What it is
Google Ads conversion tracking links an ad click to later events, while remarketing builds audiences from site behaviour for later targeting. The scanner classifies both as advertising. Their precise legal treatment still depends on the data, purpose, contracts, jurisdiction and configuration.
The delivery is unusually spread out. Conversion tags may live in a container, remarketing may come from a GA4 audience link, and the endpoints sit on general-purpose Google domains next to search and reCAPTCHA, which is why the classifier matches paths rather than hosts alone.
What a scan matches
A verification scan drives a real browser and records the outbound requests observed during its configured journeys, so Google Ads and DoubleClick is identified by request hosts and paths rather than by source-code claims. Requests on unvisited paths, after unperformed interactions or solely on the server remain outside that observation.
- doubleclick.net, googlesyndication.com, googleadservices.com
- adservice.google.com and its country variants
- google.<tld> on the /ads, /pagead, /ccm and /rmkt paths: matched by path because those domains also serve things that are not tracking
Cookies are classified by name before domain because many analytics and advertising tags write first-party cookies through the page, which places a vendor-related identifier on your domain. Matching known names helps attribute those values without assuming that every first-party cookie came from your own application.
| Cookie | What it is for |
|---|---|
| _gcl_* | Google Ads click identifiers used for conversion attribution |
| IDE, DSID | DoubleClick advertising identifiers |
| __gads, __gpi | Ad serving and frequency capping |
| test_cookie | A capability check written by DoubleClick |
Controlling it with consent
Attach the conversion and remarketing tags to the marketing category. Inside a container, that is a consent setting on each tag; outside one, a custom script declaration with the marketing purpose.
Where a GA4 property is linked to Google Ads, audit both the account linkage and Consent Mode mapping. Google says that from 15 June 2026 its Ads Consent Mode settings govern Google Ads data collected through linked Analytics, while Analytics settings govern behavioral reporting. Confirm `ad_storage`, `ad_user_data` and `ad_personalization` reflect the marketing choice rather than assuming the analytics category controls advertising use.
No named adapter: choose the appropriate control
The product ships named adapters for Google Tag Manager, Google Analytics, the Meta and TikTok pixels, and Klaviyo. Choose the control route that fits this technology: a custom HTTPS script declaration for a browser loader, an individual consent condition inside a tag manager, a platform or app setting, or a click-to-load placeholder for a frame. Server-side integrations need their own enforcement because a browser runtime cannot stop them.
What breaks if it is refused: conversion attribution and remarketing audiences for the visitors who refused. No visitor-facing behaviour changes.
Verifying it
Before consent, there should be no request to doubleclick.net or to the /ads and /pagead paths, and no _gcl_ cookie. Watch for the conversion tag firing on a thank-you page specifically, which a homepage-only scan will miss.
- Before a choice: optional tracking endpoints and optional identifiers are absent; any intentionally loaded necessary or functional surface matches the control model described above
- After rejecting optional categories: optional activity remains absent and the refusal persists across a reload
- After granting the relevant category: the expected loader or embed appears and the feature behaves normally
- After withdrawing: new optional activity stops; where the vendor supports a consent signal, verify that the signal is sent as well as checking network behavior
Common questions
Is a conversion tag exempt because it only fires after purchase?
Not merely because it fires after purchase. Timing does not change an advertising-attribution purpose, and an identifier may already have been set on arrival. A narrowly necessary checkout or security function requires its own purpose-specific analysis; ordinary advertising conversion attribution should not be described as exempt just because the event occurs on a thank-you page.
What is the test_cookie for?
DoubleClick writes it to check whether the browser accepts cookies at all. It is short-lived and carries no data of its own, but its presence before consent means the advertising script already ran.
Sources and verification
Verified on . Product-behaviour statements were checked against the current implementation and tests. The links below are the verification basis recorded for this article. They support the stated facts, not a legal conclusion for every site or configuration; recheck changing vendor behaviour before relying on it in production.
- Google: set up consent mode on websites
Vendor documentation
Checked
- Google: consent mode reference and consent types
Vendor documentation
Checked
- Google Analytics: 2026 data-control updates
Vendor documentation
Checked
- Google: how Google uses cookies
Vendor documentation
Checked
See what your own site is loading
A browser scan reports the requests and storage it observed during the sampled journey. Use configured workspace scans to compare the states and pages that matter to your implementation.