Consent unbundling in Ads APIs

What’s changing?
Starting the week of May 1 2025, we will roll out consent unbundling for OAuth user authentication to all Google Cloud projects which were created before 2019. If you own an application that uses an Ads-related API through a Google Cloud project created before 2019, you may need to update your application to handle unbundled user consent before May 1 2025.

Background
Consent unbundling for OAuth user authentication flow allows users to customize which specific OAuth scopes they want to authorize your application for, rather than an all-or-nothing approach. All the Google Cloud console projects created since 2019 have this feature turned on, whereas all the projects created before 2019 have this feature turned off.

The following screenshot shows the difference between an all-or-nothing consent prompt, and an unbundled consent prompt. Figure 1: All-or-nothing consent screen. Users aren’t allowed to choose from a list of OAuth scopes.

Figure 2: Unbundled consent screen. Users are allowed to choose from a list of OAuth scopes.

Who is affected by this change?
You will be affected by this change if ALL of the following conditions are met:

1. Your API application uses a Google Cloud Console project that was created before 2019.
2. Your application implements the OAuth 2.0 user consent flow – an authentication workflow where the user logs in with their Google account and grants one or more permissions that your application is requesting.
3. Your application uses more than one Google API, and one of the APIs is an Ads-related API listed below.

Who isn’t affected by this change?

• Existing refresh tokens: This change doesn’t affect user authentications that you already have in place. Your existing refresh tokens will continue to work without any changes or re-authentication.
• Single scope applications: If your application uses only one Google API scope, your application isn’t affected by this change, since there aren’t multiple OAuth scope to unbundle.
• Single user applications / Manually authenticated applications: Your application doesn’t have an explicit OAuth user authentication flow implemented. Instead, you use a manual authentication script such as GenerateUserCredentials, gcloud CLI or OAuth Playground to authenticate the user, and then use those credentials for a long period of time. Since you select all the scopes that your application requires while authenticating, your application isn’t affected by this change.
• Service accounts: If your application uses a service account to authenticate your API calls, you won’t be affected by this change

What do I need to do?
You need to ensure that your application can handle partial user consent. To do this,

1. Request the list of OAuth scopes that the user consented to by including the include_granted_scopes parameter in your OAuth flow.
2. Examine the actual list of OAuth scopes that the user consented in the OAuth response.
3. Implement incremental authorization in your application.

Review our OAuth granular consent guide to learn about the requirements and best practices to handle granular consent.

How do I test this feature?
There are two ways to test this feature:

1. Create a new Google Cloud project: New Google Cloud projects have enabled OAuth consent unbundling. So you can create a new Google Cloud project, and use it for testing your application.
2. Enable consent unbundling in your existing project: You can set the enable_granular_consent parameter to true in your OAuth authorization request.

Which API scopes are affected?
The following APIs related to Ads are affected by this change.

API	OAuth Scope
Google Ads API	https://adwords.google.com/api/adwords
Google Ad Manager API (SOAP API, Beta)	https://www.googleapis.com/auth/dfp https://www.googleapis.com/auth/admanager
Bid Manager API	https://www.googleapis.com/auth/doubleclickbidmanager
Content API for Shopping	https://www.googleapis.com/auth/content
Display and Video 360 API	https://www.googleapis.com/auth/display-video-mediaplanning https://www.googleapis.com/auth/display-video-user-management
AdMob API	https://www.googleapis.com/auth/admob.report https://www.googleapis.com/auth/admob.googlebidding.readwrite https://www.googleapis.com/auth/admob.monetization
AdSense for Platforms API	https://www.googleapis.com/auth/adsensehost https://www.googleapis.com/auth/adsense https://www.googleapis.com/auth/adsense.readonly
Google Analytics API	https://www.googleapis.com/auth/analytics https://www.googleapis.com/auth/analytics.readonly https://www.googleapis.com/auth/analytics.edit https://www.googleapis.com/auth/analytics.manage.users https://www.googleapis.com/auth/analytics.manage.users.readonly https://www.googleapis.com/auth/analytics.provision https://www.googleapis.com/auth/analytics.user.deletion
Campaign Manager 360 API	https://www.googleapis.com/auth/ddmconversions https://www.googleapis.com/auth/dfareporting https://www.googleapis.com/auth/dfatrafficking
Search Ads 360 API	https://www.googleapis.com/auth/doubleclicksearch
Google Tag Manager API	https://www.googleapis.com/auth/tagmanager.delete.containers https://www.googleapis.com/auth/tagmanager.edit.containers https://www.googleapis.com/auth/tagmanager.edit.containerversions https://www.googleapis.com/auth/tagmanager.manage.accounts https://www.googleapis.com/auth/tagmanager.manage.users https://www.googleapis.com/auth/tagmanager.publish https://www.googleapis.com/auth/tagmanager.readonly
Real time bidding API	https://www.googleapis.com/auth/realtime-bidding
Authorized Buyers Marketplace API	https://www.googleapis.com/auth/authorized-buyers-marketplace https://www.googleapis.com/auth/adexchange.buyer

How to get help
If you have any questions or need help, reach out to your respective API’s support team with your questions.
 - Anash P. Oommen, Google Ads API Team