Google Introduces Consent Unbundling for OAuth in Ads APIs Starting May 2025

Starting the week of May 1, 2025, Google will implement consent unbundling for OAuth user authentication across all Google Cloud projects created before 2019. Applications utilizing Ads-related APIs through these older projects must be updated to accommodate this change.

Consent unbundling allows users to select specific OAuth scopes for authorization, moving away from the previous all-or-nothing model. Projects created since 2019 already have this feature enabled, while older projects do not.

Who is Affected?

The change impacts applications that meet all the following criteria:

• Use a Google Cloud Console project created before 2019.
• Implement the OAuth 2.0 user consent flow.
• Utilize multiple Google APIs, including at least one Ads-related API.

Who Isn’t Affected?

• Existing refresh tokens: Current user authentications remain unchanged.
• Single scope applications: Applications using only one Google API scope are unaffected.
• Single user applications: Applications using manual authentication scripts are not impacted.
• Service accounts: Applications using service accounts for API calls will not be affected.

Required Actions

To prepare for this change:

• Request the list of OAuth scopes consented by users using the include_granted_scopes parameter.
• Review the OAuth response for the actual scopes consented.
• Implement incremental authorization in your application.
• Consult the OAuth granular consent guide for best practices.

Testing the Feature

Testing can be done in two ways:

1. Create a new Google Cloud project: New projects have consent unbundling enabled.
2. Enable consent unbundling in existing projects: Set the enable_granular_consent parameter to true in your OAuth authorization request.

Affected API Scopes

The following Ads-related APIs are impacted:

• Google Ads API: https://adwords.google.com/api/adwords
• Google Ad Manager API: https://www.googleapis.com/auth/dfp, https://www.googleapis.com/auth/admanager
• Bid Manager API: https://www.googleapis.com/auth/doubleclickbidmanager
• Content API for Shopping: https://www.googleapis.com/auth/content
• Display and Video 360 API: https://www.googleapis.com/auth/display-video-mediaplanning, https://www.googleapis.com/auth/display-video-user-management
• AdMob API: Multiple scopes including https://www.googleapis.com/auth/admob.report
• AdSense for Platforms API: Multiple scopes including https://www.googleapis.com/auth/adsense
• Google Analytics API: Multiple scopes including https://www.googleapis.com/auth/analytics
• Campaign Manager 360 API: Multiple scopes including https://www.googleapis.com/auth/ddmconversions
• Search Ads 360 API: https://www.googleapis.com/auth/doubleclicksearch
• Google Tag Manager API: Multiple scopes including https://www.googleapis.com/auth/tagmanager.manage.accounts
• Real time bidding API: https://www.googleapis.com/auth/realtime-bidding
• Authorized Buyers Marketplace API: Multiple scopes including https://www.googleapis.com/auth/authorized-buyers-marketplace