Consent banners and the measurement gap

In the UK, cookies and similar technologies are governed by regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). The Data (Use and Access) Act 2025 substituted a new regulation 6 with effect from 5 February 2026. The general rule is unchanged. Subject to Schedule A1, a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user. The new text adds that instigating the storage or access counts, and that gaining access includes collecting information automatically emitted by the device.

The Information Commissioner's Office finalised its guidance on storage and access technologies on 29 April 2026. It covers cookies, tracking pixels, link decoration, local storage, device fingerprinting, scripts and tags. It sets out five exceptions to the consent requirement, which cover communication, strictly necessary, statistical purposes, appearance and emergency assistance.

For executive reporting the statistical purposes exception matters most. Under the ICO guidance, an organisation can run analytics without consent where the sole purpose is to collect statistical information about how its service is used, with a view to improving it. The resulting information must be aggregate, visitors must receive clear and comprehensive information, and there must be a simple, free means to object. A third-party analytics provider may help, but it must act as a processor and must not combine the data with information from other sources.

The exception has firm edges. The ICO states that online advertising purposes "are not exempt from PECR's consent requirements and never have been", and lists ad measurement and performance among them. Connecting a visitor ID to purchases so that conversions can be shared with advertising partners still requires consent.

The Data (Use and Access) Act changes UK law only. Organisations with EU visitors need a separate review against the rules that apply where those visitors are.

Websites that use Google tags pass consent choices to them through Google Consent Mode. Google's developer documentation describes two ways to implement it, and the choice changes what the business can see.

In basic consent mode, Google tags are blocked until the visitor interacts with the banner. If the visitor declines, no data is sent to Google at all, not even the consent status. Conversion modelling in Google Ads then falls back to a general model.

In advanced consent mode, tags load with consent defaulted to "denied". While consent is denied they send measurements without cookies, and full measurement starts only once the visitor grants consent. Google states that this supports an advertiser-specific model rather than a general one.

The individual consent types have specific effects. With analytics_storage denied, Google Analytics does not read or write its first-party cookies. With ad_storage denied, no new advertising cookies are written and IP addresses are truncated at collection. With ad_user_data denied, hashed first-party data for enhanced conversions is not sent. Each of these lowers the share of activity that can be observed and tied to an individual visitor across a session or a return visit.

Google Analytics 4 fills part of the gap with behavioural modelling, which estimates the behaviour of visitors who declined analytics cookies from the behaviour of similar visitors who accepted. Google's help centre lists the conditions. Consent Mode must be in place on every page using the advanced implementation. The property must collect at least 1,000 events a day with analytics_storage denied for at least 7 days. It must also have at least 1,000 daily users sending events with analytics_storage granted on at least 7 of the previous 28 days. Meeting these thresholds does not guarantee eligibility.

A property with modest traffic can fall below them, and Google is explicit about the consequence. If there is not enough consented traffic to train the model, events from visitors who declined consent are not reported.

Where modelling does run, it stops at certain features. Google lists audiences, user explorer, cohort and user lifetime explorations, sequence segments, retention reports, predictive metrics and data export, including the BigQuery export, as unsupported. A data warehouse fed from the BigQuery export therefore holds observed data only, while the GA4 interface with the Blended reporting identity shows observed plus modelled data. When the warehouse dashboard and the GA4 screen give different user counts for the same week, this is one documented reason to check first.

The 2026 exception lets analytics that meets its conditions run without consent, while advertising measurement still depends on it. An organisation that moves its analytics onto the exception may see sessions and users rise in its analytics reports while the conversions reported by its advertising platforms stay where they were. That difference would come from what each system is permitted to observe, with no change in demand behind it.

Treat the date of any consent configuration change as a break in the series. Record it in the reporting calendar, keep separate trend lines before and after, and avoid comparing conversion rates across the break without a stated adjustment. Use the order count from the commerce platform or ERP as the reference series, because it does not depend on a browser storing anything and does not change when a banner is redesigned.

The CTO should know which consent management platform is in use, whether Google Consent Mode is implemented in its basic or advanced form, and whether every tag on the site, including those from other vendors, respects the visitor's choice.

The data protection lead should be able to say which PECR exception each non-advertising technology relies on, where the visitor's simple means of objecting sits, and whether the analytics provider's contract makes it a processor.

The CMO and CFO should know which board metrics are observed and which include modelled data, whether the GA4 property meets the behavioural modelling thresholds, and which series serves as the reference when the systems disagree. Each answer needs a named owner and a review whenever the banner, the consent platform or the tag set changes.