Guide · June 17, 2026
How to handle PDPL cookie consent on Google Sites/Blogger
Guide to PDPL cookie consent on Google Sites/Blogger: code limits, AdSense, correct setup and deployment tips.
Quick answer
What is PDPL cookie consent for Google Sites/Blogger?
This is how to implement cookie notices and obtain consent on websites built with Google Sites or Blogger so they comply with the Personal Data Protection Law (Law 91/2025/QH15). With these two platforms, the issue is not only “whether there is a banner,” but also where to place scripts, how to block non-essential cookies in advance, and how to record consent to prove it when needed.
The key point is: cookies for basic operation can differ from cookies for tracking, measurement, and advertising. Tools such as Google Analytics, Google Ads, AdSense, and social network pixels often entail obligations to clearly disclose purposes, types of data, data recipients, and to implement a consent mechanism in accordance with the rules.
Where are Google Sites and Blogger challenging for cookie consent?
Google Sites and Blogger are both user-friendly for the general public, but they are not ideal environments for attaching a “full” consent solution like self-hosted CMSs.
In practice, you often face three constraints:
- Hard to inject custom JavaScript in all locations.
- Hard to “pre-block” third-party scripts in a granular way.
- Hard to store consent status in your own system without a backend.
If you only paste a banner but still let AdSense, analytics, or pixels run as soon as the page loads, that is not a good consent design for compliance. Under the rules, you need to revisit the script loading flow, not just the displayed interface.
| Situation | Common issue | Practical approach | |
|---|---|---|---|
| Google Sites with embedded script | Third-party script runs early | Only embed after the user agrees, or use the tool’s data-restricted mode per its configuration | |
| Blogger with a custom theme | Hard to manage multiple scripts | Split scripts into groups: necessary, analytics, advertising; only enable non-essential groups after consent | |
| Using AdSense | Personalized ads may set cookies | Clearly disclose advertising purposes, allow opting out, and check Google’s consent settings | |
| No backend | Hard to store evidence of consent | Use an external consent tool with logs, or store state in the browser with a minimal event log |
How to implement cookie consent on Google Sites/Blogger?
You should take a minimalist approach but with proof.
Audit all cookies/scripts:
List which are essential and which serve analytics/advertising/personalization. On Google Sites/Blogger, don’t just look at the banner; check embeds, themes, widgets, and any added code.
Group purposes clearly:
Split at least into necessary, analytics, and advertising. Each group needs a short, easy-to-understand description.
Pre-block non-essential scripts:
If possible, do not let analytics/AdSense/pixels run before the user chooses. If the platform is limited, prefer configuring “consent mode” or only load scripts after user interaction.
Display an appropriate banner/center notice:
The content should clearly state what you use cookies for, which third parties receive data, and that users can refuse or change their choices.
Store evidence of consent:
Record the time, choices, and notice version. If you lack a backend, use an external tool or a minimal logging mechanism to support compliance checks.
Update when adding AdSense or new trackers:
Each time you add a script, re-check the processing purposes and the notice content. Don’t assume the old banner will always suffice.
What should you watch for with AdSense on Google Sites/Blogger?
Yes. AdSense is often overlooked because many think “this is just advertising.” In reality, advertising often involves cookies, device identifiers, measuring ad performance, and may entail sharing data with third parties.
A safer approach is to:
- State clearly in the cookie notice that the website serves ads.
- If ads are personalized, you must inform users and provide appropriate choices under the rules.
- Do not enable ad scripts before there is a clear mechanism for consent/refusal, if your configuration allows it.
- Check Google’s current documentation and settings because implementation details may change.
With Google Sites, because you have limited control, consider using only components that can be minimally configured, and note in your cookie policy that some third-party cookies are set by the service provider.
Short cookie consent copy for Google Sites/Blogger
You can use this snippet as a starting point and then adjust to your actual implementation:
We use cookies and similar technologies to operate the website, measure traffic, and display ads. You can accept, refuse, or change your choices for non-essential cookies. Some cookies are set by third parties such as analytics tools and ad providers under their policies.
If you want a more rigorous implementation, add:
- A list of each provider.
- Cookie retention periods.
- How to withdraw consent.
- Contact for personal data requests (DSAR).
When should you review the entire implementation?
Review immediately when you:
- Add Google Analytics, Tag Manager, AdSense, or a new pixel.
- Change a Blogger theme or embed an external iframe.
- Move from an informational site to one with forms, remarketing, or conversion tracking.
- Receive feedback that the banner cannot be refused or trackers still run after refusal.
Under the Personal Data Protection Law (Law 91/2025/QH15), serious violations may be handled criminally; specific administrative fines will be set by the guiding decree. If your website has real traffic, uses real trackers, and handles real data, implement early rather than waiting until you are asked to fix it.
- If your website uses cookies or similar technologies for analytics, advertising, or tracking, you must provide clear notice and design a consent mechanism under the rules, especially for non-essential trackers.
- A banner is only one part. More important is whether scripts run before the user chooses, and whether you can store evidence of consent.
- Review advertising purposes, describe the cookies/third parties, and check settings to avoid enabling personalization or non-essential scripts before consent, as required.
- You can use an external consent tool with logs, or a minimal client-side state with timestamp and notice version. If the model is complex, consult a lawyer.
If you’re using a consent banner for a static site, also check how you store evidence of consent and your DSAR process so you won’t have to rework everything when traffic grows.
Source: the Personal Data Protection Law (Law 91/2025/QH15): https://thuvienphapluat.vn ; Decree 13/2023/ND-CP: https://thuvienphapluat.vn ; Ministry of Public Security (A05): https://bocongan.gov.vn
Get started — set up in 5 minutes.
Need help with PDPL compliance?