Getting it right
Consent & privacy
Consent is both a legal obligation and the largest single controllable cause of missing data. Handled badly it costs you twice — once in signal, once in exposure.
This explains how consent mechanics interact with your marketing data, and what the requirements broadly are. It is not legal advice. For a binding view on your specific obligations, particularly around lawful basis and cross-border transfer, speak to a qualified data protection lawyer.
What applies to you #
| Regime | Applies when | What it primarily governs |
|---|---|---|
| POPIA South Africa | You process personal information in South Africa | Lawful processing, data subject rights, and — via section 69 — unsolicited electronic direct marketing |
| GDPR EU / EEA | You target or monitor people in the EU, wherever you are based | Lawful basis for processing, and consent for non-essential cookies via ePrivacy |
| Platform policies | Always, if you use Google or Meta advertising | Google's EU user consent policy and equivalents. Breach risks your ad account, which in practice bites faster than regulators do. |
POPIA in practical terms #
South Africa's Protection of Personal Information Act does not have a dedicated cookie clause the way the EU's ePrivacy Directive does. What it has is a requirement that processing personal information be lawful, and cookie and tracking identifiers are generally treated as personal information because they single out an individual.
The practical consequence, and current market standard, is an opt-in model: obtain consent before setting non-essential cookies or tracking technologies. In practice that means a banner that:
- Appears before any non-essential cookie or tag is set
- Explains, concisely, what you are collecting and why
- Offers Accept all and a genuinely equivalent Reject all — a reject option buried a level deeper is a common and pointed failure
- Offers granular preference management
- Lets people change their mind later, and records what they chose and when
Section 69 — direct marketing #
Section 69 prohibits unsolicited electronic direct marketing — email, SMS, automated calls — unless the recipient has given prior consent, or is an existing customer under specific conditions relating to similar products and a chance to opt out at collection.
The Information Regulator published guidance in late 2024 clarifying its position after a large volume of complaints. Every message must clearly identify the sender and provide an accessible opt-out. See Email and automation for why this is a data quality issue as much as a legal one.
POPIA provides for administrative fines up to R10 million and, for certain offences, imprisonment. The more common commercial reality is an enforcement notice, a public complaint, and the reputational cost that follows — which typically arrives faster and hurts more than the fine.
Consent Mode v2 #
Consent Mode is Google's mechanism for adjusting tag behaviour based on a consent state, rather than simply blocking tags outright. It sets four signals:
| Signal | Governs |
|---|---|
analytics_storage | Whether GA4 may set and read analytics cookies |
ad_storage | Whether advertising cookies may be set and read |
ad_user_datav2 | Whether user data may be sent to Google for advertising purposes |
ad_personalizationv2 | Whether data may be used for personalised advertising and remarketing |
The two v2 signals were added in 2024 and are required for Google advertising features in the EEA. Even outside the EEA, implementing them properly is now the sensible default — it is the same work either way and it future-proofs the setup.
The two modes #
Advanced mode
Tags load immediately in a restricted state. If consent is declined they still send cookieless pings containing no identifiers. This preserves aggregate signal and is what makes behavioural modelling possible.
Basic mode
Tags do not load at all until consent is granted. Declining means no data whatsoever — no pings, no modelling eligibility, a clean and total gap.
Advanced mode preserves considerably more measurement. It is also the more aggressive interpretation, since a ping is still transmitted after someone declined. This is a genuine judgement call, and it is one to make deliberately with legal input rather than by accepting a CMP's default.
Behavioural modelling eligibility #
Consent Mode is a prerequisite for GA4's behavioural modelling, but it is not sufficient. Your property must also meet Google's published thresholds:
- at least 1,000 events per day carrying
analytics_storage='denied', for at least 7 days, and - at least 1,000 daily users sending
analytics_storage='granted'events on at least 7 of the previous 28 days
Meeting the numbers does not guarantee it — Google applies further model-quality criteria. Most small and mid-sized properties never qualify, so if you have been told Consent Mode will “recover your missing data through modelling”, check the thresholds against your actual volumes first.
The commercial cost of getting it wrong #
Consent implementation is usually treated as a compliance checkbox handed to whoever installed the CMP. It has direct, measurable revenue consequences.
| Implementation problem | What it costs you |
|---|---|
| Banner blocks tags but Consent Mode is not configured | Total data loss from decliners, and no modelling eligibility ever. The most common setup, and the most wasteful. |
| Consent signals not passed to Google Ads | Conversion tracking degrades, smart bidding loses signal, campaign performance drops for reasons nobody connects to the banner |
| Banner design nudging toward accept | Regulatory exposure, and a consent record that will not survive scrutiny |
| Banner design making reject too easy to hit by accident | Unnecessarily low consent rate, and correspondingly less data than you are entitled to |
| Consent state not persisted across pages | Banner reappears, users decline out of irritation, consent rate falls |
| Tags firing before the banner resolves | Straightforward breach, and it is trivially detectable by anyone who opens developer tools |
Two sites with identical traffic and identical marketing can have a 30-point difference in usable data purely from banner design and implementation quality. That difference flows into every downstream number: your conversion counts, your smart bidding performance, your audience sizes, your remarketing reach. Track your consent rate and treat a drop the way you would treat a drop in conversion rate.
Doing it properly #
- Use a real consent management platform. Cookiebot, OneTrust, CookieYes, Usercentrics or similar. A hand-rolled banner will not maintain a consent record, will not handle Consent Mode v2 signals correctly, and will not survive an audit.
- Configure Consent Mode v2 properly in Google Tag Manager, with all four signals and a default denied state that resolves before tags fire.
- Verify it actually works. Open the site in a private window, decline, and confirm in developer tools that no advertising cookies were set. Then accept and confirm they are. Most implementations fail this test, and it takes three minutes.
- Make the banner honest and easy. Equal-prominence accept and reject. Clear language. No dark patterns. Beyond the legal argument, a banner that feels manipulative measurably reduces trust.
- Write your privacy policy to match what you actually do, including hashed data sent to advertising platforms through Enhanced Conversions and the Conversions APIs. This is frequently omitted and it is exactly the sort of gap a complaint surfaces.
- Record and monitor the consent rate as a first-class metric, segmented by device and landing page.
Common questions #
Does server-side tagging let me bypass consent?
No, and anyone selling it that way should be treated with suspicion. Server-side tagging recovers signal lost to technical causes — ad blockers, cookie lifespan, page speed. It does not change your legal position at all. Tracking someone who declined is a breach regardless of which server the request passes through, and doing it deliberately through server-side infrastructure is worse, not better.
Do South African businesses really need a cookie banner?
If you process personal information — and cookie identifiers generally count — you need a lawful basis, and consent is the practical route for non-essential tracking. The market has converged on opt-in banners for good reason. If you have any EU visitors at all, GDPR and ePrivacy apply to them regardless of where you are based, which settles it for most businesses with a website.
Our consent rate is 40%. Is that bad?
It is on the low side and almost certainly improvable. Rates vary enormously by audience, geography and design, but the biggest lever is nearly always implementation quality rather than wording — banner timing, whether it reappears, whether the reject button is placed where people hit it accidentally, and mobile layout. Before rewriting the copy, check that the consent state persists correctly across pages and sessions.
What happens to data collected before we fixed consent?
A question for your lawyer rather than your analyst. From a purely measurement standpoint, annotate the date you changed the implementation, because your data volumes will shift and any comparison spanning that date is not like-for-like.