Start learning free

Guide · Analytics · 3 min read

Consent, privacy and CRO: What cookie rules mean for your data and your tests

How cookie consent affects CRO: what EU and UK guidance says, what consent does to analytics and A/B test data, Google Consent Mode, and practical setups.

By Phil the CRO Guy

Phil the CRO Guy

Your CRO guide at Mentorele

Phil walks you through every lesson and case study. He asks the questions you might be too polite to ask, and he's happy to admit when a test didn't win. Every lesson he presents is checked by a real CRO expert.

Learn more about MentoreleMeet Phil

Expert-reviewed by Filip Doneski

Filip Doneski

CRO Expert and Strategist · Partner and Lead CRO Strategist at Wavesy

10+ years in conversion optimization and experimentation for DTC, retail and SaaS. Reviews every Mentorele lesson for accuracy before it’s published.

A/B testingConversion rate optimizationDigital psychology and persuasion

Filip’s expertise at WavesyLinkedIn profile

Updated

This guide summarises public regulator guidance for practitioners. It is not legal advice.

The short answer

Privacy rules decide who your analytics and testing tools can measure. That changes your data in ways that matter for CRO:

  • In the EU, analytics cookies generally need opt-in consent.
  • In the UK, a newer statistical purposes exception can allow some analytics without consent, with conditions.
  • Everywhere, consent and ad blockers mean your tools see a sample, not everyone.

What the guidance says

EU (GDPR and ePrivacy)

Under GDPR, valid consent must be freely given, specific, informed and unambiguous. The European Data Protection Board’s guidance adds points that matter for banners (EDPB, 2020):

  • Cookie walls (no access unless you accept) don’t produce valid consent.
  • Scrolling or continuing to browse is not consent.
  • Withdrawing consent must be as easy as giving it.

UK (PECR)

PECR requires consent to store or access information on a device unless an exception applies. Following the Data (Use and Access) Act 2025, the ICO’s guidance describes a “statistical purposes” exception, which can cover some analytics when people are given clear information and a simple means of objecting (ICO). The conditions matter, so read the guidance before relying on it.

Elsewhere

Many places, including most US states, allow analytics by default with an opt-out, though some state laws and sector rules add requirements. Check what applies to your audience.

  • Totals undercount. If 60% of visitors accept, analytics sees roughly 60% of sessions. Your backend orders won’t match analytics purchases.
  • Rates may be biased. People who accept cookies may behave differently from those who don’t. Conversion rates are estimates for consenting users.
  • Trends can break. Changing your banner changes who you measure. Note the date in your tracking plan.
  • Tests see consenting users only (if your testing tool needs consent). Results apply to that group; that’s usually fine, but say so.

Consent Mode lets Google tags adjust to the consent state, using signals such as analytics_storage and ad_storage, and supports different defaults per region (Google for Developers). It’s a technical layer. It doesn’t make your setup compliant on its own: you still need a fair banner and records of choices.

An honest setup that keeps data useful

  1. Ask clearly. One short sentence, equal Accept and Reject buttons, a link to the privacy policy.
  2. Set defaults by region to match the rules that apply.
  3. Make changing your mind easy: a “Cookie settings” link in the footer.
  4. Measure the consent rate itself (in aggregate), so you know how big your sample is.
  5. Use first-party backend data (orders, sign-ups) as the source of truth for business totals.
  6. Treat the banner as a page element: it shouldn’t cover the main content or the buy button on mobile.

What to do next

Note your consent setup and its start date in your tracking plan, and see GA4 for CRO for reading the data you do have.

Frequently asked questions

Do I need consent for analytics cookies?

In the EU, generally yes: analytics cookies aren't strictly necessary, so they need opt-in consent. In the UK, a 'statistical purposes' exception introduced by the Data (Use and Access) Act 2025 can cover some analytics if people get clear information and a simple way to object, with conditions. Elsewhere, rules vary. Check with a privacy lawyer for your situation.

Does Google Consent Mode make my site compliant?

No. Consent Mode tells Google tags how to behave based on the consent state. You still need a lawful consent setup: a clear banner, real choices and records.

Can I A/B test visitors who reject cookies?

Testing tools usually store the assigned variation on the device, which falls under cookie rules. Some setups run server-side or without storage. Treat test tools like analytics: check whether consent is needed for your setup and region.

Sources (3)

  1. Guidance on the use of storage and access technologies. Information Commissioner's Office (UK). Accessed 14 November 2026.

Search lessons, guides, case studies and templates. Press Esc to close.