Expand my Community achievements bar.

Concerns Implementing Google Consent Mode v2 With OneTrust in Adobe Launch

Avatar

Level 3

Hi Data Collection community!

 

I'm trying to implement Google Consent Mode v2 with OneTrust as my consent management platform and I am using Adobe Launch instead of GTM.

 

Previously I was using the GTAG extension by Acronym, but this extension seems to inject GTAG scripts for Google accounts (Google Analytics, Google Ads, etc.) into the `<head>` of my web application in an order that does not abide with what OneTrust documentation states.

 

NicholasDrzewiecki_0-1730147292427.png

 

I have even reached out to OneTrust support and they seem to agree that we are not able to use the GTAG extension for that reason (although they did not sound too confident in that confirmation).

 

Due to that, I have been testing abandoning the GTAG extension and including most of what the extension was doing in the `<head>` of my web application.

 

Now, Adobe Launch is only responsible for sending GTAG events using Custom Code actions.

 

However, after testing this refactor, I am noticing that GTAG scripts are being duplicated in the `<head>` of my web application.

 

The duplicated GTAG scripts are showing up at the very top of the `<head>` which again does not abide by the order of scripts that OneTrust documentation shows as we need the consent default command to be first.

 

I have a single page React application.

 

I also attached a PDF file that explains my concerns better and has screenshots to show the issue.

 

I understand this might be a better question to ask elsewhere such as the Google forums, or GA or GTAG subreddits.

 

Thought I would ask here regardless just in case somebody has ran into this issue.

 

Unfortunately, I don't believe I would be able to get a contact with a Google support agent directly.

2 Replies

Avatar

Adobe Champion

At what point are the gtag scripts being added to the head? Because that is the very nature of gtag- 10 minutes after the page has loaded, if I run the gtag snippet in my console, it will add a gtag script to my <head>. (Obnoxiously, i will add a whole other script for each tag/account I send data to.) Normally being in the <head> means it has loaded first, but in this case, it's just where gtag appends its script, even long after your page has loaded. So your Onetrust problem is less one of the tag being in the head, and more one of timing.
It looks like Onetrust has a more automatic solution, where you configure your gtag defaults first, so as Onetrust loads, it can update them as needed. But that's not the only way you could tackle this. If Onetrust didn't have this prepackaged solution for consent mode, it would probably be simpler for you. (And frankly, I find it surprising that Onetrust would recommend putting gtag script before Onetrust loads, when Onetrust's own very reasonable best practice is usually to have Onetrust load before any marTech scripts). Personally, I'd load Onetrust first, just like I do with any marketing tag, and either use a rule condition to entirely turn gtag on or off (same as I do with other marketing tags), OR, have gtag always fire, but use Javascript to dynamically populate the consent setting variables based on the user's preferences (as stored by Onetrust). 

Are you in the EU (with folks-are-opted-out-by-default rules) or elsewhere (like in the US, where in general folks can be opted in by default, so long as they have a way to opt out)? Do you need to have the setting be fairly dynamic (are you dealing with multiple regions) or do your users generally all fall in the same privacy regulation jurisdiction? Also, how committed are you to using consent mode v2, where if someone is "denied", Google will still collect data, just without tying it to any cookies? One could make a good argument for why even with consent mode v2 as an option, it may be best to have a simple "with consent we fire the tag, without it we don't". 

Avatar

Level 3

Thanks for your thorough reply @Jennifer_Kunz

 

At what point are the gtag scripts being added to the head?

 

The ones that show up at the very top of my `<head>` (the "duplicated" ones) seem to appear immediately as a page (or route in the context of React) loads.

 

Assuming that the GTAG scripts that show up at the top of the head ARE in fact being injected SOME time after the page loads, does that mean that my consent default script may in fact still be executed first BEFORE the injected GTAG scripts show up?

 

This is the main order of scripts I have been trying.

 

NicholasDrzewiecki_0-1730151799279.png

 

I say "main" because I have tried several different ordering of scripts.

 

This is a combination of an example from Google's documentation and OneTrust's documentation.

 

OneTrust's documentation doesn't mention where to place the GTAG config commands (as you can see in the screenshot in my initial post).

 

Whereas Google's documentation shows the GTAG config commands in a separate script below the GTAG scripts like 

 
NicholasDrzewiecki_1-1730151998971.png

https://developers.google.com/tag-platform/security/guides/consent?consentmode=advanced#implementati...

 

Again, that results in this when I run my test React web application.

 

NicholasDrzewiecki_2-1730152366480.png

 

This also results in the following messages in the Chrome console:

 

  • Duplicate container installation abandoned: AW-2
  • Duplicate container installation abandoned: DC-1
  • Duplicate container installation abandoned: G-1

 

Are you in the EU (with folks-are-opted-out-by-default rules) or elsewhere (like in the US, where in general folks can be opted in by default, so long as they have a way to opt out)?

 

I am in Canada and have confirmation that we can set the default consent settings to `granted` for all regions.

 

Do you need to have the setting be fairly dynamic (are you dealing with multiple regions) or do your users generally all fall in the same privacy regulation jurisdiction?

 

I do not need different settings for different regions (e.g., provinces). We have a OneTrust consent banner where a user is able to update their cookie preferences. This pushes a consent update event to the Google data layer and also updates the OneTrust `OptanonConsent` cookie. Currently, we only send GTAG events if we have the proper consent by checking the `OptanonConsent` cookie. This is done by rule conditions. But we are looking into updating that approach by implementing Google Consent Mode v2.

 

Appreciate your help.

 

There is so much conflicting information out there and seemingly unfinished documentation.