> Google AdSense and GDPR: which cookies AdSense sets, when consent is required, how to use IAB TCF or Consent Mode v2 and serve non-personalised ads. > > Canonical: https://www.flowconsent.com/en/services/advertising/google-adsense Advertising # Google AdSense Marketing · [Official website](https://adsense.google.com) Google AdSense is Google's advertising platform that enables website publishers to earn revenue by displaying targeted ads. AdSense loads third-party advertising cookies and sends visitor data to Google's ad infrastructure before serving any ads. Under GDPR and the ePrivacy Directive, consent is required before personalised ads are served. Publishers must integrate with the IAB Transparency and Consent Framework (TCF 2.2) or Google Consent Mode v2 to pass valid consent signals to AdSense. Non-personalised ads may be served without full consent with appropriate disclosure, though many EU DPAs still recommend consent. [Block Google AdSense until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=advertising) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Advertising](https://www.flowconsent.com/en/services/advertising) - Consent Marketing - Prior consent Required - Documented cookies 4 - Third-party domains 5 - Servers United States (Google infrastructure) Overview ## What does Google AdSense do? ## **What is Google AdSense?** Google AdSense is Google's publisher monetisation platform, allowing website owners to earn revenue by displaying ads served by the Google Display Network. Publishers place a JavaScript snippet (adsbygoogle.js) on their pages, which communicates with Google's ad servers to fetch and display contextually or behaviourally targeted advertisements. AdSense is one of the most widely deployed third-party scripts on the web, making it a significant compliance touchpoint for any European website that monetises through advertising. ## **What Cookies and Data Does AdSense Collect?** AdSense sets several advertising cookies including \_\_gads and \_\_gpi (persistent, up to 13 months, ad targeting and frequency capping), IDE (persistent, 13 months, DoubleClick cross-site conversion tracking), and DSID (for signed-in users). Beyond cookies, AdSense collects IP address, browser fingerprint, page URL and referrer, ad interaction events (impressions, clicks), and audience segment data derived from browsing history across the Google Display Network. All this data feeds into Google's advertising profiles used for behavioural targeting. ## **GDPR and ePrivacy Obligations** Under the ePrivacy Directive and GDPR, personalised advertising requires explicit prior consent. This means the adsbygoogle.js script must not load, and no AdSense cookies must be set, until the user has actively consented to advertising cookies in a compliant cookie banner. The IAB Transparency and Consent Framework (TCF 2.2) provides a standardised consent signal that AdSense can read. Publishers using a TCF-certified CMP must obtain consent for TCF Purpose 1 (store and access information on a device) as a minimum before AdSense operates. Failures to obtain valid consent for AdSense have resulted in significant fines across the EU. ## **Non-Personalised Ads and Consent Mode** Google offers two alternatives to fully blocking AdSense before consent. First, Non-Personalised Ads (NPA) mode: when a publisher passes a consent signal indicating no personalisation consent, AdSense serves contextual ads only, without setting persistent tracking cookies. This reduces the privacy footprint but does not eliminate all data collection. Second, Google Consent Mode v2: a framework where AdSense adjusts its behaviour based on the consent signals passed by the CMP. With Consent Mode, AdSense can model conversions and audiences even when users decline cookies, using aggregated and anonymised data. Both approaches reduce risk but do not fully eliminate the need for a compliant consent banner and privacy policy disclosure. ## **Data Transfers Outside the EU** All AdSense data processing occurs on Google infrastructure in the United States. Google relies on Standard Contractual Clauses (SCCs, 2021 edition) for EU to US data transfers. Publishers must accept Google's DPA (available in their AdSense account settings) and document the SCC reliance in their Records of Processing Activities. The publisher acts as data controller for their own site and as a joint data controller or data processor depending on the specific use of AdSense features. The Google Ads Data Processing Terms must be accepted before serving ads to EU users. ## **Practical Compliance Steps** To run AdSense compliantly: (1) Implement a TCF 2.2 certified CMP and block adsbygoogle.js until consent is given. (2) Accept Google's Ads Data Processing Terms in your AdSense account. (3) Enable Google Consent Mode v2 to send consent signals and recover modelled conversions. (4) Configure NPA mode as a fallback for users who decline cookies. (5) Disclose AdSense, its cookies, the US data transfer, and Google's role as data processor in your privacy policy and cookie notice. (6) For large-scale EU advertising, complete a DPIA and document your legitimate interest assessment where NPA is used. Compliance ## Google AdSense and the GDPR Google AdSense is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) required for personalised advertising cookies under the ePrivacy Directive. Non-personalised ads (NPA mode) may be served under legitimate interest (Art. 6(1)(f)) with appropriate disclosure and opt-out, but many DPAs require consent even for NPA. Publishers using IAB TCF 2.2 must obtain purpose 1 (store and access information) consent before any AdSense cookies are set. - Risk level high - Applicable regulations GDPR, ePrivacy Directive, IAB TCF 2.2, SCCs for US data transfers ### Impact assessment (DPIA) A DPIA is recommended for publishers with significant EU traffic using personalised AdSense advertising, particularly where AdSense audience profiling combines with other on-site user data, or where sensitive content categories trigger special processing considerations under Art. 9 GDPR. ### Sample text for your banner > We use Google AdSense to display advertisements on this website. AdSense uses cookies and collects data about your visits to serve personalised ads based on your interests. Data is processed by Google in the US. You can manage your advertising preferences below or opt out of personalised ads at any time. Cookies and trackers ## What Google AdSense sets and contacts - Tracking method JavaScript (adsbygoogle.js), third-party advertising cookies, cross-site audience profiling, contextual and behavioural ad targeting, Google Ad Manager integration, Google Consent Mode v2 - Server location United States (Google infrastructure) - Data transferred outside the EU Google AdSense is operated by Google LLC (US). All ad-serving data, audience profiles, and conversion signals are processed on Google infrastructure in the US. SCCs are in place via Google's GDPR-compliant DPA. Publishers must ensure their consent signal is correctly passed to AdSense via IAB TCF 2.2 or Google Consent Mode v2. ### Cookies set (4) | Name | Type | Duration | Purpose | | -------- | ---------- | --------- | ------------------------------------------------------------------------ | | \_\_gads | persistent | 13 months | Google AdSense publisher-side ad targeting and frequency capping | | \_\_gpi | persistent | 13 months | Google Publisher ad impression frequency and measurement | | IDE | persistent | 13 months | Google DoubleClick cross-site conversion tracking and ad personalisation | | DSID | persistent | 2 weeks | Signed-in user targeting and ad personalisation for Google ads | ### Third-party domains contacted (5) - `pagead2.googlesyndication.com` - `tpc.googlesyndication.com` - `googleads.g.doubleclick.net` - `adservice.google.com` - `doubleclick.net` Questions ## Frequently asked questions about Google AdSense Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does Google AdSense require GDPR consent? Yes. Google AdSense uses advertising cookies and processes personal data for behavioural targeting, which requires prior explicit consent under the ePrivacy Directive and GDPR Art. 6(1)(a). The adsbygoogle.js script must not load until the user has consented to advertising cookies in a compliant banner. Without valid consent, your site risks enforcement action from EU data protection authorities and potential fines under GDPR. ### What cookies does Google AdSense set? Google AdSense sets several cookies: \_\_gads (persistent, 13 months, publisher-side ad targeting and frequency capping), \_\_gpi (persistent, 13 months, Google Publisher ad frequency), IDE (persistent, 13 months, DoubleClick cross-site conversion tracking and ad personalisation), and DSID (persistent, 2 weeks, signed-in user targeting). In NPA mode, persistent advertising cookies are not set. Some browsers and ad blockers may prevent these cookies from being set, which can affect ad revenue. ### Can I serve non-personalised ads without user consent? Google offers a Non-Personalised Ads (NPA) mode where AdSense serves contextual ads only, based on page content rather than user behaviour. In NPA mode, no persistent tracking cookies are set for ad targeting. However, AdSense still makes a request to Google servers (sharing IP and page URL), so it is not entirely cookieless. Most EU DPAs accept NPA mode as compatible with legitimate interest, but require clear disclosure and an easy opt-out. Some stricter authorities may still require consent even for NPA mode, so consult your local DPA guidance. ### How does Google Consent Mode v2 work with AdSense? Google Consent Mode v2 is a framework that allows your CMP to pass consent signals to Google tags including AdSense. When a user declines advertising cookies, Consent Mode instructs AdSense to operate in a restricted mode: no advertising cookies are set, but AdSense can still collect anonymised, aggregated signals (pings) to model conversion data without identifying individual users. This allows publishers to recover some measurement data even from users who declined consent. Consent Mode v2 is required for publishers using Google Ads with EU traffic. Implementing it requires a TCF 2.2 certified CMP or direct Consent Mode API integration. ### Does Google AdSense transfer data outside the EU? Yes. All AdSense data processing occurs on Google LLC infrastructure in the United States. Google uses Standard Contractual Clauses (SCCs, 2021 edition) as the legal transfer mechanism under GDPR Chapter V. Publishers must: (1) accept the Google Ads Data Processing Terms in their AdSense account; (2) reference the Google DPA and SCCs in their privacy policy; (3) document the transfer in their Records of Processing Activities. US intelligence law (FISA 702) continues to be a concern under Schrems II, and publishers should document a Transfer Impact Assessment. ### Do I need a DPIA for Google AdSense? A DPIA is recommended (and may be required) if: (1) your website serves a large EU audience and relies heavily on personalised AdSense advertising; (2) AdSense audience data is combined with other personal data from your platform (e.g., logged-in user profiles); (3) your content targets vulnerable groups such as minors or involves sensitive categories. The DPIA should assess the risk of US data transfers, the breadth of behavioural profiling, and the measures taken (Consent Mode, NPA fallback, SCCs). Even without a full DPIA, a legitimate interest assessment is required if using NPA mode. ### How do I implement AdSense with an IAB-compliant consent banner? To implement AdSense with a compliant consent banner: (1) Choose a CMP certified under IAB TCF 2.2 (e.g., Axeptio, CookieBot, OneTrust). (2) Configure AdSense as a vendor in your CMP, ensuring it is linked to the correct IAB vendor ID. (3) Block the adsbygoogle.js script from loading until TCF consent is obtained. (4) Implement Google Consent Mode v2 to pass consent signals and enable NPA fallback. (5) Test that AdSense does not fire on initial page load for new users. (6) Verify that your cookie banner offers a genuine and easy way to refuse all advertising cookies. ### How do I disclose Google AdSense in my privacy policy and cookie notice? Your privacy policy should state: (1) that you use Google AdSense for advertising revenue; (2) what data AdSense collects (cookies, IP, browsing behaviour); (3) that Google processes data in the US under SCCs; (4) a link to Google's Privacy Policy and Google's Ad Technology Provider list; (5) how users can manage ad personalisation via Google's My Ad Center. Your cookie notice should list \_\_gads, \_\_gpi, and IDE under the advertising category with accurate durations and mark them as requiring consent. If using NPA mode, explain that contextual ads may be shown without consent but that Google still receives IP data. Same category ## More services: Advertising [See the whole category](https://www.flowconsent.com/en/services/advertising) ### [Ringostat](https://www.flowconsent.com/en/services/advertising/ringostat) [Ringostat is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Ringostat enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Ringostat empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/advertising/ringostat) [Marketing](https://www.flowconsent.com/en/services/advertising/ringostat) · ### [ArcSpan](https://www.flowconsent.com/en/services/advertising/arcspan) [ArcSpan is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. ArcSpan enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, ArcSpan empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/advertising/arcspan) [Marketing](https://www.flowconsent.com/en/services/advertising/arcspan) · ### [Gruvi](https://www.flowconsent.com/en/services/advertising/gruvi) [Gruvi is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Gruvi enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Gruvi empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/advertising/gruvi) [Marketing](https://www.flowconsent.com/en/services/advertising/gruvi) · ### [The Rave](https://www.flowconsent.com/en/services/advertising/the-rave) [The Rave is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. The Rave supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, The Rave ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/advertising/the-rave) [Marketing](https://www.flowconsent.com/en/services/advertising/the-rave) · ### [Signal](https://www.flowconsent.com/en/services/advertising/signal) [Signal is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Signal enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Signal empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/advertising/signal) [Marketing](https://www.flowconsent.com/en/services/advertising/signal) · ### [Facebook Ads](https://www.flowconsent.com/en/services/advertising/facebook-ads) [Facebook Ads is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Facebook Ads enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Facebook Ads empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/advertising/facebook-ads) [Marketing](https://www.flowconsent.com/en/services/advertising/facebook-ads) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)