Measuring when users say no: a guide to cookieless attribution

The standard mental model for consent and measurement goes something like this: users who accept cookies get tracked, users who decline do not, and the analytics data you see represents the accepting majority. That model has always been an approximation, but it is increasingly a bad one.

Opt-out rates on cookie banners vary widely, but in the UK and EU - where banners are required to offer a genuine choice - declining rates of 30–50% are common on consumer-facing sites. If half your visitors are declining, your analytics reflects half your reality. Conversion rates, funnel analysis, campaign attribution: all of it is based on a self-selected sample that may behave very differently from the users you are not measuring.

This guide covers the main approaches to filling that gap.

What breaks when consent is declined

When a user declines analytics and advertising cookies:

• GA4 does not fire (if your implementation is correct). No pageview, no session, no conversion event.
• Google Ads cannot match ad clicks to on-site behaviour. Conversion reporting drops for those users.
• Meta Pixel does not fire. Remarketing audiences shrink. Attribution models see fewer post-click events.
• Any CRM or email tracking that relies on cookies for attribution becomes unreliable.

The platforms know this, which is why they have built modelling capabilities to estimate what they cannot measure directly. Understanding how those work - and where they fall short - is the starting point for building a sensible measurement strategy.

Conversion modelling

Google Ads and GA4 both use conversion modelling to estimate conversions that cannot be observed directly. The approach relies on patterns from consented users to infer what non-consenting users likely did.

If, for example, 40% of consenting users who clicked a specific ad and visited a specific product page went on to purchase, Google's model applies a probabilistic estimate to non-consenting users who followed a similar path - based on aggregated signals that do not involve individual identifiers.

The key thing to understand: conversion modelling only works if GCM is correctly implemented. Specifically, it requires Advanced mode, where Google tags fire in a reduced state for non-consenting users, sending anonymous pings without setting cookies. These pings provide the population-level signals the models need. Without them - if you are using Basic mode, which blocks tags entirely - there is nothing for the model to work with, and conversions from non-consenting users disappear entirely from your reports.

GA4 has a similar feature called behavioural modelling, which estimates user behaviour for sessions where consent was declined. It is off by default and requires a minimum threshold of observed data before activating.

Modelling is better than nothing. It is not the same as observed data, and confidence intervals are not published - you cannot tell how accurate the model is for your specific site and audience.

Enhanced conversions

Enhanced conversions in Google Ads work differently from modelling. Rather than estimating, they provide Google with hashed first-party data - typically an email address or phone number - that Google uses to match a conversion event to a signed-in Google user.

When a user completes a purchase and you send their hashed email alongside the conversion event, Google checks whether that email corresponds to a Google account that recently clicked one of your ads. If it does, the conversion is attributed, regardless of whether a gclid cookie was present.

This approach requires:

1. Collecting the user's email or phone number as part of the conversion event (which requires them to provide it - a purchase confirmation, a form submission, etc.)
2. Sending that data to Google, which requires a legal basis. In most EEA contexts, that means consent for advertising purposes, or a legitimate interest assessment for existing customers.

Enhanced conversions are not a way around consent. They are a way to improve attribution accuracy for users who have already given you their contact details and for whom you have a lawful basis to share that data with Google.

First-party data and direct measurement

The most reliable measurement comes from data you collect directly, under your own terms, without depending on third-party tracking.

For e-commerce, this typically means:

• Order data from your own systems. You know how many purchases happened, at what value, from which channels, because your server processed the orders. Campaign-level revenue reporting can be built from UTM data stored at point of purchase without any cookies.
• Logged-in user behaviour. Users who create accounts and log in can be tracked across sessions via your own session management, without cookies for analytics. Their purchase history, browsing patterns, and campaign exposure can all be observed through your own database.
• Email engagement. Open rates and click rates from email campaigns are measurable through your email platform without consent for cookies, because email engagement tracking works differently from browser tracking.

This data does not require a cookie consent framework to collect. It does require data governance, a clear privacy policy, and in some cases a separate consent mechanism for direct marketing.

Aggregate and cohort approaches

Where individual-level measurement is unavailable, aggregate measurement often still works.

Media Mix Modelling (MMM) uses statistical regression to attribute sales or conversions to marketing channels based on spend and outcome data over time, without any user-level tracking. It requires significant data history to be reliable, but is entirely independent of cookie consent. Agencies and large advertisers have used it for decades; tools like Meridian (Google's open-source MMM) have made it more accessible.

Incrementality testing measures the true causal effect of advertising by comparing a group exposed to an ad with a control group that was not. When designed correctly, it does not require individual attribution - you measure the difference in conversion rates between the two groups. This is a more robust method than last-click attribution even when cookies are available.

Both approaches require more statistical knowledge than standard platform reporting, but they also produce more reliable answers to the question "is this working?"

What not to do

Some approaches to closing the measurement gap are worth avoiding:

Fingerprinting. Browser fingerprinting identifies users by combining characteristics of their browser and device - screen resolution, installed fonts, timezone, and so on. It is widely prohibited under ePrivacy rules, explicitly disallowed by Google's own policies, and increasingly detected and blocked by browsers. It is not a legitimate substitute for consent.

Re-enabling cookies through technical means. This includes techniques like CNAME cloaking (using a subdomain that maps to a tracker's infrastructure to appear first-party) or cookie syncing workarounds. Regulators and browser vendors have specifically targeted these. The legal and reputational risk is not worth it.

Assuming your non-consenting users behave like consenting ones. If the users who decline tracking are systematically different from those who accept - and they often are - then scaling up your consented data to represent the full audience will give you wrong answers.

Putting it together

No single approach replaces observed individual data at scale. A realistic strategy combines several:

• GCM Advanced mode, correctly implemented, to enable conversion modelling for non-consenting users
• Enhanced conversions where you have first-party contact data and a lawful basis to use it
• UTM-based campaign attribution for your own analytics, which survives consent declines
• Order and CRM data as the ground truth for revenue attribution
• Periodic incrementality tests to validate what your attribution models are telling you

The goal is not to recover the measurement you had before consent law applied. That measurement was never as accurate as it looked. The goal is to understand your business well enough to make good decisions, using methods that are legally sound and statistically defensible.

Where ConsentScout fits

ConsentScout checks whether consent is being collected correctly before any tracking starts. That is a prerequisite for everything above: conversion modelling only works with GCM Advanced mode in place; enhanced conversions require a legitimate basis for the data you send; first-party data collection requires a privacy policy that accurately describes what you collect.

A site that is setting analytics or advertising cookies before consent is given is not only non-compliant - it is also undermining its own measurement. If pre-consent data is mixed into analytics reports, the numbers are wrong in ways that are hard to unpick after the fact.