Privacy & GDPR, a necessity for digital trust
Today's internet user is privacy aware. We strongly encourage this as we believe everyone has a right to privacy.
But with privacy mechanisms in place, there is a significant possibility your marketing efforts can be hindered. We've seen it more often than not. This is the reason why it is crucial to implement it in a way so your analytics system and marketing and budgets benefit from it. And yes, it is possible. We wrote up the most common mistakes in GDPR cookie consent modals that we see when auditing sites.
It can be done with right implementation of Advanced Google Consent Mode v2 either through CMPs or custom implementations with correct Google Tag Manager setup.
Apart from cookie consent deployments, we also offer services like privacy audits and analysis. This goes much deeper as it addresses issues of all communication with third party systems. We can supervise or even execute your privacy setup project.
We work closely with your data protection officer but usually have a suggestion how to improve it in order to protect you legally and your users privacy.
In case you need help with privacy implementation while maximizing the data you and your marketing can obtain, ask us for a privacy and consent audit.
Audit
We analyze your website or application to see what data is being collected and how it is being used.
Compliance
We check that your consent setup, tags and third-party data flows meet GDPR requirements, together with your data protection officer.
Cookie Consent
There are many ways to implement cookie consent. We can help you choose the right one.
Privacy Policies
We can help you define your privacy policy and make sure it is GDPR compliant.
Google Consent Mode v2 implementation
Google Consent Mode v2 is a game-changer for businesses relying on Google Analytics and Google Ads. It allows your site to adapt to each user's individual cookie consent status, respecting privacy while ensuring you still gather essential data to optimise campaigns. By sending consent signals to Google, you can measure conversions more accurately and maintain effective remarketing and audience insights, all within GDPR guidelines.
We implement Advanced Consent Mode v2 either through a consent management platform (CMP) or as a custom implementation with a correct Google Tag Manager setup, and we configure Consent Mode within Google Tag Manager or server-side tagging to respect user choices while safeguarding your marketing insights. We usually recommend Advanced mode, but the right choice depends on the scenario.
- Privacy-safe tracking: when visitors decline, Google still receives cookieless signals and uses them to model the conversions you would otherwise lose, while their choice is respected.
- Accurate conversion data: better visibility into the customer journey without relying on invasive tracking methods.
- Higher ad ROI: give Google Ads enough data to properly optimise campaigns, preventing under-reported conversions that drive up acquisition costs.
Where the setup includes a tagging server, consent is enforced in real time on your own infrastructure; see server-side tracking and consent-aware data pipelines.
What we deliver
- Complete GDPR and privacy audits: we assess your current data practices, identify risk areas and deliver a clear roadmap to full compliance. The audit goes much deeper than the cookie banner: it addresses all communication with third-party systems.
- Google Consent Mode v2 integration in Google Tag Manager or server-side tagging, as above.
- Cookie consent: there are many ways to implement it; we help you choose the right one and make sure the banner itself is compliant (reject button on the first layer, no pre-ticked boxes, equal buttons, a visible withdrawal mechanism on every page).
- Customised policy and procedure development: from cookie banners to data retention schedules, frameworks tailored to your business, and a privacy policy that is GDPR compliant.
- Advanced analytics and reporting: privacy-focused tracking methods, such as Google Analytics 4, which does not log or store IP addresses, for actionable insights without intrusive data collection.
- Ongoing compliance and support: data protection is an evolving field; we keep your policies and practices from falling behind.
What is at stake
- Regulatory complexity: keeping up with evolving data protection laws is time-consuming and confusing.
- Expensive non-compliance: fines for GDPR violations can reach up to €20 million or 4% of a company's annual worldwide turnover, whichever is higher.
- Weaker ad performance: without Google Consent Mode v2 you miss critical data from non-consenting users, resulting in incomplete conversion tracking and weaker Google Ads optimisation.
- Loss of customer trust: modern consumers want transparency; misuse of personal data or an opaque cookie policy can quickly damage brand reputation.
How an engagement runs
It starts with a privacy and consent audit: we review your current cookie consent setup, identify GDPR gaps and show you how to use Google Consent Mode v2 for more accurate analytics and ads. From there we deliver the action plan, implement it (or supervise your team doing so) and test the consent states against every tag. We work closely with your data protection officer and usually have a suggestion for how to improve the setup to protect you legally and protect your users' privacy. Timelines vary, but most businesses can establish a solid compliance foundation within a few weeks of the audit and recommended action plan.
Proof
For a hotel group we delivered GTM and tracking implementation with online loyalty and CRM integration and a focus on privacy, so measurement and consent were designed together rather than bolted on. Consent there runs through a consent management platform (CMP).
Common consent mistakes we fix
The EDPB Cookie Banner Taskforce listed the mistakes regulators see most often, and we keep finding them in audits: no reject button on the first layer, pre-ticked boxes, deceptive button colours, third-party tools claimed as legitimate interest, non-essential cookies classified as essential and no withdrawal mechanism. We walk through each in common mistakes and pitfalls of GDPR cookie consent modals. For the measurement side of the same problem, read server-side tracking: the quiet revolution behind modern data accuracy, and for the implementation, see our analytics and server-side tracking service.
Questions we are often asked
How long does it take to become GDPR compliant?
Timelines vary, but most businesses can establish a solid compliance foundation within a few weeks of our detailed audit and recommended action plan.
What if I already have a basic cookie banner?
A simple banner may not meet GDPR standards or integrate with Google Consent Mode v2. We will ensure your consent platform is fully compliant and integrated with all tracking tools.
Is Consent Mode v2 only for Google Analytics?
Primarily it is built around Google Ads and Analytics, but it can also influence how other third-party tags handle data based on consent signals.
Do I need a consent management platform, or can it be a custom implementation?
Both work. Consent Mode v2 can be implemented through a CMP or as a custom implementation with a correct Google Tag Manager setup. There are many ways to implement cookie consent; we help you choose the right one for your site and your tag stack.
Do you offer ongoing support after the initial setup?
Absolutely. We provide continuous monitoring, policy updates and staff training to keep your compliance and analytics strategy current.
I have copied a privacy and cookie policy from a similar business. Is that OK?
No. A privacy policy has to describe what your business actually does with personal data: who you are, which data you collect and why, the legal basis for each purpose, who receives it, how long you keep it, whether it leaves the EU, and how people can use their rights (GDPR Articles 13 and 14). A cookie policy has to list the cookies and tools on your own site. Someone else's policy describes their processing and their tools, so it is almost certainly wrong for yours, and a policy that does not match what really happens is a transparency problem in itself. It may also be someone else's copyrighted text. We check what your site and your business really do, and the policy is written from that.