Cookie Banners and Measurement: What Still Works Without Consent

Why does web analytics show only part of your visitors?

Many owners experience the same thing: web analytics reports far fewer visitors than before, although inquiries have not fallen. The reason usually lies not with the website but with the consent banner. Anyone who rejects or dismisses the banner is not recorded by analytics that sets cookies. The numbers then show only visitors who agreed.

This article therefore answers one question: Which measurement is still possible without consent, and how does a small business design banner and measurement so that its numbers hold up and visitors’ trust does not suffer? We first clarify the legal situation and the terms, then a model from advertising research that explains why intrusive banners do harm. After that we look at study findings, weigh two views and sort the measurement methods into three layers. This article is not legal advice.

A banner that pushes for a yes buys numbers and pays with trust.

What does Section 25 TDDDG require, and what counts as device access?

In Germany, two sets of rules interlock for cookies, as the article on B2B retargeting already describes. The Telecommunications Digital Services Data Protection Act (TDDDG), called TTDSG until May 2024, regulates access to terminal devices in Section 25. Anyone who stores information in a user’s browser or reads it from there needs the user’s consent, unless the access is strictly necessary for the service requested. The General Data Protection Regulation (GDPR) then governs whether the personal data obtained in this way may be processed.

Device access is broader than the word cookie suggests. It also covers pixels, local browser storage and methods that read device features to recognize it. The Datenschutzkonferenz, the body of Germany’s data protection authorities, deliberately gives no blanket approval for audience measurement in its guidance for digital services. The specific purpose is what counts. Strictly necessary are, for example, a cookie for the shopping cart, for login or for storing the banner decision itself. Web analytics showing how many visitors come from where serves the operator, not the service the visitor wanted.

Courts have clarified the requirements for consent. In 2019 the Court of Justice of the European Union ruled in the Planet49 case (C-673/17) that a pre-ticked box is not valid consent, and Germany’s Federal Court of Justice followed in 2020 (I ZR 7/16). The Datenschutzkonferenz also requires that rejecting be as easy as accepting. Since April 2025 Germany has also had the Consent Management Ordinance (Einwilligungsverwaltungsverordnung). It allows recognized services in which users store their decisions centrally. Website operators, however, are not obliged to honor such services.

Changes have been announced but not adopted. In November 2025, in the so-called Digital Omnibus, the European Commission proposed among other things an exemption from consent for aggregated audience measurement and one-click rejection. The Council adopted its position on October 21, 2026, Parliament’s position is pending, and entry into force is not expected before 2027. Until then, Section 25 TDDDG applies unchanged. Plan according to the law that applies today.

Why do intrusive banners do harm? Persuasion knowledge and reactance

To understand how a banner works, the model already used in the article on retargeting helps. Friestad and Wright (1994) developed the Persuasion Knowledge Model. It assumes that over their lives people learn how advertising and selling work. When they recognize an attempt to influence them, they examine the message more critically and resist if they consider the means inappropriate.

Add to this Brehm’s reactance theory. Reactance is the inner resistance that arises when people see their freedom of choice threatened. They want to regain that freedom and therefore reject precisely what they are pushed toward. A banner that shows only a large button to accept and hides rejection behind a link is exactly this kind of pressure. Such designs are called dark patterns: interfaces that steer users toward a decision that benefits the provider.

On a B2B website, the visitor is evaluating a potential supplier. A banner that plays tricks is a first hint to them of how the business treats customers.

What do studies show about banners and consent?

In the Journal of Advertising, Ju, Ham and Yel (2026) examined in three successive studies how the design of consent requests affects later advertising. In the first study, participants rated common phrases. “I am OK” was seen as the most ambiguous, “I Agree” as the clearest. In the second study, an available option to decline reduced perceived loss of control and reactance. In the third, personalized ads brought back the memory of the earlier consent. Those who had felt pushed at the banner met the later ad with more resistance. The studies were conducted with consumers, not with buyers in business-to-business markets.

Two investigations show how widespread such designs are. The authors refer to an earlier study by Utz and colleagues (2019) on the GDPR in Germany, according to which 57.4 percent of the notices examined contained elements steering toward the privacy-unfriendly choice. An automated check of 99 high-traffic websites accessed from Denmark found a banner on 90 of them. Accepting was usually possible on the first layer, rejecting often only after further steps (Ntemkas and colleagues 2026). The authors stress that their criteria are indicators, not a legal assessment.

A third finding concerns whether honest consent harms business. Godinho de Matos and Adjerid (2022) analyzed an experiment at a large telecommunications provider in Europe. After transparent consent under GDPR rules, agreement, sales and the effectiveness of customer communication rose. For sensitive purposes customers remained reluctant.

Two views: maximize consent or rebuild measurement?

The first view relies on the banner. It says: without consent there are no usable numbers, so the banner must be designed so that as many people as possible agree. Colors, order and wording are optimized for this. In its favor is that web analytics with consent shows more precise paths through the website than any other source.

The second view relies on measurement. It says: a small business’s decisions depend on inquiries and orders, and these can be counted without device access. The banner stays honest, web analytics provides a sample, and steering is based on numbers that are complete. The findings on reactance support this, as does the legal situation, under which a pushy banner is vulnerable.

I consider the second view the more sustainable one. A small B2B business often has only a few thousand visitors a month. At such volumes, more precise web analytics says little about the one question that matters: which source brings orders. That question is answered by the measurement chain from the article on how to measure marketing success, and its decisive links, inquiry, conversation and order, lie in the form and the CRM, not in the visitor’s browser.

The three-layer measurement: which numbers remain without consent

From the legal situation and the findings I derive an order that I call the three-layer measurement. It sorts every number by whether it requires device access. Steering is done with the bottom layer because it is complete. The upper layers supplement it.

1. Layer 1: without device access

   Search Console, business profile statistics, the source question and hidden source field in the form, the inquiry list and the CRM. These numbers are complete because they do not depend on consent. Inquiries, conversations and orders per source belong here.

2. Layer 2: technical logs and aggregated counting

   Server logs show page requests for operation and security. Some analytics tools count without cookies and without recognition. Whether that is permissible without consent in the individual case is disputed. Have the setup checked before you rely on it.

3. Layer 3: with consent

   Web analytics with cookies, advertising pixels, retargeting. These numbers are a sample of visitors who agreed. They show paths through the website and patterns, but not totals.

For clicks from Google Search, Google Search Console provides impressions, clicks and position without any cookie being set on the website. How these numbers relate to whether a business is found is described in the article on how to measure visibility. And how to improve the inquiry rate with few visitors is covered in the article on how to measure the website inquiry rate.

What does an honest banner look like? A checklist

The banner itself can be checked with a few questions. They follow from case law, from the requirements of the supervisory authorities and from the findings on reactance.

• Rejecting is possible on the first layer and as visible as accepting.
• No box is preselected, except for strictly necessary access.
• The buttons say clearly what happens, such as “Allow statistics” and “Reject,” not “Continue” or “OK.”
• No analytics or advertising cookies are set before the decision.
• Visitors can change their decision at any time via a link in the footer.
• Fonts, maps and videos are hosted locally or load only after consent.
• The list of services in the banner matches what the website actually loads.

The last question fails most often, because websites grow over the years and the banner does not grow with them. Check it once a year together with the privacy policy. How consent is documented in sales is described in the article on data protection in sales.

Conclusion: what still works without consent?

The question was
measurement is possible without consent and how banner and measurement can be designed so that numbers hold up and trust remains. Without consent, everything remains that needs no device access: Search Console, business profile, the source field in the form, the inquiry list and the CRM. With these, inquiries, conversations and orders per source can be counted completely. Web analytics with cookies now provides only a sample, useful for paths and patterns, not for totals.

The banner should be honest, not only because the law requires it. The findings on reactance show that visitors who were pushed meet later messages with more resistance. A business that bases its decisions on the complete bottom layer can afford an honest banner. The experiments cited do, however, come from consumer business, and how buyers react to banners has not been studied. The direction remains robust: if you take the obligation seriously, you lose numbers you do not need and keep the ones that matter.

What you can put into practice right away

1. Open your website in a private browser window and check whether rejecting on the first layer is as easy as accepting.
2. Ask your agency or service provider for a list of the services the website loads and compare it with the banner.
3. Check whether your inquiry form stores the source and asks how the person found you.
4. Decide which three numbers from layer 1 you will review monthly, and have banner and analytics checked by your data protection officer.