Cookie banner for a website with ads

When a Google Analytics ID is entered in Advanced Ads' ad blocker counter, an inline footer script on every page loads googletagmanager.com/gtag/js and sends an AdBlock event; it is held on the server only with the Cookie or TCF privacy methods. Advanced Ads also marks its critical inline script (id ending in 'ready', no tracker) to be skipped by WP Rocket's delay and by one consent plugin's blocker, and does nothing for other delay tools.

AdSense Auto ads in Advanced Ads print adsbygoogle.js in the head; with the Privacy module on, an inline script creates it when the advanced_ads_privacy event says accepted. With 'Show non-personalized AdSense ads until consent is given' (Cookie method), Advanced Ads sets requestNonPersonalizedAds=1 and loads AdSense before any choice.

Advanced Ads has no banner and does not use WP Consent API or set Consent Mode defaults. Its Privacy module defaults to showing all ads without consent. The Cookie method looks for a cookie name containing a value, checked in PHP (substring) and re-read in JavaScript every 333 ms for 60 seconds; with page caching the free version serves the cached result to everyone. The IAB TCF method waits for window.__tcfapi and needs purpose 1 consent; ads are kept base64-encoded in a text/plain script and decoded only at load. It fires a DOM event, advanced_ads_privacy.

Ad Inserter's ad blocking detection is off by default. When it is on with Use external scripts (on by default), every page footer gets bait tags before any choice: <object> tags pointing to google-analytics.com/analytics.js, googletagmanager.com/gtag/js, secure.quantserve.com/quant.js and contextual.media.net/dmedianet.js, an <img> from dummyimage.com, and after load a HEAD fetch to pagead2.googlesyndication.com/pagead/js/adsbygoogle.js whose address is base64-encoded in an inline script. Cookies: aiADB (30 days by default) and aiADB_PV (365 days) when a blocker is handled, aiADB_PR for redirection, and aiBLOCKS (365 days) for per-block close and view limits.

Ad Inserter shows no banner and does not use WP Consent API or set Consent Mode defaults. Each block can wait for a cookie listed in its Cookies list (whitelist or blacklist, empty by default); JSON cookies are read with the syntax name[key][*]=value after decodeURIComponent and JSON.parse. The check runs in the browser only with Client-side insert or Client-side show; server-side checks are frozen by page caching. Blocks waiting for consent are re-inserted on the page only on IAB TCF signals, on the events of one consent plugin, or when ai_load_blocks() is called; tcf- conditions hide the block if window.__tcfapi is missing after three tries.

With Dynamic blocks set to Client-side insert (the default), an Ad Inserter block that has a check run in the browser (cookie, URL parameter, referrer or client list, scheduling, a device selection other than all) or uses lazy, manual or delayed loading is printed with its code base64-encoded in a data-code attribute of a div (ai-dynamic, ai-lazy, ai-manual). Ad Inserter's own script decodes it and inserts it, and the inserted scripts run. A consent plugin that reads the page markup cannot see the ad network address. A block with default settings and no list is printed in clear.

With Site Kit's conversion tracking for WooCommerce and the gtagUserData flag (since 1.161.0), the purchase event carries user_data with the billing email, phone and name for Google's enhanced conversions. Its Reader Revenue Manager module loads news.google.com/swg/js/v1/swg-basic.js on the pages where its snippet is set.

Cookie Rocks lists the Google tag as Google Analytics (gtag.js), statistics only, without the Google Ads cookie _gcl_au and storage key _gcl_ls, when nothing shows Google Ads (no Google Ads tag seen on the pages or declared in GTM, no Site Kit Ads module) and one sign says there is none (the answer No Google Ads, or Site Kit active without its Ads module). Otherwise a GT- tag stays in statistics and marketing. A Google Ads ID (AW-) in the gtag.js address or in gtag('config', 'AW-...') counts as Google Ads.

With Site Kit's Ads module (a test AW- conversion ID), the Google tag counts as statistics and marketing. After Accept all, Google Ads sets _gcl_au and calls doubleclick.net. With consent to statistics only, no Google Ads cookie is set, but the loaded tag still sends Google a cookieless request with advertising consent denied (pagead2.googlesyndication.com/ccm/collect).

Site Kit prints its Google tag (gtag.js) in the page head. Cookie Rocks holds it there in basic mode: before any choice, no request goes to Google. After Accept all, Google Analytics sets _ga and _ga_<ID>; with statistics only, the same happens and advertising stays denied; after Reject all, gtag.js is never loaded. With a GT- test ID Google returned no configuration and set no cookie; the cookies were seen with a G- test ID.

With its Consent Mode setting on, Site Kit sets Google's default consent a second time, after the banner's, and only for a fixed list of 32 countries (EU, IS, LI, NO, GB, CH): the regions saved in Site Kit are not read. With WP Consent API present, it also sends its own consent updates after each choice; they grant functionality_storage as soon as the page opens (the functional category of WP Consent API), while statistics and advertising follow the visitor's choice.

With Site Kit, Cookie Rocks pushes its 'denied' consent default first in the dataLayer and asks Google to wait 500 ms; on Accept all it records 'granted' before releasing Site Kit's tag, so the tag reads denied, Site Kit's settings and events, then granted, and everything is sent as granted. After a refusal the tag never loads. In a browser test: no request and no cookie before the choice, Analytics and its cookies after Accept all.

When a banner holds Site Kit's Google tag (gtag/js), two other Site Kit scripts still run before the choice: the inline tag settings (google_gtagjs-js-after: linker, js, developer_id, config) and its content events provider. They only fill the dataLayer and send nothing to Google. Site Kit also replaces window.gtag with an equivalent function writing to the same dataLayer. After consent, events pushed before the choice are processed by the tag.

With Site Kit's Tag Manager module, the container (gtm.js) is held in the page head and loads only after consent. With its AdSense module, the Auto ads script (adsbygoogle.js) is held as marketing: it loads after Accept all, not with statistics only or after Reject all.

Site Kit declares itself compatible with WP Consent API, but its code reads WP Consent API only when its own Consent Mode setting is on. With that setting off, Site Kit pushes no consent command at all, and the visitor's choice reaches Google only through the banner's own Consent Mode signals.

WP Consent API keeps its wp_consent_* cookies for 30 days by default. A banner that writes them only at the click leaves Site Kit reading no consent after 30 days, while the banner's own choice is still valid. Cookie Rocks writes the visitor's choice to WP Consent API on every page: in a test, the wp_consent_* cookies were deleted and the page reloaded; they were set again to allow, and Site Kit and Google read granted.