/pulse

Privacy & Consent Management

2025-2026 Regulatory Timeline (must-know dates)

Tactical posture for 2026: assume third-party cookies persist in Chrome, but treat them as legally hazardous (GDPR/ePrivacy still applies). Default to server-side first-party tracking + Consent Mode v2 Advanced (cookieless pings + behavioral modeling) — Advanced Mode recovers ~70% of denied-consent conversions when ≥1,000 daily denied events sustain for 7 days.

Consent Management

// lib/consent.ts
type ConsentCategory = 'analytics' | 'marketing' | 'functional';

interface ConsentState {
  analytics: boolean;
  marketing: boolean;
  functional: boolean;
}

export function getConsentState(): ConsentState {
  const stored = localStorage.getItem('user_consent');
  if (stored) {
    return JSON.parse(stored);
  }
  return {
    analytics: false,
    marketing: false,
    functional: true
  };
}

export function setConsentState(consent: ConsentState) {
  localStorage.setItem('user_consent', JSON.stringify(consent));

  // Update analytics based on consent
  if (consent.analytics) {
    enableAnalytics();
  } else {
    disableAnalytics();
  }
}

export function hasConsent(category: ConsentCategory): boolean {
  return getConsentState()[category];
}

Google Consent Mode v2 — required signals

The CMP must forward all four signals (defaults denied, updated after user choice) to Google tags before any GA4 / Google Ads event fires:

// Default (before consent) — denied
gtag('consent', 'default', {
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  analytics_storage: 'denied',
  wait_for_update: 500
});

// After user choice — update
gtag('consent', 'update', {
  ad_storage: userConsent.marketing ? 'granted' : 'denied',
  ad_user_data: userConsent.marketing ? 'granted' : 'denied',
  ad_personalization: userConsent.marketing ? 'granted' : 'denied',
  analytics_storage: userConsent.analytics ? 'granted' : 'denied'
});

Common failure modes (each silently kills EEA/UK measurement):

• CMP loads after gtag (signals arrive too late).
• Only analytics_storage is signaled (ads parameters missing → Google Ads goes blind).
• Banner cosmetic-only (no actual signal wiring) — most common WordPress failure.
• Forgetting wait_for_update → events fire before consent resolves.
• Using ad_storage='granted' based on functional instead of marketing consent.

After 2026-06-15: ad_storage is the only knob for Google Ads data; treat the GA4 Google Signals toggle as a reporting-only setting that does not stop ad data collection.

Privacy-Safe Tracking

// Track only with consent
export function trackEventWithConsent(
  eventName: string,
  properties?: Record<string, unknown>
) {
  if (!hasConsent('analytics')) {
    return;
  }

  // Remove PII from properties
  const safeProperties = removePII(properties);
  trackEvent(eventName, safeProperties);
}

function removePII(
  properties?: Record<string, unknown>
): Record<string, unknown> | undefined {
  if (!properties) return undefined;

  const piiFields = ['email', 'phone', 'name', 'address', 'ip'];
  const safe = { ...properties };

  piiFields.forEach(field => {
    if (field in safe) {
      delete safe[field];
    }
  });

  return safe;
}