What do privacy and consent mean for digital marketing?

What you will learn

By the end, you will understand:

Explain purpose, minimization, notice, choice and security
Distinguish consent from other possible legal bases without giving legal advice
Understand basic versus advanced Consent Mode and tag governance

Visual explainer

See the idea clearly.

A person receives clear purpose information and makes granular choices; approved data flows only to permitted first and third parties, while denied purposes remain blocked and withdrawal propagates.

Start with purpose and necessity

01
Define legitimate purpose
02
Identify minimum data
03
Map collection and recipients
04
Choose lawful basis with qualified advice
05
Give clear notice/choice
06
Secure and limit access
07
Honor rights/withdrawal
08
Delete or anonymize on schedule

Consent has qualities, not only a button

Where consent is relied on, it generally needs to be informed, specific, freely given and expressed through a clear affirmative choice under applicable rules. Preselected boxes, bundled unrelated purposes or blocked withdrawal can undermine it.

Other lawful bases may exist depending on jurisdiction and activity. This course teaches design principles, not a universal legal conclusion; obtain qualified advice for markets and data use.

Separate purposes

Purpose	Example
Essential/security	Authentication, fraud prevention and requested service functions.
Analytics	Understanding product/site use under the configured consent/legal design.
Personalization	Remembered preferences or tailored experiences.
Advertising	Ad storage, measurement, audience creation or personalized advertising.
Direct marketing	Email/SMS/other messages under channel-specific rules and preferences.

Consent Mode is a tag behavior layer

Google says Consent Mode communicates user choices to Google tags/SDKs and adjusts their behavior. The website/app still must obtain the choice, update Google and ensure Google and third-party tags respect it.

In basic mode, Google tags are blocked until consent interaction and no data is sent before consent. In advanced mode, tags load with denied defaults and may send limited cookieless pings used for modeling. The appropriate implementation depends on legal/business decisions.

A banner is not proof by itself

Choices match actual tags
Default state before tags
Reject as accessible as accept where required
Granular purposes
No dark patterns
Preference link persists
Withdrawal updates immediately
Third-party tags controlled
Consent record/version
Regional behavior tested
Crawler/essential functions preserved
Vendor list current

Protect first-party data

“First-party” means collected in the direct relationship, not automatically unrestricted or safe. Minimize, secure, restrict, retain only as needed and avoid uploading to advertising/AI platforms without a valid purpose and contract.

Hashing contact data reduces exposure in transit/processing but does not anonymize it or create permission.

Measurement changes under privacy controls

Denied consent, browser limits and cross-device gaps reduce observable data. Modeling can estimate aggregates under eligibility conditions, but should not be represented as exact known individuals.

Use ranges, reconciled business outcomes and experiments where appropriate. Do not use fingerprinting or covert workarounds to defeat user choices.

Real-world example

Example: consent choice actually controls tags

Example

A visitor rejects analytics and advertising. Defaults are denied before tag execution, related tags remain blocked/limited according to the chosen implementation, and the footer preference link can reopen choices. Changing to granted sends an update without forcing a page reload.

Try this

Audit one tag from click to recipient

Choose one analytics or advertising tag. Record purpose, data fields, default consent, firing conditions, recipient, retention, access, withdrawal effect and current documentation. Test accept, reject and change-choice paths.

Common questions

Questions beginners ask.

What is personal data?

Information relating to an identified or identifiable person; exact legal definitions vary.

Is consent always required?

Not for every purpose/jurisdiction, but any chosen legal basis must be valid; get qualified advice.

What makes consent meaningful?

Clear information, specific purposes, real choice, affirmative action and easy withdrawal under applicable rules.

What is Consent Mode?

Google tag behavior that receives consent states and adjusts data collection/use; it does not collect legal consent by itself.

What is basic Consent Mode?

Google tags remain blocked until consent interaction; denied/no consent sends no data to Google through those blocked tags.

What is advanced Consent Mode?

Google tags load with denied defaults and can send limited cookieless pings used for modeling, depending on configuration.

Does hashing make email anonymous?

No. A hashed stable identifier can still be personal/pseudonymous data and requires authorization.

Can privacy choices reduce measurement?

Yes. Respect the choice and use modeled/aggregate or experimental evidence without covert identification.

Assessment

Check what you understood.

5 questions · instant explanations

1. What should come before collecting data?

2. What does Consent Mode do?

3. What happens in basic mode before consent?

4. What does hashing a contact do?

5. True or false: a cookie banner alone proves every third-party tag obeys the choice.

Sources