Privacy policy for Google AdSense: what publishers actually have to disclose

Most publishers meet the AdSense privacy-policy requirement by pasting in a generic template and moving on, assuming the box is checked. It usually isn't — not because the template is wrong, but because it's generic, and Google's requirement is specific. Google tells you, in its own program policies, roughly what your disclosure has to contain. And separately, for anyone with European traffic, there's a consent requirement that a privacy policy doesn't satisfy on its own — one that directly affects how much ad revenue you actually collect. This guide covers both, using Google's actual language.

Does AdSense require a privacy policy? (Yes — and here's the wording)

This one isn't optional or ambiguous. Google's AdSense program policies state it plainly:

So the requirement isn't just "have a privacy policy." It's "have one that specifically discloses the ad-serving cookies and web beacons." A privacy policy that talks about your contact form and newsletter but never mentions that third-party ad cookies are being placed doesn't actually meet Google's requirement — even though it's a real privacy policy.

Why this matters for AdSense approval — and staying approved

For a lot of publishers, this question comes up at the worst time: during the AdSense application. Google reviews your site before approving you, and a missing or inadequate privacy policy is one of the more common reasons applications get held up or rejected. So the privacy policy isn't just an ongoing obligation — it's often a gate to getting approved in the first place.

And it doesn't stop at approval. The AdSense terms require you to have and abide by a compliant privacy policy for as long as you run ads. Google can review your site at any time, and a policy that's missing the required ad-cookie disclosures — or that describes practices your site doesn't follow — puts your account at risk, not just your first approval. The practical takeaway: treat the privacy policy as something to get genuinely right before you apply, and to keep right afterward, not a formality you bolt on to pass review.

Exactly what your AdSense privacy policy must disclose

Pulling Google's requirements together, here's the concrete checklist. Your policy needs to cover each of these:

The part templates get wrong: your vendors

Here's where a generic AdSense privacy policy quietly falls short of Google's requirement. Point 3 above asks you to disclose the third-party vendors and ad networks actually serving ads on your site — and that list is specific to you. If you run AdSense alongside other ad networks, header bidding partners, or analytics that feed advertising, each is a third party your policy is supposed to name. A template can't know which networks you use; it describes a generic publisher.

This is the same accuracy problem that affects any privacy policy, but it bites harder for publishers because the whole point of the disclosure is naming the ad tech. A policy that says "we may use third-party ad vendors" without listing the ones actually on your pages is thinner than Google's requirement asks for — and it's the kind of gap that's trivial to spot, because anyone (including Google's reviewers) can load your site and see which ad networks fire.

The EU requirement that costs you revenue if you miss it

For publishers with European traffic — and if you have any global audience, that's you — there's a second requirement that a privacy policy alone doesn't satisfy, and this one hits your wallet directly. In the EEA and UK, non-essential ad cookies generally can't fire until the visitor gives affirmative consent, collected through a Google-certified consent management platform. Disclosure in your policy is necessary but not sufficient: you also need a working consent banner that actually gates the cookies.

What makes this a revenue issue, not just a compliance one, is what happens when you get it wrong:

So the consent setup isn't a compliance tax that eats your revenue — done right, it's what protects it. A valid consent signal is what keeps Google serving your high-value personalised ads. A broken or missing one silently downgrades your inventory to limited ads and quietly halves EEA earnings. This is why publishers who treat consent as an afterthought often can't figure out why their European RPMs cratered.

Your options when a user declines consent

When an EEA visitor doesn't consent to ad cookies, you're not simply stuck with nothing — Google gives publishers a few ways to keep earning something while respecting the choice. It's worth knowing them, because the difference between them is real money:

• Non-personalised ads (NPA). When no personalisation consent is given, AdSense can serve contextual ads only, without persistent tracking cookies. It earns less than personalised ads but more than nothing — and it keeps you serving to users who declined. Note it's not fully cookieless: AdSense still contacts Google's servers.
• Google Consent Mode v2. A framework where AdSense adjusts its behaviour based on the consent signals your banner passes. With consent denied, Google can still model conversions from aggregated, anonymised data — recovering some measurement without setting tracking cookies.
• Full blocking. The strictest approach: non-essential ad tech simply doesn't load until consent. Highest privacy footprint reduction; you serve personalised ads only to those who opt in.

None of these removes the need for the two fundamentals — an accurate disclosure and a real consent banner. They're just different ways of handling the "user said no" case. But they underline the same point: your consent setup isn't a single on/off switch, it's the machinery that decides how much of your EEA traffic you can still monetise, and how. Configuring it well is a revenue decision as much as a compliance one.

The honest picture: disclosure + real consent

Put the two halves together and the honest requirement for an AdSense publisher is clearer than "get a privacy policy." It's two things that have to both be true:

• An accurate disclosure — a privacy policy that actually names the ad vendors serving on your site and covers Google's required points, not a generic template.
• Real consent behaviour — for EEA/UK visitors, ad cookies that genuinely wait for consent, gated by a working banner, so the disclosure isn't describing something your site doesn't actually do.

How to put it together

The practical sequence for an AdSense publisher, in order:

• Find your real ad vendors. Scan your live site to see which ad networks and trackers actually fire, so your disclosure lists the real ones.
• Build the policy from that — covering Google's required points plus your standard privacy-policy content, with the actual vendor list and opt-out routes. A policy built from a real scan gets the vendor list right by construction.
• Add a proper consent banner for EEA/UK visitors, on a Google-certified CMP using the current TCF version, that actually blocks non-essential ad cookies until consent — so your personalised ads keep serving and your disclosure stays true.
• Keep it current. Add or drop an ad partner and both your disclosure and your consent setup need to keep pace — ad stacks change often.

Disclaimer: This article is general information, not legal advice, and does not create an attorney–client relationship. Google's AdSense requirements and program policies change over time; verify current requirements in Google's official AdSense Help Center. ConsentPixel — Privacy · Verified is not a law firm and is independent of and not affiliated with Google ("Google," "AdSense" and "DoubleClick" are trademarks of their respective owner). Generating a privacy policy or configuring consent does not by itself make your site compliant with any law or program policy. Consult qualified counsel for your specific situation.