. Consent handling, URL passthrough and verification remain separate tasks.<\/figcaption><\/figure>\n

2. Distinguish basic and advanced mode<\/h2>\n

In basic consent mode, the relevant Google tags remain blocked until appropriate permission. In advanced mode, requests without the relevant cookies can occur while storage is denied. \u201cDenied means no transmission\u201d is therefore incorrect. A default denied<\/code> state also does not necessarily represent a completed banner decision.<\/p>\n

The additional ad_user_data<\/code> and ad_personalization<\/code> signals must reflect the actual choice. ads_data_redaction<\/code> replaces neither. Google product requirements also do not create a statutory obligation to use a particular technical mode.<\/p>\n

3. Direct gtag.js configuration<\/h2>\n

The example sets only initial states and the redaction option. The CMP must subsequently communicate the actual choice and later changes. The fragment illustrates initialization only; it is not a complete CMP integration.<\/p>\n

window.dataLayer = window.dataLayer || [];\nfunction gtag() { window.dataLayer.push(arguments); }\ngtag('consent', 'default', {\n  ad_storage: 'denied',\n  analytics_storage: 'denied',\n  ad_user_data: 'denied',\n  ad_personalization: 'denied'\n});\ngtag('set', 'ads_data_redaction', true);\n\/\/ Configure measurement only after these initial settings.\n\/\/ The CMP must provide the actual consent updates.\n<\/code><\/pre>\n
Both settings must precede commands that trigger measurement, especially config<\/code> and event<\/code>. There is no universal requirement to place ads_data_redaction<\/code> before default<\/code>. Neither ordering can protect against tags that already fired earlier. Other scripts and the loading sequence need inspection too.<\/p>\n
4. Google Tag Manager configuration<\/h2>\n
Check an existing CMP integration first. Independent default or update implementations can produce conflicting states. Custom GTM templates should use setDefaultConsentState<\/code> and updateConsentState<\/code>; gtagSet<\/code> sets additional options.<\/p>\n
    \n
  1. Select the consent integration intended for the CMP and map states to the actual choices.<\/li>\n
  2. Run defaults on Consent Initialization \u2013 All Pages<\/em>. This orders GTM tags early; it does not control scripts started outside the container.<\/li>\n
  3. Enable ads_data_redaction<\/code> as boolean true<\/code> where the integration exposes that option.<\/li>\n
  4. Check updates after selection, withdrawal and subsequent page loads.<\/li>\n<\/ol>\n
    One community option by Simo Ahava is named Consent Mode (Google + Microsoft tags)<\/em> in the inspected source. Its field is Redact Ads Data (ads_data_redaction)<\/em>. The template is an option, not a mandatory or proven universally best solution. An installed version and its settings may differ from the current repository.<\/p>\n
    5. Legal framework and verification<\/h2>\n
    GDPR Article 5(1)(c) limits personal-data processing to what the purpose requires; it does not automatically authorize remaining requests. Article 5(3) of the ePrivacy Directive concerns terminal storage and access, with narrow exceptions for transmission and explicitly requested services. Techniques without traditional cookies can fall within its scope. National implementation and the actual processing remain relevant.<\/p>\n
    This switch guarantees neither lawfulness nor the absence of all identifying data. Technical checks should cover the initial state, refusal, permission and withdrawal. Inspect states in Tag Assistant and identifiers and URLs in network requests. Any GCLID, DCLID or other click parameters in use need their own test cases. A successful configuration call does not prove redaction.<\/p>\n
    \n
    Questions and answers<\/h2>\n
    What does url_passthrough do?<\/h3>\n
    It can pass measurement information through links within the same domain. That is a different data path from redacting identifiers in certain advertising requests. It does not establish that Google receives nothing while the website safely retains everything. Redirects, destinations, logs and subsequently fired tags need consideration.<\/p>\n
    Is this GA4 web-stream data redaction?<\/h3>\n
    No. GA4 web-stream redaction handles detected email addresses and configured URL parameters. It is a separate feature with its own limits, including Measurement Protocol. Check the two controls separately.<\/p>\n<\/div>\n
    Sources<\/h2>\n