Analytics and the consent problem

Measurement and privacy law meet at one point: whether you may store or read something on somebody's device before asking. The answer shapes what data you have, and it is more nuanced than either the compliance industry or the growth industry tends to admit.

Two different models, worldwide

Before the detail: the world divides roughly into consent-first and opt-out jurisdictions, and which you are in changes what your site has to do before measuring anything.

• Consent first. The EEA and the UK, and increasingly others. You may not store or read anything on a visitor's device without permission, with a narrow exception for what is strictly necessary. Measurement requires asking before it starts.
• Opt out. The United States, where state privacy laws generally let you collect by default and require you to offer a way to stop, together with disclosure of what you collect and, in several states, a recognised opt-out signal.
• Mixed and developing. Many other markets have data protection law modelled on one of the two, often with consent requirements closer to the first, so the safe default when you do not know is to ask.

The practical consequence for a small site with international visitors: either you ask everybody, which costs you some data and is simple, or you detect where somebody is and behave differently, which is more work and more to get wrong. Asking everybody is the usual right answer at this size.

The EEA and UK rule, in detail

The relevant provision is Article 5(3) of the ePrivacy Directive, which covers storing information on a user's device or accessing information already there. It is not limited to cookies: the EDPB's guidelines on its technical scope make clear it catches other storage and access techniques too.

Consent is required unless the storage is strictly necessary for a service the user explicitly requested. The important and widely misrepresented part is what counts as strictly necessary. The EDPB's technical scope guidelines explicitly do not analyse when the exemptions apply, pointing instead to earlier opinion for that, and its cookie banner taskforce reported finding controllers labelling things strictly necessary that do not meet the test.

So the honest position on analytics: it generally requires consent, the exemption is narrow and contested, some authorities have accepted a limited first-party aggregated audience-measurement case, and national supervisory authorities differ. If the answer matters to your business, read your own authority's guidance rather than a vendor's summary of it.

What you can measure without touching the device

More than people assume, and these numbers are complete rather than sampled.

• Server logs. Every request, with no consent question, because nothing is stored on the visitor's device. Crude, complete, and enough for traffic trends.
• Orders, enquiries and bookings. The things you actually care about are in your own systems, not in an analytics tool.
• Search Console data, which comes from the search engine rather than from the visitor's browser.
• Revenue, repeat rate and customer value, all of which live in your own records.
• Analytics products designed to work without device storage, which exist and trade some detail for completeness.

Notice that four of the five most useful numbers from the previous article are available without any of this. The thing consent mostly costs you is the behavioural detail in between, which is also the part least often acted on.

Doing it properly if you do use consent-based tools

1. 01Do not load the tag before the answer. A banner that appears while the tracking has already run is the most common implementation and it is worse than no banner, because it looks like compliance.
2. 02Make refusing as easy as accepting. The cookie banner taskforce has been explicit about designs that make one path harder.
3. 03Say what is actually set, in the privacy policy, and keep it current when you add something.
4. 04Give a way to change the answer later.
5. 05Record what you asked and what they chose, because the consent is the thing you would have to evidence.

None of this is legal advice, and the position is genuinely unsettled in places. Where the decision carries money or risk, take advice in your own jurisdiction.

Working with a partial picture

Once some visitors decline, your analytics is a sample rather than a census, and the sample is not random: people who refuse tracking differ from people who accept it. Three habits make the data usable anyway.

1. 01Use ratios rather than totals. If a third of visitors are missing but missing consistently, the proportion converting is still comparable month to month even though the counts are wrong.
2. 02Anchor to something complete. Your order count is complete. If analytics reports 60 orders and your records show 100, you know the coverage and can reason about the rest.
3. 03Stop quoting absolute figures to anybody, including yourself. A conversion rate measured over consenting visitors is not the site's conversion rate and should never be written down as though it were.

There is also a less obvious consequence worth knowing: if consent rates differ by country, device or traffic source, then comparisons between those segments are comparing differently sized samples. A channel can appear to convert better purely because more of its visitors accept tracking.

The honest conclusion is that consent-based analytics is good for direction and poor for measurement, and that the numbers which decide anything important should come from your own systems where possible.