Configuring Google AdSense Privacy Messages for WordPress: A Practical Test of GDPR, US State Laws, and CMP Options

As my blog gradually integrates Google AdSense and I begin building an independent English site, the privacy choices of overseas users have become an issue I need to address, alongside ad display and revenue optimization.

The Google AdSense backend provides a “Privacy & messaging” feature that can display appropriate privacy messages to users in the European Economic Area, the UK, Switzerland, and certain US states.

This feature appears to be just a few toggles, but during the actual configuration process, I navigated numerous twists and turns involving Google CMP, “future sites,” the privacy policy URL, multilingual messages, and the “Do not consent” button.

This article documents this practical configuration process and the functional boundaries I ultimately confirmed.

1. Why AdSense Privacy Messages Need to Be Configured

When serving personalized ads in the European Economic Area, the UK, and Switzerland, Google AdSense requires collecting user choices through a compliant Consent Management Platform (CMP).

These choices primarily involve:

• Whether to allow the use of cookies or other local storage;
• Whether to allow the processing of personal data;
• Whether to accept personalized ads;
• Whether to allow ad performance measurement;
• Whether to allow advertising partners to use relevant data.

The “Privacy & messaging” feature of Google AdSense can handle:

• Displaying user consent messages;
• Providing consent, non-consent, and management options;
• Saving and transmitting user choices;
• Applying corresponding messages based on the user’s region.

Google requires the use of a certified CMP integrated with IAB TCF when serving personalized ads to users in the European Economic Area, the UK, and Switzerland.

2. My Website Counts as a Single Site in AdSense

Currently, the blog uses the following domains:

• Chinese site: www.shuijingwanwq.com
• English site: en.shuijingwanwq.com

Although they are two different hostnames, in the AdSense “Sites” list, the actual managed site is:

shuijingwanwq.com

shuijingwanwq.com

AdSense no longer allows standard subdomains to be added and managed as separate sites. As long as the root domain has been approved, ad code can still be deployed on the corresponding subdomains.

Therefore, if I add the following in the future:

ja.shuijingwanwq.com
de.shuijingwanwq.com

ja.shuijingwanwq.com
de.shuijingwanwq.com

They will still belong to the site shuijingwanwq.com, rather than being two new independent sites in AdSense.

At that point, the main tasks will be:

• Adding Japanese or German to the existing European regulations message;
• Ensuring the corresponding language pages load properly;
• Updating the existing privacy policy as needed.

Adding a standard language subdomain will not automatically create a new European regulations message.

3. The Most Misunderstood “Future Sites” Option

On the “Settings” page for European regulations, you can see the following option:

Use Google’s CMP to create a message with 3 options (“Consent”, “Do not consent”, and “Manage options”) for my future sites.

Initially, I interpreted this as:

• Creating the European regulations message myself;
• Using Google CMP to automatically create the message;

Assuming the two were mutually exclusive.

Consequently, I briefly thought that simply checking this option would allow me to delete the currently created European regulations message and even eliminate the need to maintain my own privacy policy page.

This understanding was incorrect.

Official Google documentation states: After adding a new site in AdSense and selecting Google CMP, Google will automatically create a European regulations message for this new site and any future sites added. The automatically created message uses default message settings, which can still be modified later under “Privacy & messaging”.

“Future sites” here refers to independent sites added to the AdSense “Sites” list later, such as:

example-a.com
example-b.com

example-a.com
example-b.com

It does not include new standard language subdomains under the same root domain.

4. This Option Cannot Replace the Privacy Policy Page

Even if you choose to let Google CMP automatically create European regulations messages for newly added sites, the website still needs to provide its own privacy policy URL.

Google CMP is responsible for:

• The privacy message pop-up;
• Consent and rejection actions;
• User choice management;
• Signal transmission to the advertising system.

The website privacy policy is responsible for:

• What data the website collects;
• Why this data is processed;
• Which cookies are used;
• Whether Google AdSense is used;
• With which third parties data may be shared;
• How users can manage their privacy choices.

Google does not know the URL of a new site’s privacy policy page, nor can it describe the actual data processing practices on behalf of the site owner.

AdSense official documentation also explicitly states that the privacy policy URL will be displayed in the “Learn more” section of the European regulations message. After adding or modifying this URL for a site, AdSense will update existing messages and automatically include it in new messages created for that site in the future.

Therefore, I ultimately retained the English privacy policy page:

https://en.shuijingwanwq.com/privacy-policy/

https://en.shuijingwanwq.com/privacy-policy/

5. An Unnecessary Deletion and Recreation

Because I initially understood “automatically create messages for future sites” and the current European regulations message as two mutually exclusive options, I deleted the existing European regulations message.

Only after deleting it did I confirm that:

• The “future sites” setting does not restore the message for the currently existing shuijingwanwq.com;
• The current site still requires a valid European regulations message;
• Manually creating a message in AdSense also uses the built-in Google AdSense CMP, rather than requiring me to develop my own privacy system.

Consequently, I recreated the European regulations message.

The message name was set to:

Shuijingwanwq GDPR European Regulations Message 2026

Shuijingwanwq GDPR European Regulations Message 2026

This name is only used for identification in the AdSense backend and will not be displayed to site visitors.

6. Site, Logo, and Privacy Policy URL

When creating the European regulations message, the selected site was:

shuijingwanwq.com

shuijingwanwq.com

The privacy policy URL uses the English site page:

https://en.shuijingwanwq.com/privacy-policy/

https://en.shuijingwanwq.com/privacy-policy/

At the same time, I reprocessed and uploaded a horizontal logo suitable for AdSense messages.

Google requires uploaded images to be:

• PNG or JPG;
• No larger than 150 KB;
• With a recommended aspect ratio of 5:1.

In the final message preview, both the logo and site name displayed correctly.

7. Language Settings for the European Regulations Message

The default language for the European regulations message is set to:

English (en)

English (en)

Additionally, I added under “Other languages”:

Chinese (China) (zh-CN)

Chinese (China) (zh-CN)

The reasons for this configuration are:

• The English site primarily targets overseas users;
• European users might also visit the Chinese site;
• If the user’s device language is Chinese, the message can display the Chinese version;
• If the device language cannot be recognized or no matching additional language is found, the default English is used.

Official Google documentation notes that additional languages are matched based on the user’s device language, and the selected languages should correspond to the actual languages provided by the site.

8. The European Regulations Message Has Four Related Settings

There are a total of four related settings for user options within the European regulations message:

1. Consent

Allows users to accept relevant data processing, advertising partners, and their purposes.

Current status:

On

On

2. Manage options

Allows users to enter a more detailed settings page to manage different purposes and advertising partners individually.

Current status:

On

On

3. Do not consent

Provides users with an explicit rejection button directly on the message homepage.

Current status:

On

On

4. Close (Do not consent)

Adds a close icon to the message.

When users click the close icon, it does not merely close the pop-up; it also signifies refusal to consent to advertising partners and their purposes.

Current status:

Off

Off

The final message homepage displays three explicit entry points:

Do not consent
Consent
Manage options

Do not consent
Consent
Manage options

I did not enable “Close (Do not consent)” because since an explicit “Do not consent” button is already provided, there is no need to express the same choice via a close icon in the top right corner.

9. Why I Insisted on Displaying the “Do not consent” Button

Google explicitly warns on the settings page:

Showing the do not consent option in the message may lower the consent rate.

This means that after some users choose not to consent:

• Personalized ads may not be displayed;
• Ad demand eligible for bidding may decrease;
• Ad revenue may decline.

However, I ultimately still chose to enable it.

The reason is not complicated:

Even if ad revenue drops, I want to give users a clear, direct choice.

The main value of the site comes from:

• Technical articles;
• WordPress practices;
• PHP and server operations;
• AI translation and content engineering;
• CDN, caching, and website performance experience.

Advertising is only one part of the site’s monetization, and I should not deliberately obscure the user’s rejection option just to improve the consent rate.

10. The “Do not consent” Button Supports Bulk Settings and Per-Country Adjustments

When configuring the “Do not consent” button, I initially thought I had to enable it for each country individually.

After testing, I found that:

1. Using the master toggle at the top of the list, you can bulk enable all listed applicable countries or regions;
2. After bulk enabling, you can still turn off individual countries;
3. Therefore, it supports both unified settings and per-country exceptions.

Official Google documentation also explicitly states that after enabling “Do not consent”, you can specify in which countries or regions the button will be displayed.

So the accurate understanding should be:

You can first bulk set the default state, and then make individual adjustments based on the needs of different countries or regions.

I ultimately kept the “Do not consent” button enabled for all listed applicable countries.

11. US State-Level Regulations Messages Are Not Exactly the Same as European Messages

In addition to the European GDPR, AdSense also provides US state-level regulations messages.

The message name was set to:

Shuijingwanwq US State-Level Regulations Message 2026

Shuijingwanwq US State-Level Regulations Message 2026

The US state-level message primarily provides users with:

Do Not Sell or Share My Personal Information

Do Not Sell or Share My Personal Information

That is, an entry point to refuse the sale or sharing of personal information.

Its editing interface differs from the European regulations message:

• It lacks the complete three-option structure found in the European message;
• The primary user option is “Reject”;
• The default language is English (US);
• No Chinese option is provided in the “Other languages” list.

Therefore, although I originally wanted to add a Chinese version for US users, the current AdSense interface does not support it, so I had to keep it in English (US).

12. Final Status of European and US Messages

The final configuration is as follows:

13. What This Configuration Really Clarified

During this configuration process, the most confusing part was not any single button, but rather the relationship between three different layers:

Built-in Google AdSense CMP

Responsible for displaying privacy messages, collecting user choices, and interacting with the advertising system.

“Create a message for future sites” Option

Only targets independent sites added to the AdSense site list in the future, automatically creating European regulations messages.

It will not create a new message just because a standard language subdomain is added, nor will it restore a currently deleted message.

Site Privacy Policy

Used to explain the site’s actual data processing practices and still needs to be maintained by the site operator.

The final structure can be summarized as:

Built-in Google AdSense CMP
+
Current site's European and US privacy message configuration
+
Site's self-maintained Privacy Policy page

Built-in Google AdSense CMP
+
Current site's European and US privacy message configuration
+
Site's self-maintained Privacy Policy page

The three are interrelated but cannot replace one another.

14. Summary

Configuring Google AdSense privacy messages is not simply a matter of enabling a cookie pop-up.

Individual site owners still need to clarify:

• What counts as a single site in AdSense;
• The relationship between the root domain and language subdomains;
• The scope of the Google CMP automatic creation feature;
• Who maintains the privacy policy page;
• What choices are available to users;
• In which countries the “Do not consent” button is displayed.

The final choices made this time were:

• Using the built-in Google AdSense CMP;
• Providing consent, do not consent, and manage options in the European message;
• Not using an ambiguous close icon to replace an explicit rejection button;
• Supporting both English and Chinese in the European message;
• Retaining the English Privacy Policy page;
• Keeping the US state-level regulations message in English (US);
• Prioritizing user choice even at the potential cost of some ad revenue.

For a personal technical blog, transparent, clear, and controllable privacy choices are more important than a short-term increase of a few percentage points in the consent rate.