Field notes on consent, tracking &amp; the money it moves .

17 Sept 2026 · 8 min read

Benchmarks

We scanned 37 California court-ordered course sites. 81% had no CMP.

A behavioural scan of a regulated US education vertical. The failure rate matches our UK clinic benchmark. The composition behind it is the reverse.

17 Sept 2026 · 11 min read

The "Do Not Sell or Share" link: what has to happen after the click

The link is the half anyone can see. California gives you 15 business days to actually stop, and requires you to tell every third party you already shared with.

16 Sept 2026 · 8 min read

Global Privacy Control: the setting that quietly disables it

GPC is a legally recognised opt-out in California, and every browser must ship one by 2027. Most CMPs support it — per banner. Check the right one.

11 Sept 2026 · 10 min read

Sending some GA4 events client-side and the rest server-side

A hybrid split is real, but not where people think. The transport switch is all-or-nothing — the useful split happens inside the container, not in the browser.

10 Sept 2026 · 9 min read

Google Ads conversion tracking, and what consent does to it

A correctly configured tag still under-reports once a consent layer sits in front of it. Where the conversion goes, and how to tell that from a broken tag.

10 Sept 2026 · 10 min read

Setting up GA4 so the numbers survive a consent banner

A standard GA4 install ships with no consent values set at all. Four settings decide whether a visitor who declines is counted, and none is in the setup wizard.

10 Sept 2026 · 11 min read

Uploading a customer list to Google Ads under UK rules

The ICO treats the upload itself as direct marketing, not preparation for it. What Customer Match sends, and why the April 2026 move changed nothing legally.

10 Sept 2026 · 11 min read

Cookieless tracking: four techniques, four failure modes

The label covers four unrelated techniques. Sort them by what breaks each one — consent, Safari, a blocker, or a regulator — and the shopping list gets shorter.

First-Party Data

First-party data: the term everyone sells and nobody defines

Data a customer gave you directly, that you have a lawful basis to use for this purpose. Vendors quote the first half of that and skip the second.

8 Sept 2026 · 9 min read

8 Sept 2026 · 10 min read

Enhanced conversions for leads: what it recovers and what it can't

It rejoins a lead to the click that produced it — for people who handed over their details. For everyone else it does nothing, which is not a tracking fix.

Does Google Tag Gateway change anything for consent?

No. It changes where the script is served from, not whether the tag was allowed to run — and it makes an existing pre-consent leak harder to spot.

7 Sept 2026 · 6 min read

First-Party Data

Google Data Manager: the five upload pipelines it replaced

What the Data Manager API consolidates, which Google Ads API doors have already closed, and why the grandfather rule is a shut window rather than a rolling one.

7 Sept 2026 · 9 min read

First-Party Data

Data Manager's consent fields are optional. That's the problem.

The Data Manager API accepts an upload with no consent state attached. Why acceptance isn't permission, what Google's policy still requires, and who carries it.

7 Sept 2026 · 9 min read

Instagram DM traffic in GA4: why it lands in Direct and Unassigned

A DM click arrives with no campaign and often no referrer, so GA4 files it where nothing can be decided. The tagging that survives a message, and what it can't fix.

1 Sept 2026 · 9 min read

Dataviz

Building a GA4 dashboard in Looker Studio that doesn't sample

The GA4 connector samples above your property's quota and shows no warning. Where that happens, why blends are slow, and what BigQuery does and doesn't fix.

17 Aug 2026 · 8 min read

GA4 vs Universal Analytics: the model changes that catch people out

A GA4 session isn't a UA session, events lost category and label entirely, and the UA data you'd compare against was deleted in July 2024.

17 Aug 2026 · 7 min read

GA4 User-ID: what it fixes, what it doesn't, and consent

User-ID joins sessions for people who log in. It is not a workaround for consent, and the UK analytics exception does not cover it.

13 Aug 2026 · 9 min read

GA4 recommended, automatic and custom events: which to use when

Use Google's recommended event name whenever one exists. A custom name carrying identical data buys you an exploration row and an empty report shelf.

13 Aug 2026 · 8 min read

GA4 Measurement Protocol: what it can and can't do

It adds events to a session it cannot create. Without a client_id and session_id from a real online visit, your server events land as (not set) / (not set).

13 Aug 2026 · 8 min read

GA4 funnel and path explorations: when they lie to you

Explorations sample, threshold and expire data differently from standard reports. Four documented reasons the same funnel gives you two numbers.

13 Aug 2026 · 9 min read

GA4 ecommerce events: the required parameters nobody validates

Google marks currency and value required with an asterisk, then reports nothing when they're absent. What actually breaks, and the checks that catch it.

11 Aug 2026 · 9 min read

BigQuery

GA4 BigQuery export: what the schema gives that the interface won't

Link it today even if you won't query it for months. Nothing before the link date arrives later, and the daily export caps at a million events.

11 Aug 2026 · 9 min read

GA4 custom dimensions: event vs user scope, and the limits that bite

Scope is permanent, archiving can't be undone, and registration controls reporting, not collection. Pick event scope unless the value describes the person.

10 Aug 2026 · 9 min read

GA4 cross-domain tracking: the setup, and how to prove it works

The setting lives in the Google tag, not in GTM. The linker parameter expires after two minutes. And if you still see self-referrals, it isn't working.

10 Aug 2026 · 9 min read

GA4 'Unassigned' traffic: the causes, in the order to check them

Unassigned is the bucket GA4 uses when nothing matches. Here's the diagnostic order, including the consent-timing cause that never shows up in a UTM audit.

5 Aug 2026 · 7 min read

GA4 attribution models: which one your reports are using

Three models survive, the thresholds people quote for data-driven belong to other products, and switching model rewrites your history. What to check and change.

5 Aug 2026 · 7 min read

GA4 DebugView: why your events don't show up, and what it hides

DebugView shows what your browser sent, with your consent state, from your tag setup. It is a view of one device — not of what real visitors send.

4 Aug 2026 · 8 min read

What Cross-network means in GA4, and why it hides your Ads spend

Cross-network is where GA4 files Performance Max and Demand Gen traffic. It is a channel grouping, not a tracking leak — and Display spend is moving into it.

4 Aug 2026 · 9 min read

Engaged sessions, engagement rate and bounce rate in GA4

GA4's bounce rate is engagement rate subtracted from 100, and engagement has a mechanical definition. Neither compares to the Universal Analytics number.

3 Aug 2026 · 8 min read

Consent Mode on an SPA: why tags fire twice, or not at all

The consent default has to run before React hydrates, a Once-per-page tag fires once for the whole visit, and two things are probably counting your route changes.

3 Aug 2026 · 9 min read

30 Jul 2026 · 11 min read

Proving consent: what a regulator actually asks for, and how to log it

What a consent record must contain under UK law, how long to keep it, what your CMP actually logs, and why those records don't survive a change of CMP.

Cookiebot

Switching off Cookiebot? Seven things to check before you do

Cookiebot pricing scales with subpages and domains, so people migrate. Here's what actually breaks in a CMP swap, and how to verify the site before and after.

29 Jul 2026 · 10 min read

Your opt-in rate is a conversion rate: what moves it, legally

Which consent banner changes are legitimate design and which ones regulators have named. Plus the arithmetic for what a point of consent rate is worth.

29 Jul 2026 · 9 min read

Server-side tagging doesn't beat ad blockers. What it recovers

Three separate buckets of lost data get sold as one. Only one of them is worth paying a tagging server to fix, and it isn't the one in the pitch.

28 Jul 2026 · 8 min read

"Pay to reject cookies": is it legal in the UK and EU?

The ICO says consent or pay can be lawful under four conditions. The EDPB says most large platforms will fail. What each requires, and what it costs your data.

28 Jul 2026 · 9 min read

27 Jul 2026 · 11 min read

GA4 traffic dropped after your cookie banner: the four causes

Part of the drop is real and correct. The rest is one of three install faults. How to tell which you have in ten minutes, and what the arithmetic actually is.

Google Tag Gateway vs server-side GTM: what each fixes

They're not alternatives, and Google's own documentation recommends running both. What each one actually does, and what neither of them touches.

26 Jul 2026 · 6 min read

Basic vs Advanced Consent Mode: what modelling recovers

Advanced gives Google more to model with. It is not a data-recovery machine, and most properties never hit the thresholds that switch modelling on at all.

26 Jul 2026 · 6 min read

Server-side GTM hosting: Cloud Run vs Stape vs self-hosted

A vendor-neutral comparison of the three ways to run a tagging server, with verified 2026 pricing — plus what nobody selling it will tell you.

25 Jul 2026 · 8 min read

Google-certified doesn't mean compliant: how to actually choose a CMP

Certification tests whether a CMP product can pass consent signals — not whether your installation does. The published research says almost nobody's does.

25 Jul 2026 · 6 min read

Google Ads vs GA4 conversions: which number to trust

The two counts will never match, and one of them shouldn't be driving your bidding. Why they differ, and which is right for which job.

25 Jul 2026 · 6 min read

Enhanced conversions vs offline import: which do you need?

They look like rival answers to one problem. They aren't. One recovers attribution; the other tells Google what a lead was worth. Most lead-gen accounts need both.

25 Jul 2026 · 7 min read

Benchmarks

We scanned UK private clinics for consent leaks. 37% failed.

A behavioural scan of private UK dental, aesthetic and physio sites. The problem wasn't missing cookie banners — it was banners that block nothing.

8 Jul 2026 · 4 min read