Google Search

Overview

Google Programmable Search Engine (formerly Google Custom Search Engine) allows website operators to embed a Google-powered search experience scoped to their own content. Rather than building and maintaining a custom search index, sites delegate search functionality to Google's infrastructure, gaining access to Google's ranking algorithms and index coverage. The widget is commonly found on documentation sites, knowledge bases, and content-heavy portals.

What This Script Does

The Programmable Search Engine loads via cse.google.com/cse.js. When a visitor enters a query, the widget sends it to Google's search API scoped to the configured site or set of domains, then renders results inline on the page.

• Script loaded: cse.google.com/cse.js — renders the search box and results container within a designated div element
• Network requests: Search queries are sent to cse.google.com along with the site's search engine ID, query terms, and pagination parameters
• Cookies: The widget may set Google cookies including NID (6-month expiry, used for search settings and preferences) and 1P_JAR (1-month expiry, used for ad personalization if Google Ads integration is enabled on the search engine)
• Data transmitted: Search query text, referring page URL, browser user agent, and IP address are sent to Google's servers with each search request
• Local storage: The widget may store recent search queries and display preferences in the browser

The search results page can include Google Ads if the publisher has enabled search ads monetization, in which case additional advertising cookies and tracking pixels load.

Consent & Compliance

Google Programmable Search Engine falls under the functional consent category when used purely for site search. If search ads monetization is enabled, advertising components shift parts of the functionality into the marketing category.

Under GDPR and ePrivacy, the core search functionality can be argued under legitimate interest (Article 6(1)(f)) as it provides expected site functionality. However, the NID cookie set by Google is a persistent identifier used across Google services, complicating the legitimate interest argument. The ePrivacy Directive requires consent for non-essential cookies regardless of the legal basis for data processing.

Under CCPA/CPRA, search queries and associated identifiers transmitted to Google constitute personal information. If search ads are enabled, the data sharing with Google's ad network constitutes "sharing" for cross-context behavioral advertising.

Data transfers to Google's US servers are covered under the EU-US Data Privacy Framework.

Should You Block This Without Consent?

Conditional. If the Programmable Search Engine is used without search ads monetization, it serves a functional purpose and can load under functional consent or legitimate interest, though it still sets Google cookies. If search ads are enabled, the advertising components require marketing consent. Consider implementing a search placeholder that activates the full Google widget only after consent is granted, or use a self-hosted search index for sites where consent friction is a concern.