Cookie consent that doesn't destroy your attribution data

The trade-off people think they're making

Add a consent banner and analytics numbers drop. Sessions fall, conversions fall, paid campaigns appear to stop working. The instinctive response is to make the banner as easy to accept as possible, or to quietly load tags before consent.

Both are mistakes. The second is a compliance problem; the first produces consent that isn't freely given, which in most European jurisdictions is not valid consent.

The useful framing: you're not choosing between compliance and data. You're choosing how much data you keep within compliance — and the gap between a well-built consent setup and a careless one is large.

What actually breaks

When someone declines, and your tags respect that:

• No analytics cookie, so no session or user identity
• No ad platform cookie, so no conversion attribution
• The visit is invisible to your analytics, or appears as an unattributed hit

Multiply by a declining share — real rates vary widely by market, sector and banner design — and reporting develops a large hole. Not evenly distributed, either: privacy-conscious audiences decline more, which biases what remains.

Consent Mode: the mechanism worth understanding

Google's Consent Mode changes tag behaviour based on consent state rather than blocking tags entirely.

Set defaults before any tag loads:

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){ dataLayer.push(arguments); }

  // Deny by default. Nothing measured until the visitor decides.
  gtag('consent', 'default', {
    ad_storage: 'denied',
    ad_user_data: 'denied',
    ad_personalization: 'denied',
    analytics_storage: 'denied',
    wait_for_update: 500,
  });
</script>

Then update when they choose:

function onAccept() {
  gtag('consent', 'update', {
    ad_storage: 'granted',
    ad_user_data: 'granted',
    ad_personalization: 'granted',
    analytics_storage: 'granted',
  });
}

The important part: with denied, Google's tags still send cookieless pings — no identifiers, no cross-session tracking, but enough for Google to model aggregate behaviour. You lose individual journeys and keep a modelled view of the whole.

That's meaningfully better than blocking tags outright, where you get nothing at all. It's also not a loophole: nothing identifying is stored, which is the point of the consent question.

wait_for_update: 500 gives your banner half a second to report a returning visitor's stored choice before tags act on defaults. Too short and returning visitors are treated as denied.

The banner is the biggest variable

Design affects acceptance more than any technical measure, and the line between "well-designed" and "manipulative" is one regulators actively police.

Legitimate and effective:

• Say plainly what you collect and why, in one sentence
• Equal visual weight for Accept and Reject
• One click to decline — not "Manage preferences" then six toggles then "Save"
• Ask at a sensible moment rather than covering the page before anyone knows what your site is

Not legitimate, and increasingly enforced:

• Reject hidden behind a settings screen
• Accept prominent and coloured, Reject grey text
• Pre-ticked non-essential categories
• Nag walls that re-prompt after a decline
• Cookie walls making the site unusable without consent

The blunt version: making Reject one click reduces acceptance and produces consent that survives scrutiny. Burying it inflates the number and creates a record that a regulator will read as invalid — which means the data collected under it is a liability, not an asset.

Server-side and first-party measurement

Where genuinely lost data can be recovered legitimately.

Server-side tagging moves tag execution to your own server. The browser sends one request to your domain; your server distributes to vendors. Benefits: fewer third-party scripts, less client-side weight, more control over what's shared. It does not remove the consent requirement — you still need permission for identifiers and personal data. It changes the mechanics, not the law.

First-party analytics — self-hosted or privacy-first tools that don't set cross-site identifiers. Under most European interpretations, genuinely anonymous first-party analytics can run without consent. Check with counsel for your jurisdiction rather than trusting a vendor's marketing page.

Modelled conversions. With Consent Mode active and enough volume, Google models the conversions it can't observe. That's an estimate, not a measurement, and it should be labelled as such in any report where someone might make a budget decision from it.

Reporting on incomplete data

The organisational half, and the part that's usually handled worst.

Say what changed and when. A step change in analytics on the day a banner launched is a measurement artefact, not a business collapse. Annotate it. Without that note, someone will compare year-on-year in six months and reach a wrong conclusion.

Report trends, not absolutes. If roughly a consistent share consents, week-on-week comparisons remain valid even though totals understate reality.

Track the consent rate itself. It's the denominator for everything else, and it moves when you change the banner.

Stop using analytics as the source of truth for revenue. Your billing system knows what you sold. Analytics tells you about behaviour among people who agreed to be measured. Conflating them is how teams end up "losing" revenue that was never lost.

A setup I'd defend

1. Consent Mode v2 with everything denied by default.
2. A banner with equal-weight Accept and Reject, one click each, plain language.
3. wait_for_update around 500ms so returning visitors aren't misclassified.
4. Essential cookies only before a decision — session, security, consent state itself.
5. Analytics and ad tags fired from the consent callback.
6. Server-side tagging if volume justifies the infrastructure.
7. Consent rate tracked as a first-class metric.
8. Annotations in analytics for every banner change.

That configuration keeps you defensible, keeps modelled data flowing, and gives you an honest denominator. What it won't do is give you the numbers you had before consent existed — and any vendor promising that is describing something you probably don't want to be doing.