We decided to try Google Ads
The site had almost no search clicks. A reasonable next step is to buy visibility rather than wait for it. So we started looking at what it takes to set up advertising properly — and the first thing it takes is measurement. Without measurement you never learn which ad did something, only what it cost.
Our own privacy policy said no
Measurement happens through an advertising tag. The tag sets cookies. And when we read our own privacy policy, there it was in plain words: that we do not use cookies for advertising purposes.
So the text was not a formality in the footer. It was a promise, and that promise stood in the way of what we were about to do. It is an uncomfortable discovery, because the easiest way out is also the worst one.
Two ways out — only one of them honest
We had two options, and they are worth writing down because the choice between them says everything:
- Quietly rewrite the text. Drop the sentence, add the tag, move on. Nobody notices, and the site starts measuring visitors who were never asked.
- Build a gate. Rewrite the text so that it becomes true, and make sure nothing loads until the visitor has actually said yes.
We chose the second one. It took longer, and it is the only one of the two where the text and the code say the same thing afterwards.
What the gate actually does
No advertising tag loads when the page opens. The script sits there, but it fetches nothing and sets nothing until consent exists. If the visitor says no, nothing at all happens — not a quiet downgrade, but no loading.
We also made it inert by default: as long as the ad ID is empty, the advertising tag itself never loads, even if someone answers yes. That way a half-finished configuration cannot start measuring by accident.
Not a single ad has run yet
This is where things stand as this is written: the gate is built, reviewed in four rounds, exercised by 83 automated tests and live on the site. The ad ID is still empty. So we are not advertising yet — we have only made sure that we can, without breaking a promise.
Check your own site
- Read your privacy policy and find the sentence about cookies and advertising. What does it promise?
- Then open the site and look at what actually loads before you have clicked anything. Do that on our site and you will find fonts served by Google — they load without consent, and they are declared in our privacy policy. The point is not that such a request may never exist, but that it has to be written down.
- If the two say different things, it is not the text that is wrong or the code that is wrong — it is that nobody compared them.
Why this is worth its own piece
Because this is a fault that no check will raise. A cookie script works exactly as well no matter what the privacy policy says, and the privacy policy does not turn red because the code contradicts it. There is no warning light between them.
We found it on our own site, in the same week we were about to start advertising. That is why we are writing about it.