2025-06-04 · Baduno Editorial Team · 7 blog.readMin · Blog & Knowledge
GDPR-Compliant Tracking: What Still Works Today – and How
Between 'we measure nothing anymore' and 'we just risk it' lies a solid middle ground: clean consent management plus data-minimizing tools.
The Legal Situation in One Paragraph
Technically necessary processing is exempt from consent; statistics and marketing require informed, voluntary consent before setting cookies. 'Legitimate interest' does not justify reach tracking under current supervisory practice.
Consent That Counts
Real choice (reject as easy as accept), granular purposes, revocation at any time, traceability. Dark patterns in the banner are not only unprofessional – they render the consent invalid and thus the measurement unlawful.
Toolbox
GA4 with Consent Mode v2 for campaign ecosystems; data-minimizing alternatives (e.g., self-hosted, cookieless analytics) for basic metrics without banner dependency. Combined, both cover most needs honestly.
Documentation
Processing register, privacy policy, and banner must tell the same story. Reconcile once a year – discrepancies between paper and practice are the classic finding in every audit.
Choosing the right Consent Management Platform
Choosing a Consent Management Platform (CMP) is a strategic decision. Look for certifications such as the IAB Europe TCF or the GDPR template – these facilitate legal recognition. Avoid providers that use pre-ticked consents or dark patterns. Check whether the CMP allows granular purpose selection that you can configure yourself (e.g., 'Statistics' and 'Marketing' separate). Example: An online shop requires a separate marketing category for its Facebook Pixel integration, which the customer can reject without impairing the shop's basic functions. Choose a CMP that offers a 'Reject All' button equivalent to 'Accept'. Additionally, the CMP should provide an interface for Consent Mode v2 or Google Tag Manager to pass consent cleanly to external services. Document which CMP you chose and why in your processing register.
Properly manage data retention and deletion periods
The GDPR requires that personal data be stored only as long as necessary for the purpose. For tracking data, this means: set a deletion period for each processing and implement it automatically. Example: Newsletter tracking stores open and click data – delete it after 12 months if the purpose (campaign optimization) is no longer current. For analytics data, you can anonymize or delete raw data after 26 months; GA4 offers a data retention setting for this. Document the periods in your privacy policy and processing register. Regular checks (annual) for data no longer needed prevent legacy issues and reduce your risk during regulatory audits. Use tools such as database scripts or analytics settings to automate deletion.
Implement data subject rights efficiently
In addition to consent, you must also handle data subjects' requests for access, deletion, and data portability. For tracking data, this means: a user can request to view and have all stored analytical or marketing data about them deleted. Implement a process: ask the user to send an email with an identifier (e.g., Client ID from GA4), and ensure that you can locate and delete this data in your systems (CMP, analytics tool, CRM). Example: A customer withdraws consent via the banner; consequently, the already collected data must also be removed from your analytics account – either via a deletion script or through the tool's API. The GDPR grants you one month to comply. Keep this transparent in your privacy policy. Manual processing is acceptable, but automated workflows reduce errors and effort.
Between 'we measure nothing anymore' and 'we just risk it' lies a solid middle ground: clean consent management plus data-minimizing tools.
Server-Side Tracking as a privacy-friendly alternative
Server-Side Tracking (SST) shifts data collection from the browser to your own server. This allows you to control cookies and tracking pixels, shorten IP addresses, and anonymize data before sharing with third parties. SST is not a free pass for tracking without consent: if personal data is processed, a legal basis (consent or legitimate interest) is still required. However, with SST you can collect cookieless metrics (e.g., page views without storage) that do not require consent. Example: An e-commerce shop measures the number of orders per day server-side without a user ID – this is statistical analysis without personal reference. Combine SST with a CMP that only requires consent for marketing tracking. Document in the processing register which data is collected server-side without personal reference.
Consistently implement IP anonymization and data minimization
The IP address is personal data – even setting a cookie without consent is impermissible if the IP is stored alongside it. Therefore, GDPR-compliant tracking relies on data minimization and anonymization. A proven method is IP anonymization already at the point of collection: truncate the last octets of the IPv4 address or set the entire address to zero once the location has been determined at the country level. GA4 offers the 'IP anonymization' function, which should be activated by default. Additionally, you should limit tracking data to the essentials: do not capture User IDs, detailed device data, or browser fingerprints unless they are strictly necessary for your analysis. For example, a simple visitor statistic requires only page views, country of origin, and browser type – not email addresses or session IDs with personal reference. Combine this with a privacy-friendly CMP that only allows full data for marketing purposes. Document in your processing record which data minimization measures you have implemented. Regularly review whether you really need every field. Less data means less risk in the event of an audit by the supervisory authority.
Digitize audit trail and proof obligation for consents
The obligation to provide proof under Art. 7 GDPR requires that you can demonstrate at any time that a user has given valid consent. Manual logging is not sufficient – you need a digital audit trail that stores the complete consent history: which banner was shown to which user at what time, what selection they made, and when consent was withdrawn. Modern CMPs automatically log this with timestamps and User IDs (e.g., from the client ID or a pseudonymous identifier). Ensure that your CMP stores this data in a GDPR-compliant manner, i.e., separate from analytics or marketing data. Example: A user clicks 'Reject' – your system must document this process and be able to provide information upon a later request. Implement a regular export of these logs (e.g., monthly) and retain them for the duration of the statutory limitation period (three years after the last processing). Avoid that the logs themselves become a data accumulation – delete them automatically after the period expires. Combine this with an access control concept: only a few administrators should have access to the raw data. This digital proof is your best defense against complaints or audits.
Multilingual consent banners and localization
If you operate a multilingual website, your consent banner must be available in all languages your site offers. This is not only a matter of usability but a legal requirement under the transparency principle (Art. 5 GDPR). The banner text, description of purposes, and cookie list must be correctly translated and culturally adapted. Purely automated machine translation can lead to inaccuracies, such as ambiguous legal terms or missing nuances. Therefore, the combination of AI translation and native-language review is ideal: AI provides speed, while the native speaker ensures legal precision. For example, the German term 'Einwilligung' may sound different in French ('consentement') or Polish ('zgoda'). Also, layout and button labels must be adapted to the length of the language – an 'Akzeptieren' button in German becomes 'Accepter' in French, but the design must still fit. Many CMPs allow uploading language files; ensure your translations are consistent across all purposes. Document which language versions you provide and who reviewed them. This not only fulfills the GDPR transparency requirement but also builds trust with international users.
Hreflang Tags and Tracking Data: Avoiding Duplicates and Misattribution
For multilingual websites, hreflang tags signal to search engines which language and regional version of a page is intended. But how does this affect your tracking? When a user switches between language versions, your tracking system might count them as multiple sessions if cookies are not correctly shared across subdomains or if the tracking code is language-independent. Example: A user lands on the German page (example.de/de/) and then switches to the English version (example.de/en/). Without proper configuration, GA4 may treat this as two different users. To avoid this, ensure your tracking is consistent across all language versions: Use a single property for all languages and set up cross-domain tracking if needed. Also, implement a language parameter in your dataLayer to segment traffic by language without losing user identity. Hreflang itself has no direct impact on tracking, but incorrect hreflang tags can lead to wrong attribution of traffic sources. Therefore, review your hreflang implementation annually and align it with your tracking setup. Document the relationship between hreflang, language folders, and tracking parameters in your SEO documentation. This is a typical area where AI can quickly generate hreflang sitemaps, but human review is crucial to avoid errors from automated mapping.
blog.faqT
Do I need consent for all cookies?
No. Technically necessary cookies (e.g., session cookies for the shopping cart) are permitted without consent, as they are required for the website's functionality. All other cookies, especially for statistics and marketing, require informed and active consent before being set.
Can I use Google Analytics without consent?
No, it is not compliant. Google Analytics processes personal data (IP address, User ID). Under current legal interpretations, you require consent for this. Alternatively, you can use a privacy-preserving, self-hosted analytics solution that does not involve personal data and thus does not require consent.
