Consent Mode v2 without losing the visits that did consent
In short
Consent Mode controls Google tag behaviour; it is separate from your own touchpoint capture. A first-visit gap can occur when the server checks before consent is granted. Test a capture triggered after acceptance, and distinguish consented tracking, cookieless measurement and the operational order record.
What Consent Mode v2 asks for
The signals ad_user_data and ad_personalization describe permission to use data for advertising and personalisation. Send the default state and update it after the visitor's choice, following Google's implementation guide.
Consent Mode is a technical signalling mechanism. It does not obtain consent on its own or establish the legal basis for your other processing.
What you can measure after a refusal
Separate three cases. Basic Consent Mode blocks Google tags before consent. Advanced Consent Mode can send measurements without cookies while consent is denied; modelled conversions are estimates, not recovered individual purchase paths. Google describes both modes.
Your store also needs operational records to fulfil an order. Those records do not automatically permit advertising profiling. Assess each purpose and implementation separately; a first-party cookie or server-side endpoint does not turn a refusal into permission.
The gap that loses your consented visits
This failure can occur when consent is checked only during the initial server request.
A visitor arrives from an ad. The URL carries utm_content, gclid, whatever your tagging puts there. The consent banner appears. At this moment the consent cookie does not exist — the question has been asked and not answered.
Server-side capture runs early in the request. It checks consent, finds none, and correctly skips. The visitor then accepts the banner. But the request that carried the campaign parameters is over, and the next page view has a clean URL.
The visit that named the campaign is gone, and consent was given.
The fix is not more server-side code. It is a small client-side listener that fires on acceptance and posts the parameters — still sitting in the address bar — to an endpoint that captures with consent now verified. In our plugin that endpoint is loyalz_tp_capture, registered for logged-out visitors as well as logged-in ones, which can matter when the visitor is not logged in on the first visit.
The gap depends on when acceptance happens and whether another request still carries the parameters. Test it on your own landing pages, including pages served from cache.
What the chain records once consent exists
| Field | Source | Why it is there |
|---|---|---|
ad_id | utm_content | Ties the visit to one creative, not just a campaign |
utm_* | URL | Source, medium, campaign, term |
gclid, fbclid, ttclid, msclkid | URL | Click ids from Google, Meta, TikTok, Microsoft |
referrer, landing_url | Request | Host and path only, not the query string |
ts | Server | ISO-8601, UTC |
In the local plugin source reviewed on 24 September 2026, the chain holds at most 20 touchpoints with a 90-day limit. The cookie is HttpOnly and SameSite=Lax, with Secure enabled on HTTPS. The chain is attached to an order at checkout; that hook is not itself confirmation of payment.
The visitor identifier is generated from 128 random bits. Random generation does not make an identifier anonymous: linking it to behaviour, an order or an email can make it personal data. The normal funnel-event path checks marketing consent and requires an existing visitor identifier.
Traffic with no campaign markers is still classified — direct, organic or referral, derived from the referrer — so those channels appear in the path instead of being a blank. Internal navigation is skipped, so a browsing session does not manufacture twenty touchpoints out of page views.
The question a consent gate cannot answer for you
The reviewed plugin has exceptions that matter when testing consent. Its newsletter-conversion endpoint creates an identifier without calling the normal marketing-consent check. A configurable consent source can also be set to always allow capture. These are observed code paths, not a statement that their use is compliant in a particular store.
A newsletter submission should not be treated as automatic permission for every advertising purpose. Review the information shown, the purposes covered and the actual tag behaviour. Test the refusal, acceptance and withdrawal paths separately. GDPR Article 4 and recital 30 explain why online identifiers and purpose-specific processing matter.
This article is based on a local source review, not a compliance assessment of a deployed store. For the technical checks, see WooCommerce conversion tracking and WooCommerce measurement. Loyalz acquisition measurement describes the product workflow.
Common questions
Can I track users who refuse consent?
Do not treat a refusal as permission for advertising tracking. Operational order processing and any cookieless or modelled measurement are separate cases with their own requirements. Check the purpose and configuration rather than assuming that all collection is either allowed or impossible.
Does server-side tracking bypass consent requirements?
No. Where the code runs has no bearing on whether you have a lawful basis to record something. Server-side capture solves reliability problems — blockers, dropped pages, broken scripts — not consent ones, and any pitch that blurs those two is worth reading twice.
What is the consent-timing gap?
If the server checks before consent is granted and no later request captures the landing parameters, the first touchpoint can be lost. A post-acceptance capture with a fresh consent check can address this. Test navigation and caching as well.
Is a first-party visitor id personal data?
It can be. An online identifier may relate to an identifiable person even when randomly generated and not derived from an email or IP address. Assess what it links to and how it is used; pseudonymous does not mean anonymous.
See it on your data
On a twenty-minute call we connect one ad account and one month of your orders, and work out the gap between what the platform claims and what your shop took. Profit and POAS stay blank until you enter your margin and costs per order.
Book a demo