Consent, privacy and what a publisher actually earns

If you sell advertising and have European traffic, user consent is no longer just a legal matter: it is a variable that lands straight in your revenue. Here is what CMP, TCF and Consent Mode mean, and what you need in place.

Consent moved into the P&L

For years the cookie notice was a formality: a bar at the bottom, an accept button, next thing. That is over. Today what the user answers decides what data the advertising chain can use to value an impression, and an impression valued with less information is paid less.

It helps to separate two sets of rules that get mixed up. The GDPR (General Data Protection Regulation) governs the processing of personal data: what it is used for and on what legal basis. The ePrivacy rules, each country's cookie law, govern something narrower: storing or reading information on the device. The second forces the banner; the first says what you may do with what you collect.

What a CMP is and what it actually does

A CMP (Consent Management Platform) is the software that shows the notice, collects the decision, stores it and, this is the important part, passes it on to the rest of the systems on the page. A banner that paints itself and never communicates is decoration.

Check three things separately: that the information is understandable and the options balanced, that the decision is recorded with a date and a scope, and that a readable signal reaches the ad server, the bidding wrappers and your measurement. If the third fails you keep the legal risk and lose money on top: a system with no signal assumes the worst.

The IAB TCF: a common language for consent

The TCF (Transparency and Consent Framework) is an industry standard, driven by IAB Europe, so that this signal is the same for everyone. Without it, every CMP would say «the user agreed» in its own way and no SSP would know how to read it.

It defines three things:

• A numbered list of purposes: storing information on the device, building profiles for personalised advertising, measuring ad performance.
• The Global Vendor List, where every participating vendor declares what it processes data for.
• The TC String, the string encoding which purposes and which vendors that user accepted, which travels with the ad request.

To sell European inventory you need a CMP integrated with the framework: Google requires one certified by Google in order to serve ads in the European Economic Area (EEA) and the United Kingdom. Successive versions have tightened what can rely on legitimate interest, and the framework has been litigated in Europe: it is not a definitive safe harbour, but the market's operating standard.

Google Consent Mode v2: what it is and why it exists

Consent Mode is a different, complementary mechanism. Instead of deciding whether its tags load at all, Google asks you to communicate the consent status through a set of parameters, and its products adjust. The original ones cover advertising storage and analytics storage; version 2 added two: sending user data for advertising purposes, and personalising advertising.

Why version 2? Because the European Digital Markets Act (DMA) requires large platforms to obtain explicit consent to combine personal data across services, and Google passed that obligation on to whoever uses its tools: without those signals, certain audience and measurement features stop being available for EEA traffic.

What happens to revenue when someone refuses

Refusing is not switching advertising off. Set up properly, that user still gets non-personalised ads, decided by the page context, the language or the device. They pay, but they usually pay less: the buyer cannot apply their segments, cannot cap frequency, cannot attribute the conversion.

A user who refuses is not worth zero. They are worth less. The difference between those two things is your configuration.

This is where revenue is lost for reasons unrelated to the law. An ad server without non-personalised advertising enabled returns an empty slot instead of a paid ad. A CMP that blocks everything until there is an answer, plus a user who leaves without answering, leaves the page unmonetised. Watch two numbers separately: how many people accept, and how much the traffic that does not accept yields.

The notice is a product decision too

The temptation is to push people towards yes, and there is little room. Consent has to be freely given, informed, specific and unambiguous, and European authorities have been explicit about what invalidates it: refusing must cost the same as accepting, silence and scrolling do not count, and boxes do not come pre-ticked.

Everything else is in your hands: asking at the right moment, explaining in one sentence what the user gets, not repeating the question once they have answered, and keeping the notice from being what ruins your page speed.

The end of third-party cookies and what is taking their place

The third-party cookie, the one another domain drops in the browser to recognise the same person on other sites, has been on the way out for years. Safari and Firefox block it by default. In Chrome the matter has gone back and forth and announcements about its disappearance have been postponed, so there will be no dates here: do not bet on everything staying the same, nor on it disappearing tomorrow.

Meanwhile the market has moved towards alternatives already in use:

• First-party data: registration, newsletter, subscription. What the user gives you directly.
• Contextual, back with better tools: you buy the page, not the person reading it.
• Audiences declared by the publisher itself: your readers in standard categories, without handing over identifiers.
• Publisher-owned identifiers, passed to the ad server so you can cap frequency and target.
• Alternative industry identifiers, built on an encrypted email address the user handed over and consented to.
• The browser APIs proposed to replace part of these uses, still shifting ground.

The common thread: almost everything replacing the third-party cookie depends on a direct relationship with your audience, and that relationship needs consent properly asked for and properly recorded.

What you should have in place

If you sell inventory to European users, this is the minimum list:

• A CMP certified by Google and integrated with the TCF, not a homemade banner.
• The consent signal reaching the ad server and the bidding wrappers, verified in the actual request.
• Consent Mode implemented, with the version 2 parameters present.
• Non-personalised advertising enabled, so that a refusal does not turn into blank slots.
• The vendor list reviewed: every one you add is one more party to accept.
• A record of consent and an easy way to change or withdraw it from the site.
• A privacy policy and a cookie policy that say what the site actually does.
• Both paths tested: what happens when someone accepts and what happens when someone refuses.

A serious note: this explains how the advertising machinery works, it is not legal advice. How the rules are interpreted varies by country and by authority, and some points are still being argued in court. It is here so you can talk to your lawyer knowing what the conversation is about, not so you can skip them: which legal basis you rely on and how you word your notices is not decided by reading a blog.