On many sites the cookie banner is decoration: the visitor clicks “Reject”, and Analytics and the advertising pixel carry on running, because they load before anyone has clicked anything. Other sites block everything, correctly, and find that their reports have emptied. Consent Mode, the mechanism by which Google adapts its tags to the visitor’s choice, is designed for the space between respecting consent and the need to measure.
A project like this has a technical part, which we do, and a legal part, which your company’s data protection officer confirms. We show which script starts and what it sends; what is permitted is for them to decide.
A cookie banner that really does block scripts
The first thing we check is what happens before any click: which cookies are written and which requests go out to other servers while the banner is on screen, traced with the browser’s developer tools. The result is often a surprise: tags placed directly in the theme, plugins that load their own scripts, embedded videos and maps with cookies of their own.
The fix is a consent management platform (CMP), such as Cookiebot, CookieYes or Complianz, connected to Google Tag Manager. It displays the banner, remembers the choice by category, keeps the proof of consent and gives the signal that decides whether tags fire or stay off.
- The inventory: all scripts, cookies and embedded content, with the purpose of each.
- Moving the tags into Tag Manager, so that none is left outside its control.
- Embedded content: videos and maps load after consent or on click.
- Withdrawing consent: the visitor can change their choice at any time, from a place that is easy to find.
Google’s Consent Mode: signals, not an exemption from consent
The mechanism is a set of signals that the site passes to Google’s tags: whether the tag may store analytics cookies or advertising cookies, and whether the data may be used for personalised ads. The banner updates the signals according to the visitor’s choice. For visitors from the European Economic Area, Google makes features such as remarketing lists conditional on them.
There are two ways of implementing it. In basic mode, Google’s tags do not load at all until consent is given. In advanced mode, they load and, if the visitor refuses, send cookieless signals, on the basis of which Google estimates what is missing. The second keeps more information, but lawyers do not all take the same view of signals sent without consent. The choice belongs to the data protection officer.
What data is lost and how it is estimated
Visitors who refuse disappear from the ordinary reports or appear without a source. What Google does, in advanced mode and if the site has enough traffic, is modelling: starting from the behaviour of those who accepted, it estimates the visits and conversions of the others and includes them in the reports. This is a calculation, not people counted.
Estimates help with seeing the direction and with automated bidding in ads. For the exact number of orders, the source of truth remains the store or the CRM. How much is lost also depends on the banner, but we do not design banners that hide the option to refuse: apart from the legal risk, consent obtained by a trick is not consent.
Server-side tagging, as an option
Normally the visitor’s browser sends data directly to each platform. With server-side tagging, the browser sends a single stream to a server that you manage, on a subdomain of the site, and that server passes it on. You gain control over what goes out, lighter pages and data less affected by blockers.
The server has to be hosted and maintained, so there is a monthly cost; for a small site it is rarely worth it. And, more importantly, moving to the server does not change your obligations: if the visitor has refused, their data is not sent by this route either. Anyone who presents it as a way round the banner is selling you a problem.
Documentation: what stays in writing after setup
A setup that is correct today breaks with the first plugin installed or the first campaign for which someone pastes a new pixel into the site. That is why we leave a register: each tag, what data it sends, to whom and which consent category it falls into. The cookie list in the policy published on the site is brought into line with it.
The banner copy, the categories and the form of the buttons are validated by the data protection officer. The authorities’ requirements and interpretations change, and a technical project is no substitute for legal advice. At handover you receive:
- The register of tags and cookies, with purpose and category.
- Screenshots from the tests carried out before and after consent, on desktop and on a phone.
- The procedure for a new tag: who approves it and which category it falls into.
Frequently asked questions
If I put up a proper banner, do I lose all my Analytics data?
Not all of it, but some; how much depends on how many visitors refuse. With consent signals configured, the reports can be filled out with estimates, and you have the real orders and enquiries in the store or the CRM in any case.
Is Consent Mode mandatory?
It is a Google requirement for certain advertising and measurement features for visitors from the European Economic Area, not a law. The legal obligation concerns consent for cookies and the processing of data, whatever the tool.
Can I use a free banner plugin for WordPress?
Sometimes, yes, if it actually blocks the scripts, passes on the consent signals and keeps proof of the choice. Many free plugins do only some of this.
This is a typical project description: it shows how we usually approach this kind of work and does not present a project carried out for a particular client. Every real project starts from your company’s situation, and the stages, timescales and price are agreed after the initial discussion.