Consent-first conversion tracking: how to measure your ads and stay on the right side of GDPR

The first thing Google Ads and Meta ask you to do after you create a campaign is to install a tag. The first thing a European data-protection authority asks when it audits a website is whether that tag loaded before the visitor consented. Small businesses sit between the two, usually with no lawyer and no developer, and often end up either tracking nothing (so they cannot tell which ad works) or tracking everything (so they are one complaint away from a fine).

This guide explains the rules in plain language, what has changed with Google's Consent Mode, and how a consent-first setup works when the platform running your app does it for you. It is general information, not legal advice; your own situation may need a professional.

What the law actually says

Two European rules apply, and people mix them up.

• The ePrivacy Directive (2002/58/EC), Article 5(3) covers storing or reading anything on the visitor's device: cookies, local storage, fingerprinting. It requires prior consent for anything that is not strictly necessary to provide the service the visitor asked for. An advertising pixel is never strictly necessary. Member states implement this in national law: in Germany it is §25 TDDDG, in France the CNIL's cookie guidelines, in the UK the PECR regulations.
• The GDPR covers what happens to the personal data afterwards: the click ID, the IP address, the hashed email sent to the ad platform. It needs a legal basis, and for advertising measurement that basis is, in practice, consent under Article 6(1)(a), with the conditions of Article 7 and the definition in Article 4(11): freely given, specific, informed and unambiguous.

Three court and regulator positions set the practical bar. The Court of Justice ruled in Planet49 (2019) that a pre-ticked box is not consent. In Fashion ID (2019) it held that a website embedding a Facebook plugin is a joint controller for the collection and transmission of data, which is why "it's Meta's pixel, not my problem" does not work. And the CNIL has fined large sites for making "reject" harder than "accept"; a banner needs a refuse option as easy as the accept one.

What a compliant banner has to do

1. Block before consent. No gtag, no pixel, no analytics cookie until the visitor accepts. Loading the script "but not firing events" still sets cookies in most configurations.
2. Make refusing as easy as accepting. Two buttons of equal weight. No dark patterns, no "continue browsing means yes".
3. Say what it is for. "Measure which ads bring customers" is specific; "improve your experience" is not.
4. Remember the choice and allow withdrawal. Store the decision, respect it on every page, and offer a way to change it later.
5. Keep the site working without consent. Booking, ordering and sign-up must work for a visitor who refuses.

Google Consent Mode v2 and why ad platforms now require it

Since March 2024, advertisers who want to use audience and measurement features for users in the European Economic Area must signal consent to Google through Consent Mode v2, with the ad_storage, ad_user_data and ad_personalization flags. Without those signals, conversions from EEA visitors stop being attributed to campaigns. Meta has a similar expectation through its own consent settings for the pixel.

This changed the economics. For years, the "track everything" shortcut at least produced numbers. Now a non-compliant setup produces worse numbers than a consent-first one, because the platforms discount data that lacks a consent signal. Doing it right became the better business decision as well as the legal one.

What you lose, and how much it matters

Consent rates on well-designed, honest banners in Europe commonly land somewhere between a third and three quarters of visitors, depending on the market and the wording. That means you will see fewer conversions in your ad dashboard than actually happened. Two things soften this. First, Google models the missing conversions when Consent Mode is in place, so campaign optimisation keeps working. Second, your own app knows the real number: bookings are bookings whether or not the visitor accepted a cookie. A growth tool that compares platform-reported conversions against your app's real metric gives you a truer picture than either alone.

How a consent-first setup works when the platform does it for you

On Autoflowly, conversion tracking is part of the Growth feature and is consent-first by default. Here is what that means concretely, because "GDPR-compliant" on a pricing page is not a specification:

• One conversion action per goal metric. When you set a goal like "40 bookings", the platform creates a Google conversion action for bookings and a Meta pixel event for the same thing, once per account, and reuses them.
• Nothing loads until Accept. The app's pages carry a small loader that shows a cookie bar in your app's accent colour, with Accept and Decline side by side. The Google tag and the Meta pixel are fetched only after Accept. Before that, no third-party script runs and no advertising cookie is set.
• Click IDs are kept, not cookies. The gclid and fbclid parameters from the ad click are carried through the visit so that, if the visitor consents, the conversion can still be attributed.
• The conversion fires on the confirmation path. A booking confirmation, an order thank-you page, a completed sign-up. Not on every page view.
• The app keeps working for visitors who decline. The consent choice gates measurement, never the product.

Because the loader is served by the platform, fixes and policy changes reach every app with a backend update, rather than waiting for each owner to edit their site.

A checklist you can run on your own site in five minutes

1. Open your site in a private window, open the browser's developer tools, Network tab, and load the home page. Before touching the banner, filter for googletagmanager, google-analytics, doubleclick and facebook. Anything there has loaded before consent.
2. Check the Application or Storage tab for cookies starting with _ga, _gcl or _fbp. Same rule.
3. Click Decline. Reload. Repeat both checks.
4. Click Accept. Confirm the tags now load and that a conversion fires on your thank-you page, not earlier.
5. Look for a way to withdraw consent later. If there is none, add one.

Privacy policy and records

Consent is only half of the paperwork. Your privacy policy should name the advertising platforms you send data to, the purpose (measuring ad effectiveness), the legal basis (consent) and the retention. Keep a record of consent choices, because Article 7(1) puts the burden of demonstrating consent on you. For the Meta pixel, Meta's own terms treat you and Meta as joint controllers for part of the processing, which is worth a sentence in your policy. If you use a managed ad account run by a platform on your behalf, ask that platform for its data-processing agreement; under Article 28 you need one with every processor.

The short version

Block before consent, make refusing easy, say what the data is for, remember the choice, keep the product working without it, and send the consent signal to the ad platforms so your measurement survives. A setup that does those six things is both the compliant one and, since 2024, the one that reports better numbers. There is no longer a trade-off to agonise over.

Frequently asked questions