Integrating with Google's Restricted Data Processing (RDP) for US Privacy Laws

This guide explains how to configure Google's Restricted Data Processing (RDP) to work with Osano for compliance with US state privacy laws like the CCPA/CPRA (California), CPA (Colorado), and others.

Overview

What is Restricted Data Processing (RDP)?

Restricted Data Processing is Google's mechanism to help website owners comply with US state privacy laws. When RDP is enabled for a user, Google is instructed to limit how it uses that user's data.

Specifically, Google will not:

• Add the user to remarketing or audience lists.

• Serve personalized advertising to that user.

This is the primary method for honoring a "Do Not Sell/Share My Personal Information" request within Google's ecosystem.

IMPORTANT: RDP vs. Google Consent Mode (GCM)

It is critical to understand that Restricted Data Processing (RDP) is separate from Google Consent Mode (GCM).

• Google Consent Mode (GCM) is designed for European privacy laws (GDPR). It manages consent for analytics and ad cookies using signals like analytics_storage and ad_storage.

• Restricted Data Processing (RDP) is designed for US state privacy laws (CCPA/CPRA). It manages data "selling" or "sharing" opt-outs using the restricted_data_processing signal.

While both are managed by Osano, they are distinct compliance frameworks.

The RDP Setting in Google Analytics 4

In your GA4 property settings (under Admin > Data Collection and Modification > Data Streams > [Your Stream] > Configure tag settings > Show More), you will find an option to "Turn on restricted data processing."

This global setting creates two different approaches for compliance.

Option 1: CHECKING the Box (Global RDP)

If you check this box, you are enabling RDP for all users Google identifies as being from the specified US states.

Pros

• Maximum Compliance (Safety Net): This is the most conservative and safest approach. It acts as a fallback, ensuring you are restricting data use for all users in these states, even if Osano somehow fails to send the correct signal.

• Simple Setup: This is a one-time, global setting that does not require dynamic signal configuration.

Cons

• Significant Data Loss: This is the major drawback. Users in California (for example) who fully consent to analytics and advertising will still be treated as if they opted out.

• No US-Based Remarketing: You will be unable to build any remarketing audiences from users in these states, harming your advertising performance even for consented users.

Option 2: Leaving the Box UNCHECKED (Dynamic RDP via Osano)

If you leave this box unchecked, you rely on Osano to dynamically send the RDP signal only for users who require it.

This is how it works:

1. A user from a relevant US state (e.g., California) visits your site.

2. Osano presents the appropriate compliance banner.

3. The user opts out by turning ON "Do Not Sell/Share" toggle or by broadcasting a Global Privacy Control (GPC) signal.

4. Osano detects this opt-out and automatically sends the restricted_data_processing: true signal to Google for that specific user.

If a user from California consents and does not opt-out, no RDP signal is sent, and you can use their data for analytics and advertising as permitted.

Pros

• Granular, Correct Compliance: You correctly honor opt-out requests on a per-user basis without over-restricting.

• Maximum Data Utility: You retain the full value of your analytics and advertising data from users who consent and do not opt out of "selling/sharing."

• Effective Ad Performance: You can continue to build remarketing lists and audience segments from consenting users in all US states, maximizing your ad spend.

Cons

• Relies on Correct Configuration: This method is entirely dependent on Osano being correctly configured to detect and send the opt-out signal.

Osano's Recommendation & How to Implement

While we cannot advise on what's best for your business, in most cases, Option 2 allows you to be fully compliant with US privacy laws while maintaining your site's data and marketing capabilities.

Implementation Steps:

Step 1: In Google Analytics 4

1. Navigate to your GA4 property settings.

2. Go to Admin > Data Streams > [Your Stream] > Configure tag settings > Show More.

3. Find the "Restricted data processing" section.

4. Ensure the box for "Turn on restricted data processing" is UNCHECKED.

5. Click Save.

Step 2: In Osano

1. Log in to your Osano account.

2. Navigate to Cookie Consent > Configurations > [Your Configuration].

3. Click the "Advanced Settings" tab within your configuration and note the "Frameworks" section.

4. Ensure the toggle for "Support Global Privacy Control (GPC)" is turned ON.

By enabling GPC support, Osano will automatically detect both GPC browser signals and clicks on your "Do Not Sell/Share" link, and then transmit the correct restricted_data_processing: true signal to Google.