The era of easy tracking is over
For years, setting an analytics cookie was a formality: one line of code, a vaguely informative banner, and the statistics flowed in on their own. Those days are gone. European data protection authorities now actively check cookie banners, Google makes access to its advertising data conditional on a standardised consent signal, and visitors refuse to be tracked more and more often.
As a result, many websites find themselves in an uncomfortable position without knowing it. Either they keep collecting as before and risk a penalty, or they respect visitors' refusal and watch their statistics melt away, to the point of steering the business blind. There is a middle way, but it requires understanding what has really changed.
Consent has become the rule, not the exception
Under the European ePrivacy rules and the GDPR, non-essential trackers need prior consent, and regulators have spelt out what that means in practice. In France, the CNIL's cookie guidelines set a simple principle: refusing a tracker must be as easy as accepting it. No more banners where only the "Accept all" button stands out while refusal hides behind three clicks and a greyed-out menu. The French regulator has backed this requirement with regular inspections and penalties that no longer target only the digital giants, and other European authorities follow the same line.
In practice, a non-essential analytics cookie, such as those set by Google Analytics, may only be placed after freely given, informed and explicit consent. Until the visitor has said yes, no personal data should leave the browser. The rule may seem restrictive, but it has the merit of being clear, and a well-designed banner can respect it without harming the experience.
Consent Mode v2, or Google's ultimatum
On top of this regulatory pressure came a technical constraint from Google in March 2024. In the wake of the EU Digital Markets Act, the company requires Consent Mode v2 on any site that wants to keep using its data in Google Ads and Google Analytics for users in the European Economic Area. Without it, remarketing and custom audience features switch off, and the data simply stops coming in.
Consent Mode works by sending Google the consent status of each visitor, rather than blindly blocking or allowing tags. When the visitor accepts, measurement works normally. When they refuse, Google no longer receives a cookie but an anonymous signal, from which it statistically reconstructs part of the lost traffic. This is not a way round the refusal, it is modelling: trends are estimated without re-identifying anyone.
The real cost of poorly managed consent
The stakes are not theoretical. The penalties handed down in recent years for cookie breaches show the scale of the risk, and observed refusal rates are a reminder that a large share of traffic now escapes direct measurement altogether.
Notable CNIL penalties for breaking cookie rules: from a few tens of millions to several hundred million euros.
Consent Mode v2 required for advertising data in the EEA: since March 2024.
Share of visitors who refuse or ignore the banner: often 30 to 50% depending on the sector.
Data recoverable through modelling after a refusal: partial, never all of it.
The message is twofold. On one side, a non-compliant banner exposes the business to a very real penalty, small businesses included. On the other, even when everything is lawful, a growing fraction of traffic will never be measured individually. Carrying on as if you could see 100% of visitors is the surest way to make bad decisions.
This blind spot has a perverse effect, seen every time a site is brought into line. When a business finally fixes its banner, its Google Analytics figures drop sharply, sometimes by thirty or forty per cent, not because traffic has fallen, but because some visitors are no longer counted. An unprepared manager sees an audience collapse, panics and questions their investments, when they are simply discovering the scale of refusal. Understanding this mechanism avoids costly decisions based on a distorted reading of the numbers.
Getting reliable measurement back despite refusals
The first answer is to set up Consent Mode v2 properly, most often through Google Tag Manager, so as to recover the modelled share of visitors who refuse. It is an immediate gain for anyone already using the Google ecosystem, provided the banner and the tags are correctly wired together.
The second answer complements it: add audience measurement that does not depend on consent because it sets no cookie and collects no personal data. Solutions such as Cloudflare Web Analytics work this way and give a reliable view of traffic volume, page views and sources, whatever the visitor accepts. You lose fine-grained individual tracking, but gain a stable baseline that refusals do not erode. Combining the two approaches, detailed consented measurement on one side and aggregated cookieless measurement on the other, restores a credible reading of activity.
The end of third-party cookies reshuffles the cards
Added to this is an underlying trend: the decline of third-party cookies, the trackers that followed users from site to site to feed targeted advertising. Long announced and then postponed by browsers, their disappearance is pushing the whole ecosystem towards less intrusive methods, based on the data each site collects itself with its visitors' agreement. Blind targeting at the user's expense is giving way to an approach where the direct relationship regains its value.
For a small business, this shift has a very concrete consequence: first-party data, collected on your own website and in your own customer base, becomes a strategic asset. A retailer who can measure conversions properly and maintain a direct link with buyers will depend less on advertising platforms than one who built all their acquisition on third-party targeting. Seen this way, compliance stops being a constraint and becomes an investment: it forces you to build today what will be worth most tomorrow.
Compliance you can prove
That leaves the least visible part, and the most scrutinised during an inspection: documentation. A compliant site can say which cookies it sets, for what purpose and for how long, and it can show that refusing is as accessible as accepting. That means mapping the trackers actually present, often more numerous than expected once analytics, chat and advertising tools are added up, then sorting them into categories in a banner that blocks everything until the visitor has chosen.
It is work at the junction of legal and technical, exactly where a good visibility strategy is played out. Our SEO and paid search strategy service includes this alignment between audience measurement, compliance and steering, because clean data is worth more than plentiful data that breaks the law.
If you do not know exactly what your site collects today, or whether your banner would stand up to an inspection, now is the time to take stock. Contact us for a review.
Sources: CNIL, Cookies and trackers: what does the law say? · Google, About consent mode