DTC measurement under GDPR: what consent does to your data
Consent decides which visits analytics can tie to a person, so GA4's user and session counts cover consenting visitors plus modelled estimates. Record your consent rate, every banner change and what GA4 receives, and compare orders by region.
By Joris van Huët, Founder & CEOPublished 5 min read
Consent decides which visits your analytics can tie to a person, so GA4's user and session counts cover consenting visitors plus whatever modelling estimates, and how many visitors consent depends on your banner. In a small field experiment with 40 participants, removing the opt-out button from the first page of a consent pop-up increased consent by 22 to 23 percentage points (Nouwens et al., a peer-reviewed CHI 2020 paper). That tells you how much design moves consent, not what your own rate is: your consent platform reports that.
What does consent change in the data you can see?
Regulators set the conditions. The EDPB's April 2026 summary says valid consent must meet four cumulative criteria, and that silence, pre-ticked boxes or inactivity do not constitute consent. The CNIL says operators must not read or write data on a user's device before obtaining consent, except in some situations, and must be able to prove they obtained it (19 July 2019). In the Netherlands, the government's business portal says you must ask explicit consent for tracking cookies, while analytical cookies with no or little impact on visitors' privacy need none. Whether a particular tag needs consent in your country is a question for your counsel and your regulator, not for an analytics post.
What changes in your data is identity. Google says that without consent, Analytics cannot tell whether a set of page views came from one user or many, and Shopify says its session count includes only visitors who consent to cookies through your cookie banner. So a hand-made orders-per-session figure rises when consent falls, with no change in buyers.
How much does the banner move consent?
Design moves consent by measurable amounts in two studies. Nouwens et al. also scraped the five most popular consent platforms on the top 10,000 UK websites (n=680) and reported that only 11.8% met the minimal requirements they set from European law. Utz et al. (ACM CCS 2019), also peer-reviewed, ran three experiments with more than 80,000 unique users on a German website and reported that seemingly small implementation decisions can substantially impact whether and how people interact with consent notices. Both measure how design moves consent, in the settings they describe. Neither gives a typical rate for a DTC store, and this post cites no figure for one because none was verifiable.
What does modelling fill in, and where does it stop?
Google says Analytics applies machine learning to estimate the behavior of visitors who decline consent from the behavior of similar visitors who accept. Google's prerequisites for behavioral modeling include at least 1,000 events per day from visitors who denied analytics consent for at least 7 days, and at least 1,000 daily users who granted it on at least 7 of the previous 28 days. Three things switch it off or limit it. Blocking Google tags until the visitor consents (Google's basic implementation) means no modelled data. A consent platform built on the IAB Europe framework (TCF) means Google Analytics cannot model data for visitors who deny consent. And Google lists features that do not use modelled data, including audiences, retention reports and the BigQuery export, so a BigQuery export holds no modelled data.
What should you record?
Five things, with a pass and a fail:
- Your consent rate and every banner change. Weekly accepted, rejected and no-choice shares from your consent platform, plus the date of each banner or wording change. Pass: each step change in your GA4 numbers lines up with a change you can name. Fail: a step with no change on your side, which points at tagging, not consent.
- What GA4 receives. In Admin, under Data collection and modification, open Consent settings: Google says the top of the page can show the percentage of your traffic and conversions coming from the EEA, and flags missing consent signals. Pass: signals present. Fail: the page flags them as missing.
- Whether modelling can run. Check your implementation type and the data-quality icon on the report, which says whether estimated user data is included. Pass: advanced implementation, Blended reporting identity and both volume prerequisites met. Fail: any of the three limits above, so no modelled data fills the gap.
- Orders by region. For one closed month, compare Shopify orders with GA4 purchases by shipping country. Pass: GA4 purchases as a share of Shopify orders are lower where consent is required and shift when the banner changes. Fail: the share is the same everywhere, which points away from consent.
- Records of consent. The EDPB says controllers are responsible for demonstrating that valid consent was obtained, so keep what your consent platform logs: the wording shown, the choice and the time.
Sources, 30 September 2026: Consent under GDPR: When to act and what to do (European Data Protection Board, April 2026); Cookies and other tracking devices: the CNIL publishes new guidelines (CNIL, 2019); Cookies on your website (Netherlands Enterprise Agency, business.gov.nl, read 30 September 2026); Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence (Nouwens et al., CHI 2020); (Un)informed Consent: Studying GDPR Consent Notices in the Field (Utz et al., 2019); Behavioral modeling for consent mode, Consent mode overview and Verify and update consent settings in Google Analytics (Google Analytics Help, 2026); Analytics data points (fields) reference (Shopify Help Center, 2026).
Related answers
Frequently asked questions
Does GDPR stop me measuring ad performance in the EU?
It limits what you can link to a person without valid consent. The EDPB sets what valid consent is, and the CNIL says operators must not read or write data on a device before consent, with some exceptions. Ask your counsel which of your tags need it.What does Google consent mode do when a visitor declines?
With advanced implementation, Google tags still load and send cookieless pings that feed modelling. With basic implementation they are blocked, and Google says you get no modelled data. Modelling also needs enough consented and denied traffic.How many visitors does Google need to model missing data?
Google's prerequisites are at least 1,000 events per day from visitors who denied analytics consent for at least 7 days, and at least 1,000 daily users who granted it on at least 7 of the previous 28 days. Meeting them does not guarantee eligibility.
Go deeper: Causal attribution, explained.
Sixty-second versions of these ideas: Causality Engine on YouTube Shorts.
Keep reading
Terms in this article
- AttributionAttribution identifies user actions that contribute to a desired outcome and assigns value to each. It reveals which marketing touchpoints drive conversions.
- Attribution ReportAttribution Report shows which touchpoints or channels receive credit for a conversion. It identifies which campaigns drive desired actions.
- ConversionConversion is a specific, desired action a user takes in response to a marketing message, such as a purchase or a sign-up.
- Dark PatternsDark patterns are user interfaces designed to trick users into unintended actions. These deceptive practices should be avoided.
- ExperimentsExperiments are scientific procedures that test hypotheses or demonstrate facts. In marketing, experiments like A/B tests determine the causal effect of campaign changes, enabling data-driven decisions.
- First Party DataFirst-Party Data is data collected directly from your audience or customers. This data provides the most valuable insights for marketing.
- Google AnalyticsGoogle Analytics is a web analytics service that tracks and reports website traffic.
- Machine LearningMachine Learning involves computer algorithms that improve automatically through experience and data. It applies to tasks like customer segmentation and churn prediction.