Ads · Measurement and consent
Conversion tracking after cookie consent: what still counts
Counting what people agreed to
After cookie consent, conversion tracking in Denmark still works, but only part of it is directly observed. Conversions from visitors who accept cookies are measured as before; for those who decline, platforms such as Google and Meta fill gaps with modelled estimates. Consent Mode, server-side events and CRM imports recover a lot of the signal, but none of them remove the need for consent.
Inside this guide
What changed, and why your numbers dropped
Under the ePrivacy rules and GDPR, a website in the EU must ask before setting cookies or similar identifiers that are not strictly necessary. Advertising pixels and most analytics cookies fall into that group. In Denmark the rules are set out in the cookie order (cookiebekendtgørelsen), and the Danish Data Protection Agency, Datatilsynet, has made clear that rejecting must be as easy as accepting.
The practical effect is simple. When a visitor clicks “reject”, the Meta pixel, Google Ads tags and similar tools should not set cookies or send identifiable data about that person. Their conversions do not disappear from your bank account, but they disappear from your dashboards. Many businesses saw reported conversions fall noticeably after introducing a compliant banner, even though sales stayed level.
Browsers added their own limits on top. Safari and Firefox restrict third-party cookies and shorten the life of some first-party cookies, which makes it harder to connect a click today with a purchase next week. Google has kept third-party cookies in Chrome for now, but the direction across the industry is less tracking by default, not more.
What still counts as measured
It helps to separate four kinds of data, because they carry different weight:
- Observed conversions with consent. A visitor accepted cookies, clicked an ad and bought. This is measured the old way and is reliable.
- Modelled conversions. The platform estimates conversions from visitors who declined, using patterns from those who accepted. Useful in aggregate, impossible to check one by one.
- First-party records. Orders in your shop system, bookings, signed contracts and leads in your CRM. These are your ground truth.
- Aggregate signals. Total revenue, branded search volume, direct traffic. They show the overall effect of marketing without tying it to individuals.
Good measurement today combines all four. The ad platform figures guide day-to-day bidding; your own records decide whether the marketing pays.
In practice that means a monthly reconciliation. Take the conversions each platform reports, add them up, and compare the total with the orders or qualified leads your own systems recorded in the same period. Platforms almost always claim more in total than you actually received, because each one takes credit for sales the others also touched. The ratio between the two figures is more useful than either on its own. If it stays fairly stable, you can steer by platform data with confidence. If it suddenly jumps, something in the tracking has broken or changed, and that is worth finding before you move budget.
Google Consent Mode v2 in plain terms
Consent Mode is a way for your consent banner to tell Google tags what the visitor agreed to. Version 2 added two signals, ad_user_data and ad_personalization, alongside the existing ad_storage and analytics_storage. Since March 2024, Google has required these signals for advertisers who want full measurement, audience building and remarketing for users in the European Economic Area.
There are two ways to run it:
- Basic mode. Google tags do not load at all until the visitor consents. Nothing is sent before that. Google can still model conversions, but with less information.
- Advanced mode. Tags load in a restricted state and send cookieless pings (no identifiers) when consent is declined. Google uses these to build better models. Some legal advisers are more cautious about advanced mode, so it is worth checking with whoever handles your data protection.
Most certified consent platforms, including those common in Denmark, can send Consent Mode signals automatically. Check that the banner actually updates the signals when someone changes their mind; misconfigured banners are common.
Server-side tracking: what it does and does not do
Server-side tracking moves some of the measurement work from the visitor’s browser to a server you control. Examples include a server-side Google Tag Manager container, Meta’s Conversions API and TikTok’s Events API. Instead of the browser sending data to each ad platform, your server sends a cleaner, controlled set of events.
The benefits are real:
- Fewer events lost to ad blockers, browser limits and slow pages.
- More control over exactly which data leaves your site.
- First-party cookies set from your own domain, which browsers tend to treat more kindly.
- Deduplication, so a purchase recorded by both the pixel and the server counts once.
What it does not do is make consent optional. If a visitor declines marketing cookies, sending their data to Meta from your server instead of their browser is still processing personal data without a valid basis. Set the server container up to respect the same consent choices as the banner. We treat this as a fixed rule in our tracking and conversion reporting work.
Comparing the main methods
A simple overview of the common techniques and how they relate to consent:
| Method | Needs consent? | What it helps with |
|---|---|---|
| Consent Mode v2 | Respects it by design | Modelled conversions, compliant Google measurement |
| Enhanced conversions (Google) | Yes, for marketing | Matching conversions using hashed email or phone |
| Conversions API (Meta) | Yes, for marketing | Reliable server-side events, better matching |
| Offline conversion import | Needs a lawful basis | Feeding real sales and qualified leads back to platforms |
| Aggregate reporting, surveys | No personal data | Checking overall effect, channel mix |
“Needs a lawful basis” for offline imports means you must be able to justify the data sharing under GDPR and explain it in your privacy policy. Hashing an email address does not turn it into anonymous data.
What it means for retargeting and audiences
Retargeting relies on recognising people who visited your site. Visitors who decline cookies cannot be added to website audiences, so audiences are smaller than they used to be, sometimes much smaller on sites with low consent rates. Lookalike and similar audiences built from them are also based on less data.
A few adjustments help:
- Build audiences from on-platform engagement (people who watched your videos or interacted with your profile), which does not depend on your website cookies.
- Use customer lists from your CRM where you have permission, refreshed regularly.
- Accept that broad targeting with strong creative often works as well as narrow retargeting now.
- Keep frequency caps sensible; smaller audiences tire faster.
For how we approach this balance in practice, see our page on retargeting and lookalike campaigns.
A practical checklist
If you want to know whether your own setup is in reasonable shape, work through these points:
- Does the banner block marketing and analytics tags until consent, and is rejecting as easy as accepting?
- Are Consent Mode v2 signals being sent, and do they change when a visitor changes their choice?
- Is the Meta Conversions API (or equivalent) running, with deduplication against the pixel?
- Are enhanced conversions or advanced matching switched on for consenting users?
- Do qualified leads and closed sales flow back to the ad platforms from your CRM?
- Do you compare platform-reported conversions with your own sales records every month?
- Is all of this described accurately in your cookie and privacy policies?
If you can answer yes to most of them, you have about as much signal as a compliant business can expect. The remaining gap is the price of respecting visitors’ choices, and it is better to plan around it than to try to hide it.
Tracking questions
Consent and measurement,
the things people ask
It can be, but only if it is set up to respect consent and data protection rules. Server-side tracking is a technical method, not a legal exemption. Moving data collection from the browser to your server does not change whether you need consent to share a visitor’s data with Google, Meta or TikTok.
A compliant setup passes the consent choice from the banner to the server container, sends marketing events only for visitors who agreed, limits the data fields to what is needed, and is documented in your privacy policy and records of processing. You should also check where the server is hosted and which data processing agreements apply. Done properly, server-side tracking can actually give you more control over personal data than browser tags do.
They are reasonably reliable in aggregate but cannot be verified individually. Google estimates conversions from users who declined cookies by looking at patterns among users who consented, such as time of day, device and campaign. The models need a minimum amount of data before they run, so small accounts may see little or no modelling.
Treat modelled figures as a better guide than raw observed numbers, not as an exact count. The best check is to compare total conversions in Google Ads with your own sales or lead records over the same period. If the two move together over time, the model is doing its job. If they drift apart, look for tracking problems before trusting either number.
There is no single normal rate; it varies widely by site, audience and banner design. Sites with a clear, compliant banner that gives equal weight to accept and reject commonly see a substantial share of visitors decline, and the share can differ a great deal between, say, a fashion shop and a B2B software site.
Rather than chasing a benchmark, measure your own rate in your consent platform and watch how it changes when you adjust the wording, design or timing within the rules. Explaining plainly why you use cookies sometimes helps. Avoid pre-ticked boxes, hidden reject buttons or other dark patterns; Datatilsynet and other European regulators have criticised these, and they create risk that outweighs any gain in data.
Yes, in most cases Meta recommends running both together. The pixel captures browser events such as page views and button clicks with useful context, while the Conversions API sends events from your server that survive ad blockers and browser limits. With a shared event ID, Meta deduplicates them so each action counts once.
Running both gives Meta more chances to match events to people who consented, which usually improves optimisation and reporting. Some businesses run the Conversions API alone for privacy or performance reasons, and that can work, but you lose some detail. Whichever you choose, both the pixel and the server events must follow the visitor’s consent choice.