Consent Management
Date: 2026-08-16
Consent is a gate on collection, not a banner. The banner is the interface; the mechanism is a stored decision that every tag checks before firing, and that travels with every event afterwards.
What it is
Consent management is capturing a user’s decision about non-essential storage and processing, storing it, enforcing it on every tag, and being able to prove it later.
Four parts, and most implementations only do the first:
1 CAPTURE the banner, and the choice
2 STORE a first-party record of what was chosen, and when
3 ENFORCE tags check it before firing
4 PROVE an auditable record, if challenged
Enforcement is where implementations fail. A banner that records a preference while tags fire regardless is worse than no banner — it’s a documented failure rather than an undocumented one.
Categories
The conventional split, and what falls where:
| Category | Needs consent | Examples |
|---|---|---|
| Strictly necessary | No | Session, basket, security, load balancing, consent record itself |
| Analytics | Yes (with a narrow 2026 exception) | Measurement, session replay, heatmaps |
| Marketing | Yes | Ad pixels, retargeting, conversion tracking |
| Preferences | Yes | Remembered locale, saved layout |
“Strictly necessary” means necessary to deliver the service the user asked for — not necessary to your business. Analytics is commercially essential and legally non-essential, and that gap is the whole subject. See UK GDPR and PECR for Analytics.
Requirements that hold
- Prior. Nothing non-essential fires before the choice. Tags firing on page load and stopping on rejection have already breached
- Granular. Per-category, not one all-or-nothing switch
- As easy to refuse as to accept. A prominent “Accept all” beside a buried “Manage preferences” is the pattern regulators name specifically
- Withdrawable, at any time, as easily as it was given
- Not implied. Continued browsing is not consent. Pre-ticked boxes are not consent
- Recorded — what was consented to, when, and against which banner version
The tag layer
consent state → dataLayer → trigger condition on every non-essential tag
One check, applied uniformly, is the only maintainable approach. Per-vendor implementations drift, and the tag someone added last Tuesday won’t have one.
Two mechanisms in practice: a blocking model where the consent platform prevents scripts loading, and a signalling model where tags load but adjust behaviour based on a signal. Blocking is more defensible; signalling is what several vendors implement. Know which yours does — Tag Managers.
Consent state should travel with the event, as a property, so downstream systems know what they’re permitted to do with a record rather than inferring it.
What it does to your data
The part that lands on analytics rather than legal:
- A step change at launch. Deploying a compliant banner reduces measured traffic immediately. Annotate the date or it reads as a traffic collapse — Annotation and Change Logs, Metric Drift
- The measured population is biased. Consenting users skew away from the privacy-conscious, and they convert differently — so it isn’t a smaller sample, it’s a different one
- Consent rates vary by device, market and traffic source, so segments aren’t comparable
- Server-side changes nothing. Consent attaches to the device access and the processing, not the transport — Server-Side Tag Management
Banner design is a CRO problem too
The banner is on every first visit, so it’s the highest-traffic interface you own. Two competing pressures: acceptance rate, and the requirement that refusal be equally easy.
The honest position is that dark-pattern banners are both non-compliant and a trust cost, and the regulators have named the specific patterns. Optimising within the rules — clarity, brevity, plain language about what’s actually collected — is legitimate and does move acceptance. Making “reject” harder is not — Deceptive Design.
Where it earns its keep: a banner explaining in one line what measurement is for, rather than a legal wall, measurably outperforms and is defensible.