10 Analytics Implementation Checks for Websites With Consent Requirements

Check that tags do not set cookies or send identifiable data before a choice is made, that default consent states are set before any tag runs, that the visitor's choice is passed to every tool (Google tags through consent mode, Microsoft Clarity through its consent API, others through your consent platform), that choices are remembered and can be changed, that no personal data leaks into analytics, and that your reports account for the data you will not collect. Then verify all of it in a browser, not just in the tag manager.

This list is for marketers, developers and site owners in markets where analytics needs consent, and for anyone serving visitors from the EU or UK. It is technical guidance, not legal advice: which rules apply depends on where your visitors are and what you collect. Google and Microsoft documentation was checked on 28 October 2026. For tracking lead sources and outcomes, see measuring conversions across channels.

1. Nothing non-essential fires before a choice. Load the page with cleared cookies, do not interact with the banner, and check the browser's network and cookie panels. Analytics, advertising and session-recording cookies should not appear unless your legal basis allows it.

2. Default consent states are set first. For Google tags, the consent mode default command must run before any measurement data is sent, on every page. Google's documentation says to call the default command on every page of the site. If the default runs after the tag, the first hit is sent without consent information.

3. Regional defaults are deliberate. If you apply consent only in some regions, set region-specific defaults and confirm visitors from those regions are actually covered. Location detection is approximate, so err on the side of asking.

4. Google consent mode v2 parameters. Send all four: ad_storage, analytics_storage, ad_user_data and ad_personalization. Google added the last two in its consent mode update; sending only the original two leaves advertising features without a valid signal.

5. Basic or advanced mode, chosen on purpose. Google describes basic mode as blocking Google tags until consent is granted, and advanced mode as loading tags that send cookieless pings when consent is declined, which Google uses for modelling. Decide which fits your legal advice; do not leave it to defaults.

6. Session recording and heatmap tools. Tools such as Microsoft Clarity need their own consent signal. Microsoft's documentation says Clarity has enforced consent signals for visits from the EEA, UK and Switzerland since 31 October 2025, and provides a consent API and consent mode setting so cookies are set only after consent.

7. Every other tag. Chat widgets, advertising pixels, embedded videos and A/B testing tools may set cookies too. List every third-party script on the site and confirm each one respects the visitor's choice.

8. Choices are stored, applied and changeable. Google notes that consent mode does not store choices; your banner or consent platform must remember them and resend them on each page. Provide a visible way to change consent later, such as a footer link, and make sure withdrawing consent stops collection.

9. No personal data in analytics. Consent to analytics is not consent to send names, emails or phone numbers. Google requires that no personally identifiable information is sent to Analytics. Check URLs, page titles, event parameters and form tracking. See lead form tracking events.

10. Reports account for the gaps. With consent required, some visitors will not be measured, and the share varies by market, device and banner design. Compare analytics counts with your CRM or order system, note the consent rate when comparing periods, and avoid treating analytics totals as complete.

Consent-aware analytics is mostly about order and plumbing: set defaults first, pass the visitor's choice to every tool, keep personal data out, and verify in the browser. Then read reports knowing some visitors are not measured. For the wider customer-data picture, see ecommerce privacy and customer data.

Google Tag Platform, set up consent mode (parameters, default and update commands). Google Analytics Help, consent mode overview (basic and advanced, cookieless pings). Google Analytics Help, PII policy. Microsoft Clarity documentation, consent mode (enforcement from 31 October 2025 for EEA, UK and Switzerland). Accessed 28 October 2026.