How Can I Measure EU Campaign Conversions While Managing GDPR Consent?

The puzzle is that a campaign report can look more complete after a technical change while becoming less trustworthy at the same time. The fix is not a cleverer tag. It is a measurement design that records what was actually observed, what was modeled, and what a visitor declined to permit.

Can I use Google Analytics for an EU website under GDPR?

Yes, but Google Analytics use does not remove the need to assess cookies, similar technologies, personal data, and any transfers as separate questions. The UK Information Commissioner's Office explains that analytics cookies are not within the strictly necessary exemption, including first-party analytics cookies; visitors must be told about them and consent must be obtained.

That distinction matters because “analytics” is a purpose, not a compliance exemption. The ICO explains that PECR rules on storing information on, or accessing information from, a device apply before the separate UK GDPR analysis. It also identifies cookies, IP addresses, advertising IDs, pixel tags, account handles, and device fingerprints as online identifiers that can become personal data when they identify or single out a person.

France's data protection authority, CNIL, describes a narrow audience-measurement exemption. It is limited to measurement or A/B testing, cannot be cross-checked with other processing, is confined to one publisher, requires truncation of the last byte of IP addresses, and limits tracker lifetime to 13 months. CNIL's diagnosis is blunt: “Most large audience measurement offerings do not fall within the scope of the exemption, regardless of their configuration.” Do not label a general analytics implementation exempt merely because it produces traffic reports.

A useful operating model has four ledgers: consented analytics data, consented advertising data, modeled platform reporting, and first-party information collected through a separate, transparent interaction. Combining them prematurely produces a number with unclear meaning. Keeping them distinct makes campaign decisions slower only in appearance; in practice, it prevents teams from comparing observed conversions with estimates as though both were counts from the same instrument.

There is a second boundary. If data is made available to an organization outside the EEA, the European Data Protection Board says the transfer conditions of GDPR Chapter V apply in addition to the other GDPR obligations. Appropriate safeguards or an adequacy decision do not erase the need for a lawful basis, data minimization, security, and applicable processor arrangements.

Do I need cookie consent before Google Ads conversion tracking runs?

Yes, where Google Ads conversion tracking uses non-exempt cookies or similar trackers, consent is required before those trackers are placed or read. CNIL states that trackers used for personalized advertising, non-personalized advertising that measures ad audiences, and social-sharing functions require prior consent; after refusal, they cannot be placed or read.

This is where a banner's visual design becomes an implementation requirement. According to CNIL's cookie guidance, users should receive information about purposes and access to an up-to-date controller list, make a clear affirmative choice by purpose, and be able to withdraw it. CNIL recommends accept-all and reject-all choices with equal prominence on the first layer, and considers six months generally appropriate for retaining either consent or refusal.

The ICO adds a detail often missed during tag-manager reviews: user control must cover all cookies set through the site, including third-party tracking pixels and beacons. A cookie audit therefore needs more than a list of vendor names. Record each technology's purpose, whether it is first- or third-party, its lifespan, the data it processes, links to other user data, and whether it is strictly necessary.

Legitimate interests are not a repair kit for a broken consent flow. The ICO states that, when consent is required for storage or access and the information is personal data, consent should also be the lawful basis for subsequent processing; it further warns that legitimate interests cannot be retrospectively used when consent validity fails. The diagnosis is simple: a banner that allows tags to run first and asks permission later has already lost the argument.

Good measurement resembles honest household budgeting: the advertised figure is not the whole figure, as explained in What Does an Apartment Really Cost Beyond Advertised Rent?. In campaign reporting, the equivalent hidden cost is ambiguity. A lower conversion count with clean provenance is more useful than a larger count whose collection logic cannot be explained.

What is Google Consent Mode v2 and do I need it in Europe?

Google Consent Mode v2 is Google's mechanism for communicating a visitor's consent choices to Google tags, and it is needed for applicable Google measurement, personalization, and remarketing uses involving EEA end users. Google updated Consent Mode in November 2023 with ad_user_data, for sending advertising-related user data to Google, and ad_personalization, for personalized advertising.

Google Ads Help says advertisers using applicable tags or SDKs for EEA end users must collect consent for personal-data use and share consent signals to continue using measurement, ad-personalization, and remarketing features. The policy also covers Google Analytics data used in Google Ads, Search Ads 360, or Display & Video 360. This is a platform requirement alongside, not instead of, the legal analysis described by regulators.

The implementation sequence matters more than the setting's name. Google's developer guidance says to set the default consent state before any measurement command, then update that state after the visitor interacts with consent settings. A deny-by-default configuration covers four signals: ad_storage, analytics_storage, ad_user_data, and ad_personalization. When preferences change, update applicable signals to denied and persist the revised choice for later page loads.

There is a genuine trade-off here. Google warns that blocking its tags entirely until the banner is answered can prevent it from verifying consent choices and can lead to measurement-data loss. By contrast, allowing tags to run without a correctly established default state creates a different problem: the implementation has not expressed the visitor's choice before measurement commands occur. Consent Mode is designed to carry that state; it is not permission to collect whatever data a tag can technically reach.

The practical workflow is therefore sequential: audit each tracker; configure the banner's purpose choices; establish a denied default before measurement commands; update signals only from the recorded choice; test acceptance, refusal, withdrawal, and later page loads; then label reporting outputs by how they were produced. This sequence turns compliance from a banner project into a measurement discipline.

That discipline also improves interpretation. Consented tracking describes activity observed under the selected permissions. Modeled conversions are estimates produced by a platform under its own methodology. Aggregated reporting summarizes data at a higher level. First-party data is information collected directly by the organization, but it still requires an appropriate legal basis and clear handling. Similar outputs do not make these categories interchangeable.