Compliant tracking that still reports the truth.

It is a way for your site to tell Google tags what the user agreed to, before and after they choose. You set a default consent state when the page loads, then send an update once the banner is answered, and each tag behaves accordingly. As Google's documentation puts it, when ad_storage is denied no new advertising cookies are set, and third-party cookies on google.com and doubleclick.net are not used except for spam and fraud purposes. In advanced mode the tags still send cookieless pings, which is what allows modelling later; in basic mode they do not fire at all until consent is granted.

Usually because you stopped seeing some conversions rather than stopping them from happening — and because declined users genuinely convert less. Google Ads notes that consented users are typically 2-5x more likely to convert than unconsented users, so the visible drop overstates the commercial one but is not purely a reporting artefact. The way out is to establish how much is measurement loss (by comparing against your own sales records), recover signal through advanced mode, modelling and server-side collection, and rebaseline the reports at the switch-over date so the step is labelled instead of debated.

Advanced, unless your legal position rules it out. In advanced mode tags load and send cookieless pings when consent is denied, which preserves aggregate signal and makes modelling possible; Analytics can then model the behaviour of users who decline analytics cookies. In basic mode nothing fires until consent is granted, so you get a cleaner story for a cautious counsel and a larger blind spot in your data. Some organisations must choose basic, and that is a legitimate call — what matters is that the choice is deliberate, documented, and that everyone knows which numbers it affects.

Yes, and there is real headroom. Commanders Act's 2025 barometer of more than 1,300 banners found an average consent rate of 78.06%, so a rate far below that usually points at design rather than audience. The levers that are both effective and lawful are plain language instead of legal boilerplate, honest category names, a visible and genuinely equal reject option, sensible timing and placement, and a short explanation of the exchange. What we will not do is bury the reject path or pre-tick categories: invalid consent is worse than low consent.

No, and this is the gap that creates most exposure. Consent mode governs Google tags; a chat widget, heatmap tool, affiliate script or an old remarketing pixel will keep firing unless someone stops it. We inventory every tag, cookie and third-party request on the site, assign each a category, and add explicit consent checks in Google Tag Manager so nothing runs without permission. Then monitoring flags anything new that appears, because the most common cause of a compliant site becoming non-compliant is a well-meaning marketer adding one script.

Four things, in order of value. Advanced consent mode so denied traffic still contributes cookieless signal and modelling can run. Server-side tagging for the conversions that matter, so the events that fund your budget do not depend on a browser. Enhanced conversions and CRM or offline imports where consent allows, so the ad platforms optimise toward real revenue. And blended reporting against your own sales data, so a fall in cookie-visible traffic is never mistaken for a fall in demand. Not one part of that requires collecting anything the user refused.

The site owner, which is why we build to evidence. Enforcement is real: the CNIL reported EUR 486,839,500 in fines during 2025 with cookies among the main subjects, and the CMS tracker puts cumulative GDPR fines at around EUR 5.65 billion. Our part is the implementation and the proof of it — a documented cookie inventory, a test log across every consent state, and a change log for the container. Your counsel sets the legal position; we make the site match it and give them the evidence pack they will ask for.

Yes, and it is the normal case. Consent defaults are set per region, so a visitor from the EEA or the UK gets a denied default and a banner, while regions with different requirements get the appropriate state — all from the same container, with the logic documented rather than hidden in a custom script. US state privacy laws, opt-out signals and sector rules are handled the same way. The important discipline is testing each region's path explicitly, because a region-specific default that was never verified is the most common silent failure we find.

For most sites the audit takes a few days, the wiring and testing two to three weeks, and server-side work follows as a second phase. We price it as a fixed-scope project — audit, implementation, banner work, documentation and test log — so you approve a number rather than an open-ended engagement, with optional ongoing governance if you want the container monitored. Complex cases are honest about themselves: many regions, several domains, a custom CMP or a heavily customised container all add days, and we will say so before quoting.

That is the arrangement we prefer. Your counsel decides the legal position, your developers own the site, and we own the measurement layer between them: the container, the consent wiring, the server-side endpoints and the documentation that lets both sides check our work. Everything is version-controlled and written in language a non-specialist can follow. Where you also want the reporting rebuilt afterwards, our analytics and server-side teams pick it up directly.