Small businesses need reliable conversion data (analytics, ad measurement, lead tracking) to make decisions. At the same time, the ICO and PECR set clear limits on when you can use storage and access technologies such as cookies, tracking pixels and similar tools. This article gives a practical decision map, explains the main options and trade‑offs, and supplies a studio‑friendly checklist and copy snippets you can adapt for a UK audience.
One‑page decision map: when you need consent
- Brochure site with no tracking beyond strictly necessary features – usually no consent needed if you only use cookies that are strictly necessary for a function the user requested (for example, session cookies needed for a logged‑in admin). See ICO guidance on storage and access technologies for what counts as strictly necessary.[ICO]
- Lead forms, newsletter sign‑ups, light analytics – analytics and advertising cookies require consent under PECR and ICO guidance. You should gate analytics/advertising tags behind consent and offer clear choices on your cookie page.[ICO]
- Ecommerce (payments, order tracking) – functional cookies for checkout may be strictly necessary, but marketing/analytics cookies still need consent. Treat advertising/behavioural measurement as requiring consent.[ICO]
ICO basics — what the law requires in practice
The ICO’s guidance makes clear that cookies and “similar technologies” (for example, tracking pixels or fingerprinting) are subject to the Privacy and Electronic Communications Regulations (PECR). For advertising and analytics uses you should obtain prior, informed consent before storing or accessing these technologies on a user’s device. That means a simple “we use cookies” banner with no opt‑out is insufficient for measurement that is not strictly necessary.[ICO]
Practical measurement options and trade‑offs
1. Consent‑first (block tags until user accepts)
How it works: your cookie banner asks for consent and you prevent analytics/advertising tags from firing until the visitor opts in. Why choose it: simplest compliance model and easy to document. Downsides: data gaps when users decline, so conversion figures will be lower than actual conversions.
2. Consent + modelling (Google Consent Mode and similar)
How it works: when a visitor declines, consent signalling tells measurement tools to change behaviour — for example, limited, anonymised pings or aggregated modelling rather than full identifiers. Google’s Consent Mode is designed to let some measurement continue in a reduced form and to use modelling to estimate conversions where cookies are blocked; it requires correct consent signalling and configuration.[Google]
Why choose it: better continuity of reporting and fewer blind spots than strict blocking. Trade‑offs: the metrics are modelled and differ from cookie‑level attribution; you must document the approach in your privacy notice and accept some uncertainty.
3. Server‑side and first‑party approaches
How it works: reduce reliance on third‑party cookies by sending events from your server or using first‑party cookies/hashed identifiers. This can improve data control and resilience to browser restrictions.
Why choose it: gives more control over data flows and potentially better matching for returning users. Important caveat: collecting or linking personal data still invokes data‑protection law (UK GDPR) so pick a lawful basis and document retention, minimisation and security measures; server‑side setups do not automatically remove the need for consent where PECR requires it.
Studio implementation checklist
- Map cookies and tracking: classify each tool as strictly necessary, analytics, or marketing.
- Choose consent UX: match banner to GOV.UK patterns — clear accept/ reject options and a cookies page with granular settings.[GOV.UK]
- Implement tag gating: block analytics/ads until consent; test on staging with common consent states.
- Set consent persistence: store choices in a first‑party cookie or localStorage and respect expiry and revisiting behaviour.
- For Consent Mode: ensure consent events are signalled correctly to Google tags and test conversion modelling behaviour over a realistic ramp period.[Google]
- Update privacy/cookie policy: explain what you collect, why, lawful basis or consent, and how users can change settings.
- Define a test plan: measure reporting loss under consent decline and prioritise the business metrics you need for decisions.
Reporting expectations and stakeholder messages
Be transparent with stakeholders: any consent‑respecting setup will create gaps compared with pre‑consent tracking. Use phrases such as “consent‑filtered data”, “modelled conversions” or “first‑party only signals” in dashboards. Prioritise the metrics that drive decisions (e.g. leads per week, revenue per channel) rather than perfect click‑level attribution.
Quick copy snippets
Banner short: We use cookies to improve the site and measure visits. Manage your choices. (Buttons: Accept all / Reject non‑essential / Cookie settings)
Cookie page lead: We use strictly necessary cookies without consent. For analytics and advertising cookies we ask for your consent; you can change your choices below. [Link to settings]
These snippets follow the GOV.UK pattern for clear, accessible choices and should be adapted to your tools and privacy notice.[GOV.UK]
Further reading: ICO guidance on cookies and similar technologies; Google’s Consent Mode documentation; GOV.UK cookie‑banner pattern.
If you want a practical review of your site’s cookie map and a checklist tailored to your platform, use our website launch check tool to get started and see which pages and tags need attention: Run the website launch check.
Sources: ICO guidance on storage and access technologies (cookies/PECR); GOV.UK Design System cookie banner pattern; Google Analytics Consent Mode documentation.