Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Google Ads Conversion Tracking is the JavaScript tag that reports conversions, leads and ecommerce events back to Google Ads. It writes the _gcl_au and _gcl_aw advertising cookies, transmits the click identifier (gclid) and is required for bid optimisation and remarketing audiences. As an advertising tool, it requires prior consent under GDPR and ePrivacy and must be deployed with Google Consent Mode v2 in the EU.
Google Ads Conversion Tracking is the JavaScript pixel that advertisers add to their site to report conversions, leads, sign ups and ecommerce purchases back to Google Ads. The tag is fired on success pages or specific events and connects each conversion to the corresponding ad click using the gclid parameter. It is the foundation of bidding strategies such as Maximise Conversions, Target CPA and Target ROAS, and feeds remarketing audiences.
The conversion tag writes _gcl_au and _gcl_aw on the advertiser domain to attribute the visit to a previous Google Ads click and reads cookies on doubleclick.net for cross device measurement. Enhanced conversions additionally send hashed email addresses or phone numbers, which are personal data even after hashing under European supervisory authority guidance.
The conversion pixel is an advertising technology, not strictly necessary for the website. Article 5(3) of the ePrivacy Directive therefore requires prior consent before the tag fires. The CNIL, AEPD, BfDI and Garante have all emphasised that conversion measurement performed through Google Ads constitutes processing for advertising purposes and must be opt in.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Since March 2024, advertisers serving EEA traffic must implement Consent Mode v2 to keep using audiences and modelled conversions. Consent Mode v2 introduces ad_user_data and ad_personalization signals that must reflect the visitor''s real choices in the cookie banner. Without consent, the tag should send no cookies and the conversion ping must be in the basic mode with no identifiers.
Conversion data, IP addresses and identifiers are transmitted to Google LLC infrastructure in the United States. Google self certifies under the EU U.S. Data Privacy Framework, but you should still document the transfer in your records of processing and inform visitors in the privacy policy.
Block the conversion tag in your tag manager until the visitor accepts the marketing category. Configure Consent Mode v2 with the four signals (ad_storage, analytics_storage, ad_user_data, ad_personalization) wired to your CMP. Use server side tagging when possible to limit the data sent client side, and document every conversion action in your records of processing.
Websites using Google Ads Conversion Tracking must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA should be considered when conversion tracking is combined with enhanced conversions (hashed email, phone), customer match audiences or remarketing, due to identification of users, transfers to the United States and large scale ad profiling.
Sample consent text
We use Google Ads Conversion Tracking to measure ad campaign performance. With your consent, Google may store advertising cookies on your device, link your visit to a previous ad click and transfer data to Google LLC in the United States. You can refuse or withdraw your consent at any time from the cookie settings.
Third-party domains contacted
googleads.g.doubleclick.netwww.googletagmanager.comwww.google.comdoubleclick.netgoogleadservices.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _gcl_au | first_party | 90 days | Set on the advertiser domain by Google Tag Manager to attribute the visit to a previous Google Ads click for conversion measurement. |
| _gcl_aw | first_party | 90 days | Stores the gclid identifier on the advertiser domain to link a conversion to the originating Google Ads click. |
| IDE | third_party | 13 months | Set on doubleclick.net for conversion attribution and cross device measurement in Google Ads. |
| test_cookie | third_party | 15 minutes | Set on doubleclick.net to verify that the browser supports cookies before serving the conversion ping. |
Google Ads Conversion Tracking places tracking cookies for advertising — comply with GDPR using FlowConsent.
The conversion tag writes _gcl_au and _gcl_aw on the advertiser domain to attribute the visit to a previous Google Ads click, plus the third party cookies IDE and test_cookie on doubleclick.net for cross device measurement.
Yes. The pixel is an advertising tool that writes non essential cookies and shares behavioural data with Google, so prior, specific and informed consent is required under Article 5(3) of the ePrivacy Directive and Article 6(1)(a) GDPR.
Consent is the only suitable legal basis. Legitimate interests cannot be relied on because the processing involves cross site profiling for advertising purposes and transfers to the United States.
Yes. The conversion ping, IP address, gclid and any enhanced conversion identifier are sent to Google LLC in the United States under the EU U.S. Data Privacy Framework. The transfer must be disclosed in your privacy policy.
A DPIA is recommended when conversion tracking is combined with enhanced conversions, customer match audiences or extensive remarketing, due to user identification, US transfers and large scale advertising profiling.
Block the tag through your CMP until consent is granted, configure Google Consent Mode v2 with all four signals, prefer server side tagging via Google Tag Manager Server, and document the legal basis and retention in your records of processing.
Privacy first alternatives include first party server side conversion APIs (Google Ads API offline conversions, Plausible Goals, Matomo Goals) which limit the data shared with Google and avoid client side cookies altogether.
Add a section that names Google Ads Conversion Tracking, lists the cookies (_gcl_au, _gcl_aw, IDE, test_cookie) with purpose and duration, mentions the transfer to Google LLC in the United States and links to Google's privacy policy.