Website tracking and privacy: a cookie banner is only the start

Start with the decisions the data needs to support

A business wants to know which campaign brings in enquiries. An online shop wants to find out where customers abandon checkout. Another website only needs to understand which articles people read. Those are different questions, and they call for different measurements.

We start by agreeing what counts as a useful result, who will use the reports and what they will decide based on them. That tells us which events to record and which data those events actually need.

For a contact form, recording a successful submission is usually enough. The message itself has no place in web analytics. Collecting more data will not improve a report unless it helps answer the question behind it.

Choosing between Usercentrics, Cookiebot and other consent platforms

A consent management platform, or CMP, records visitors’ choices, keeps a record of consent and passes those choices to the connected services. The banner is the part visitors see.

Usercentrics CMP and Cookiebot CMP both belong to Usercentrics. Comparing them means comparing two product lines from the same supplier. consentmanager and Didomi are other options. The right choice depends on the website and the people who will maintain it. The appearance of the banner is a relatively small part of that decision.

When assessing a platform, we look at:

• the websites, languages and any apps it needs to support;
• how reliably it can control existing services and custom integrations;
• whether editors, marketers and developers can have appropriate access rights;
• how changes can be tested before they go live;
• what it will cost at the website’s actual level of use.

The banner itself needs attention too. People must be able to understand their options and use them on a phone, with a keyboard or with a screen reader. It must not leave essential website functions out of reach. Our web accessibility service covers this work in more detail.

The tag manager has to respect the visitor’s choice

A tag manager controls when analytics and marketing code runs. For example, it can send an event to an analytics service when a form has been successfully submitted. The same setup needs to control whether that service is allowed to run at all.

We regularly encounter two problems. In one, the banner correctly records a rejection, but a marketing tag still fires on every page view. In the other, a service is correctly configured in the tag manager but also loaded separately by a CMS extension. Looking at the tag manager alone will not reveal that second connection.

We therefore check what the website loads directly, including external videos, maps, chat tools and forms. For each connection, we need to know when it starts and what data it sends.

Google Consent Mode: Basic and Advanced behave differently

Google Consent Mode passes consent signals to supported Google tags and adjusts how they behave. The two implementation options differ in an important way:

• Basic Consent Mode: Google tags remain blocked without consent. No data is sent to Google through those tags.
• Advanced Consent Mode: Google tags load immediately with a default consent state. When consent is denied, they still send measurement signals to Google without cookies, known as cookieless pings.

With Advanced Consent Mode, data is therefore still sent to Google when consent has been refused.

Marketing, development and the people responsible for data protection need to agree which approach to use. That means considering both the reports the business needs and the processing it is allowed to carry out. Enabling Consent Mode does not establish that the resulting data processing is lawful.

JENTIS and server-side tracking

Server-side tracking adds a server between data collection and the services receiving the data. That gives the website operator a place to control what each service receives and to remove or change information before forwarding it.

JENTIS provides data collection and tag management for this setup. The visitor’s choice in the banner has to reach the server and control what it forwards to each service. Changing the browser tags alone is not enough.

That additional control can be useful for a business working with several marketing services. It also means more configuration, cost and ongoing maintenance. A website with a few straightforward reporting needs may be better served by a simpler setup.

Server-side tracking still has to respect visitors’ choices. What can be collected and passed on depends on the particular processing involved. Routing data through a server does not, by itself, give anyone permission to use it.

GDPR and Austrian cookie rules cover more than cookies

In Austria, Section 165(3) of the Telecommunications Act 2021 governs storing information on a device or accessing information already stored there. It applies to cookies, local storage and comparable technologies. Storage that is not technically necessary requires consent. Where personal data is processed, the GDPR applies as well.

For a website project, this means identifying what is processed, for which purpose, who receives it, how long it is needed and which services require consent.

Where technical work needs legal advice

We are a digital agency, not a law firm. We can establish what a website collects, where the data goes and how to change that behaviour. When a question goes beyond our knowledge or needs a legal assessment, we say so.

On data protection matters, we work with Knyrim Trieb Rechtsanwälte, a law firm specialising in data protection and ePrivacy. If a project needs legal input, we agree with the client whether to involve the firm or work with their existing legal advisers. We provide the technical details and implement the requirements agreed as a result.

What we check on the website

The settings in the admin interface are a starting point. We check whether they work by testing the website in four situations:

1. Before a choice is made: We record which services load, which connections open and what information is stored.
2. After rejection: Services that require consent must stay inactive. We also check that the website’s basic functions still work.
3. After partial consent: Agreeing to analytics must not also activate marketing services. We check that each choice is applied separately.
4. After withdrawal: Visitors must be able to reopen and change their choices. We check that processing dependent on the withdrawn consent stops and does not restart on another page.

We look beyond the homepage. A video in an article or a form on a campaign page may load services that are not used elsewhere. With server-side tracking, we also check what the server forwards. The cookies visible in a browser cannot tell us that.

Once valid consent is in place, we check the quality of the measurements. An enquiry should not be counted twice because two integrations send the same event. Nor should clicking “Submit” count as a successful enquiry if the form then returns an error.

A new campaign can change the whole setup

Adding a marketing pixel takes little time. It can also introduce a new recipient of data that is missing from both the consent settings and the documentation.

Someone needs to prepare the change, someone needs to check it, and someone needs to approve it for release. The person approving it must be able to see which service is being added, what it collects and when it will run. Accounts and access remain with the business, so changing agencies does not mean losing control of the setup.

This work belongs in an agreed website maintenance arrangement. We cover access rights, external services and controlled releases in more detail in our article on web security.