Case study · Privacy · Consent Mode · Email
Consent
you can prove.
The site had a cookie banner with three toggles, and a newsletter list built up over years. Both looked compliant. Neither could show that anyone had actually agreed to anything.
- 0
- tracking before a visitor chooses
- 100%
- of the old list asked to opt in again
- 2
- steps, so an email scanner can’t “consent”
Summary
Problem
“Only essential” and “Accept all” produced identical tracking, and nobody could show how the newsletter contacts had opted in.
Solution
Analytics and advertising storage off until a visitor chooses, every tracking feature built to respect that choice, and a newsletter list rebuilt from people who said yes.
A banner that changed nothing
Asked whether visitors “should be accepting cookies” for analytics, I checked the code instead of answering from memory. The banner saved the visitor's choice, and nothing ever read it: analytics started on every page load, before the banner appeared, whatever anyone clicked.
Fix: Google Consent Mode v2. Everything starts denied, a previous choice is read before analytics loads, and a new choice applies immediately. The choice is also mirrored into a cookie, because the server-side lead events need to respect it too and can't read the browser's storage.
Every feature built on top of it
- Server-side lead events are sent only when analytics consent exists, and every skipped one is logged as “skipped, no consent”, not as an error.
- Ad attribution needed a 90-day cookie to match Google's window. It's written only with marketing consent, promoted the moment someone accepts mid-visit, and deleted if they withdraw.
- The cost was stated, not hidden: recorded traffic halved, because analytics now only counts people who agree. Most of the drop was bots.
A list nobody could prove
The newsletter list had no record of how any of its contacts had opted in. Emailing them as if they had wasn't defensible, so the campaign didn't “re-verify” consent: it asked for it from scratch.
The flow is deliberately two steps. The email links to a page with a Confirm button, and only that click records consent. Corporate email security tools open every link in an email to scan it, and a one-click link would have registered “consent” from a scanner on exactly the list this was meant to clean.
- Signed, expiring tokens, so a confirm link can't be forged or guessed. No new database.
- A separate endpoint from the live sign-up flow, so the campaign couldn't break new sign-ups.
- Tokens written to every contact through the API: 100% updated, none failed. Confirmed contacts land with their source and a fresh consent timestamp.
- Tested end to end on a real address, then checked the result in the email platform's API, not in the campaign report.
The campaign is ready and waiting for the business owner's go-ahead to send. Building it was my decision; sending to the whole list is theirs.
“Track what helps the business. Prove the people being tracked agreed to it.”