Preparing for the Future of Data Privacy: The Issue of Consent

As Australia prepares for stricter data privacy laws, business owners must stay ahead of compliance requirements, and one crucial element is the cookie consent banner.

Many Australian businesses wonder if they need one on their website.

Currently, the Privacy Act 1988 and the 13 Australian Privacy Principles (APPs) don’t require businesses (that only serve Australian customers) to display a consent banner.

However, the landscape is shifting fast, and the new privacy regulations will make this a requirement, so now is the time to get started.

Firstly, what is Consent in Data Privacy?

Consent, in a legal sense, means that someone freely and willingly agrees to participate in an interaction. But first, you need to understand what that interaction is. When it comes to data and technology, it’s a complex interaction. This is why, in order to establish consent, businesses must provide transparent information about what data is being collected, why, and how it will be used. Only then can individuals offer informed consent, which is where the cookie banner comes in.

The new privacy regulations will emphasise this level of transparency. In the same way other forms of consent are documented in legal contexts, businesses must document that website visitors have permission to collect and use their data. The cookie consent banner is the most straightforward device to facilitate this, giving users a visible, easy way to either provide their consent or opt-out.

But if Cookies are Dying Out, Do I Still Need This?

Yes, consent requirements don’t just apply to 3^rd party cookies, they also apply to first-party data when it’s collected on a website. Soon, any data you collect and use must be provided to you with consent.

Remember, first-party data refers to any information that a business collects directly from its users, like site interactions, purchase history, or personal information like an email address provided through a form submission. When first-party data is collected via cookies or any other tracking tools, consent will be required. This is already the case under privacy regulations like Europe’s GDPR and will be the case when the upcoming changes in Australia take effect.

Why Google’s Role in Consent Management is Key

As the dominant player in both browsers and analytics, Google significantly influences data privacy practices. Google Chrome holds a 65% global browser market share, and around 75% of websites use Google’s Analytics tools globally.

Source: statista.com

This means the effects are felt across industries when Google rolls out changes. Google has already introduced tools like “Consent Mode” and guidelines for managing consent.

Plus, they’re partnering with Consent Management Platforms (CMP’s) to try and make it easier for businesses to stay compliant as privacy laws evolve.

Let’s break down how Consent Mode and a Consent Management Platform (CMP) work together and why a CMP is essential for data privacy compliance.

What is Google’s Consent Mode?

Consent Mode is a tool from Google that adjusts how tracking and advertising tags behave based on the consent choices made by users. When a user either accepts or declines cookies on a website, Consent Mode changes how Google tags (like Google Analytics or Google Ads) collect data:

If a user consents to cookies: Consent Mode enables full tracking, allowing all Google tags to function as intended and gather data for analytics and conversion tracking.
If a user declines cookies: Consent Mode restricts Google tags from using cookies to track user behaviour. Instead, it collects only basic information in an anonymised and aggregated form, reducing the detail and precision of the data.

Consent Mode helps businesses stay compliant by ensuring that user preferences for data privacy are respected.

What is a Consent Management Platform (CMP)?

A Consent Management Platform (CMP) is a tool that collects, manages, and records users’ consent choices. When a user first visits your website, the CMP displays a cookie consent banner (or popup) that explains which data is collected and why and allows users to opt in or out.

The CMP then stores the user’s preferences and ensures that their settings are applied each time they visit.

A CMP is crucial because:

It gathers explicit consent from users in a compliant way, displaying clear, standardised options to accept or reject tracking.
It manages ongoing compliance by storing and applying these settings for each user, so their preferences are remembered on future visits.
It integrates with Consent Mode to enforce these preferences at the tag level.

How Consent Mode and a CMP Work Together

Here’s how these two tools work in tandem:

User Interaction with the CMP
When a user arrives on your website, the CMP displays a consent banner. The user chooses whether to accept or reject cookies.
CMP Passes Consent Decisions to Consent Mode
Once the user makes their choice, the CMP communicates this information to Google’s Consent Mode. For example:
- If the user accepts cookies, the CMP tells Consent Mode to allow tracking tags to operate fully.
- If the user declines cookies, the CMP tells Consent Mode to restrict tags, meaning only limited, aggregated data can be collected.
Consent Mode Adjusts Google Tags Based on Preferences
Consent Mode then activates the correct settings for Google tags on the website, making sure they behave according to the user’s choice. If cookies are declined, Google tags operate in a “consent-less” mode, preventing any individual tracking while still gathering anonymous data where possible.

Why a CMP is Important

A CMP is essential because it acts as the gatekeeper for all user consent choices:

Ensures Transparency and Compliance
A CMP provides transparency by informing users upfront about data collection, and then securely records their choices. This transparency and documentation are critical for meeting regulatory requirements, especially with upcoming changes in Australia’s privacy laws.
Saves and Applies User Preferences
CMPs save the user’s consent choices so they don’t have to be asked repeatedly, which enhances user experience and ensures compliance on repeat visits.
Protects Your Business
By integrating with Consent Mode, a CMP ensures that your site’s tracking adheres to the user’s consent, protecting you from accidental non-compliance, which could lead to penalties under stricter data privacy regulations.

Think of Consent Mode as the mechanism that controls Google tags based on user consent, and the CMP as the tool that gathers and manages that consent. Together, they enable your business to respect user choices, stay compliant, and protect customer trust in a seamless, automated way.