[luckylion]

> If you do this you don't even need to check for consent since you're not tracking the user or storing any PII.

Google seems to disagree [1]: Non-personalized ads are targeted using contextual information rather than the past behavior of a user. Although these ads don’t use cookies for ads personalization, they do use cookies to allow for frequency capping, aggregated ad reporting, and to combat fraud and abuse. Consent is therefore required to use cookies for those purposes from users in countries to which the EU ePrivacy Directive’s cookie provisions apply.

What's not clear from Google's documentation, but what I assume, is that they also do not use the info about the context & visitor to serve them personalized ads on other websites.

[1] https://support.google.com/adsense/answer/7670013

[bartread]

Hmm, that's interesting because that would suggest that if somebody declines advertising cookies then you can't serve them ads via Adsense at all... which would be an odd decision by Google.

[AstralStorm]

That's not the issue. The issue is that if the user has and sends Google cookies AdSense will use them. (And many people have third party cookies on, and AdSense might be using some tricky bypass there too.) Getting sneaky about tracking is their business model. And then cookie law is in full force.

[bartread]

Sure but it sounds like the only way to guarantee those cookies aren't sent by Adsense is simply not to use it in the event that consent is declined. Or am I missing something?

[luckylion]

That's my understanding. You can't use most Google services without prior consent. Adsense, Youtube (even youtube-nocookie, which just uses localstorage for tracking), maps etc. Google is not in the business of not tracking users.

[bartread]

But this is what I find strange. It seems unlikely that Google would simply opt out of serving people who refuse to accept advertising or tracking cookies.

Granted, from measurements on my own site that's only 1 - 1.5% of people, but Google's ad revenue for 2019 was $134.81 billion, meaning that they'd potentially be leaving $1.3 - $2 billion on the table by not serving ads to these people. Maybe it would be half that or less because the ads aren't personalised, so they're a bit more hit and miss and therefore probably wouldn't attract the same level of bids from advertisers.

But still, they'd be leaving a lot more money on the table than it would cost to fix the problem (an order of magnitude? two orders of magnitude?). Whilst they might choose to leave it due to opportunity cost, it doesn't seem that likely to me. Here's an example: I once worked at a company whose revenue sat in the £250-300 million range, and they absolutely considered it worth supporting 1% of their userbase for the extra £2 - 3 million it brought in (this is back in the day when IE7 and 8 were still a thing), because it probably only cost them high 5 to low-ish 6 figures per year in PITA workarounds to do that[1].

So, as I say, it seems odd to me that Google don't have a solution for serving cookie-free ads that require no consent.

Going back to skrtskrt's original question, "What are some good non-tracking & non-intrusive ad providers?"

[1] Obviously all us devs hated this, but it was tough to argue against from a rational standpoint.

[luckylion]

I don't know whether they really could. It's not just an issue of matching ads, it's also an issue of having relevant ads.

I use adblock by default, so I have no ad-profile at Adsense that they'd use to show me "relevant ads". When I occasionally have to debug some issue with ads somewhere, I'm essentially getting the context-sensitive, not-personalized ads, and they're terrible. At least to me they look as if they were using very simple keyword-matches with little regard to context and primary language. It may be that they don't care to invest more, but it may also be that they don't have enough ad buyers that care for unpersonalized ads so they simply don't have a large pool they can choose from.

I'm also not sure that "cookie-free" would be enough, really. If you're loading ads directly from Google, the user makes the request and can therefore be tracked by Google. Even with Google Analytics and anonymizeIp, at least in the medical sector in Germany, GA is considered opt-in only. In that sense, I'm not sure a central service that delivers ads for you can work without requiring consent.

What very much should work would be a server-side system that's sale/lead-based, where the service would crawl your site, manage your affiliate programs and create ads for you that you'd then insert into your site. That way, no third party learns anything about the individual user and you don't require consent.

[mfontani]

Well, sure - you can still send some signals to see ads that are relevant to the _content_ as opposed to the _viewer_.

Example: you're seeing an article about devops and you get an ad about AWS instead of an ad that has followed you around from another website you visited previously.

The cookie used for frequency capping is considered to be a "technical cookie" and has no bearing on privacy, best I can tell.

The other types of cookies can be pretty much disabled at the point of calling the google tag, or enabled (along with more tracking/targeting ads) if the user consented to that.

[the_gipsy]

> The cookie used for frequency capping is considered to be a "technical cookie" and has no bearing on privacy, best I can tell.

But the comment you're responding to says it right there: Even google is telling you it requires consent. It's a cookie, so it requires consent, period. Don't fool yourself.

Could google serve ads without cookies, and do fraud detection by other means? Yes, perhaps lowering payout due to increased risk. But it much better to pretend that a cookie-banner is needed, so that you might as well enable ad-tracking cookies.

[luckylion]

Since it's a technical cookie that's required for ads/marketing, it very much falls under marketing, I believe. Imho "technical cookies" are e.g. Cloudflare's __cfduid or your framework setting a session cookie because it wants to be stateful.