A meaningful share of your visitors decline tracking, and browsers restrict much of what remains. Your analytics did not stop working, but what the numbers mean has changed, and most dashboards do not say so.
Key takeaways
- Consent rates vary enormously by region and banner design, so a drop in reported traffic is often a consent change rather than a demand change.
- A large share of modern platform reporting is modelled, not observed. Modelled data is useful for trends and unreliable for small segments.
- Server-side tagging improves data quality but does not create consent: it is an engineering fix, not a legal one.
- First-party data you collect with permission is the only measurement asset that keeps getting more valuable.
On this page
What actually changed
Three separate forces reduced measurement coverage at once, and they are frequently confused with each other. Consent law governs what you may collect, browser policy governs what you technically can, and platform modelling fills the resulting gaps with estimates.
| Force | Restricts | Your options |
|---|---|---|
| Consent regulation | What you may collect at all | Ask well, and honour the answer |
| Browser tracking prevention | Cookie lifetime and cross-site identity | Server-side tagging, first-party data |
| Platform modelling | Nothing, it estimates the gaps | Understand what is observed vs modelled |
Click to download this table as an image
The practical effect is that reported conversions fell for reasons unrelated to marketing performance. Teams that did not know this spent a year optimising against a measurement artefact, and argued about attribution when the real change was consent.
Consent, and the banner that decides your data
Your consent rate is a design outcome, not a fixed property of your audience. Two sites in the same market with the same visitors can differ by tens of percentage points based on how the banner is written and laid out.
In the European Economic Area, the legal floor is straightforward: analytics and marketing cookies require prior, informed, freely given consent, refusal must be as easy as acceptance, and the site must work either way. Pre-ticked boxes and a hidden reject option are not compliant, whatever the banner vendor implies. The EU’s Digital Omnibus proposal (November 2025) would move these cookie rules into the GDPR, but as of October 2026 it is still being negotiated, so nothing has changed yet.
The United Kingdom has diverged. Since 5 February 2026, under the Data (Use and Access) Act 2025, cookies used only to produce statistics about your own site no longer need consent, provided visitors get clear information and a simple, free way to opt out. Advertising and cross-site tracking cookies still need consent, and maximum fines rose to £17.5 million or 4% of global turnover.
- Make accept and reject equally prominent. Beyond being required, a fair banner earns better-quality consent from people who meant it.
- Say in plain language what you use data for. Vague legal boilerplate lowers acceptance.
- Do not fire tags before a choice is made. This is the most common implementation failure and the easiest to detect.
- Record the consent state alongside your analytics so you can see what share of reality you are observing.
That last point is the one people skip and later regret. Without it you cannot distinguish a genuine traffic decline from a change in how many people agreed to be counted.
Knowing which numbers are estimates
When consent is refused, major platforms estimate the missing conversions rather than reporting a gap. The estimate is reasonable in aggregate and unreliable the moment you slice it finely.
In Google’s case this runs through consent mode. Since March 2024, advertisers must send consent signals for visitors in the EEA to keep Google Ads measurement and remarketing working, and when a visitor declines, consent mode lets Google model the conversions it could not observe.
Modelled figures behave well for overall trends and channel-level comparisons over reasonable time periods. They behave badly for small segments, short windows and individual campaigns, precisely where small businesses tend to look hardest.
Treat any conversion count below a few dozen as directional. If a decision rests on the difference between eleven and fourteen conversions, it does not rest on anything.
Modelled data is a weather forecast. Useful for deciding whether to take a coat, useless for deciding whether it rained.
Serhii Yelbaiev, Well Web Marketing
What to build instead
The measurement that survives all of this is measurement you own and were given permission for. Every restriction so far has hit third-party observation and left first-party relationships alone.
- Ask on the form. A source field on your enquiry or checkout captures journeys no platform can see, consent or otherwise.
- Own the identifier. An email address given willingly outlasts every cookie and works across devices. Email marketing is how that list keeps paying, and email and lifecycle automation keeps it running without daily effort.
- Measure at the boundary that matters. Total revenue and total enquiries per month are unaffected by consent rates. Use them as the sanity check on everything else, ideally in one analytics dashboard.
- Consider server-side tagging if data quality is genuinely limiting decisions, but implement it as a consented, transparent channel, not as a way around the banner.
- Run holdout tests where budget allows. Switching a channel off and watching total revenue needs no tracking at all.
Frequently asked questions
Compare total sessions against a consent-independent source such as server logs or Search Console impressions. If those held steady while analytics fell, you are looking at a measurement change.
No. Consent governs the purpose of processing, not the technical route the data takes. Server-side tagging improves data quality for the consent you already have.
It is a reasonable option if aggregate trends are all you need. You give up user-level journeys and most attribution in exchange for coverage that is close to complete.
It varies too widely by region, sector and banner design for a benchmark to be meaningful. Measure your own, then treat improving it as a design project.
Sources and method
- European Union, ePrivacy Directive 2002/58/EC and GDPR, as applied in the EEA
- UK Information Commissioner’s Office, Guidance on the use of storage and access technologies and what the Data (Use and Access) Act 2025 means for organisations
- Clifford Chance, Key aspects of the Data (Use and Access) Act take effect (February 2026)
- Osborne Clarke, Digital Omnibus reshapes EU cookie rules
- Google Ads Help, About consent mode, About consent mode modelling and Updates to consent mode for EEA traffic
- Observations on modelled data and consent-rate variation come from our own client implementations. This is not legal advice. Last reviewed October 2026.