Consent & Privacy-first Tracking

Analyzing visits and orders usually requires the visitor’s consent. The banner is the smallest part of that. The harder part is that every connected service has to know the status and respect it, including the one somebody added through the tag manager six months ago.

We implement this technically and, where it fits, add privacy-friendly measurement methods. Legal advice is not part of it. What applies to a company in a specific case is for its data protection officer or legal counsel to decide, and we implement the result.

How to tell the implementation is off

It usually shows when you look at your own site once with the developer tools open. Tags fire as soon as the page loads, before any decision has been made. After consent is declined, cookies or requests to third parties still appear. New services have been added through the tag manager without anyone checking consent for them. Or the numbers dropped after the banner went live, and nobody can say by how much. If on top of that nobody knows which service collects which data, taking stock is the first step.

What the law covers here

Two sets of rules work together. The GDPR governs when personal data may be processed and lists consent as one possible basis. In Germany, section 25 of the TDDDG (the Telecommunications Digital Services Data Protection Act, called TTDSG until May 2024) governs storing and reading information on a device, such as cookies. This generally requires consent, unless the action is strictly necessary for a service the visitor expressly requested.

At EU level there are proposals to change the cookie rules, under discussion as part of the Digital Omnibus. As far as we know, how they turn out is still open. Until then the existing rules apply.

What has to happen after the click

The consent platform shows the banner, stores the decision and makes it available technically. Which one you choose is a matter of languages, hosting and how it connects to the tag manager. What counts is what happens next.

In regions where consent is required, every consent type is set to “denied” until the decision is in, even before the first measurement command. When the visitor decides, the new status goes straight to the tag manager and the tags. Every trigger is tied to the matching consent, including for services added later. If a visitor changes their mind, the tags have to follow the new status.

When data runs through a server of your own, the status has to arrive there as well. The server cannot replace consent. The technique is covered under server-side tracking.

Google Consent Mode

Consent Mode tells Google tags which consents are in place. Version 2 has four signals: ad_storage and analytics_storage control storing information, while ad_user_data and ad_personalization control the use of user data for advertising and personalization. The last two were added with the update in November 2023.

In Basic mode, Google tags stay blocked until a decision is made. A visitor who declines sends nothing to Google. In Advanced mode the tags load at once with the default “denied” and, on a refusal, send cookie-less signals with a timestamp, referrer and consent status that Google can use for modeling. Which mode fits is partly a legal question, which we settle with data protection and legal counsel.

Consent Mode has two limits. It does not store decisions, which stays the job of the consent platform. And it does not stop third-party services that do not come from Google.

Measuring when people do not consent

Some analytics tools are built for privacy-friendly measurement. Matomo, for example, can run without cookies, at the cost of accuracy for returning visitors. Others work without cookies from the start, using identifiers that change daily. Cookie-less does not automatically mean free of consent, though. The TDDDG covers any access to information on the device, the GDPR applies when personal data is processed, and supervisory authorities assess individual configurations differently in places. Whether a tool may run without consent is a matter of legal assessment for the specific case.

The lean variant still makes sense, for example for basic figures such as page views and sources. Detailed analysis across several pages remains tied to consent.

Whoever does not consent is missing from the detailed data. How large the gap is depends on audience, banner and site, but it can be measured: the consent rate shows how far the numbers can be trusted. Orders in the shop are complete even if the tracking has gaps. So we compare tracking data with the shop, CRM or accounting and see how far apart they are. Some vendors also estimate missing conversions with statistical models, which needs a minimum amount of data. Modeled figures do not replace measured ones, and in reports we mark what was measured and what was estimated.

Testing in the browser

A planned configuration does not guarantee a correct implementation. So we open the site in four states and look at what is actually sent. Before the decision, there must be no requests to third parties and no tracking cookies. After a refusal that stays the case, including on further pages. After consent the expected tags start with the right signals, and after a withdrawal they follow the new status again.

We repeat the tests whenever the website, the tag manager or the consent platform changes. We document data flows, settings, the services in use and the test results.