Conversion tracking that survives cookie consent

Ask a business owner how many leads the website sent last month and you’ll often get 2 answers. One is the number in the inbox. The other is a smaller number in Google Ads or Meta. Conversion tracking is meant to close that gap, yet the gap has grown for years. Browsers block more third-party tracking. People decline cookies. Ad blockers strip scripts out. And privacy law expects businesses to be more careful with what they collect.

None of that is going away, and none of it should. People are entitled to choose how they are tracked. The job now is to build tracking that respects those choices and still tells the business something accurate about what its marketing is doing.

Why don’t my ad platform numbers match my inbox?

Ad platforms count conversions through scripts in the visitor’s browser. Those scripts miss people who decline cookies, use privacy-focused browsers or run ad blockers. Broken tags lose more. So Google Ads and Meta see fewer leads than your inbox does, and their bidding works from that smaller, patchier picture.

A traditional tracking setup relies on scripts in the visitor’s browser. When someone sends a form, a pixel fires and tells the ad platform a conversion happened. That breaks down in several ways:

• Consent. If a visitor declines marketing cookies, a correctly configured site should not fire advertising pixels for them.
• Browser protections. Safari, Firefox and others limit how long cookies last and block many third-party trackers by default.
• Ad and script blockers stop tracking scripts from loading at all.
• Broken setups. Tags fire twice, fire on the wrong page, or stop working after a site update and nobody notices.

The first 3 are people making choices, and the last one is a bug. All 4 mean the platforms see fewer conversions than happened. That changes how their bidding systems spend your budget.

Start with the conversion you care about

Before any tags go in, decide what a conversion is. For most service businesses, a page view or a button click doesn’t count. A conversion is a sent enquiry, a booked appointment or a phone call. Define each one. Then make sure the website can recognise it reliably. That means a form that actually went through, rather than someone simply pressing the button.

That event is the source of truth. Everything else in the setup exists to report it accurately to the places that need it. So reliable enquiry forms are the foundation of good tracking, and they belong in the same project.

What makes a cookie consent banner work?

A consent banner works when the site does exactly what the visitor chose. Tags wait until a choice is made. Reject is as easy to press as accept. The choice is remembered across pages. And the privacy policy describes what each tag collects. A banner that looks right but fires tags anyway helps nobody.

Common failures:

• the banner appears, but tags fire before anyone makes a choice;
• “reject” is hidden or harder to use than “accept”;
• choices aren’t remembered, so the banner returns on every page;
• the privacy policy doesn’t describe what the tags collect.

Australia has no single European-style cookie law. The Privacy Act and the Australian Privacy Principles govern how personal information is collected and used. Those rules were tightened recently, and more reform is under way. Many businesses also serve visitors or run campaigns where stricter regimes apply. The safe, honest approach is the same everywhere. Tell people what you collect, give them a genuine choice, and respect it. Our privacy and consent work sets that up and tests it.

What is Google Consent Mode?

Google Consent Mode lets a website tell Google’s tags what each visitor has agreed to. Version 2 passes 4 signals: analytics storage, ad storage, ad user data and ad personalisation. When someone declines, tags in advanced mode send anonymous, cookieless pings. Google then models the conversions it couldn’t see.

The modelling isn’t perfect. It still fills much of the gap without identifying people who said no.

What matters is that consent mode is configured correctly. The banner and the tags must agree on what each choice means. A mismatch either tracks people who declined or throws away data from people who agreed.

What is server-side tracking?

Server-side tracking sends conversions from your website’s server as well as the visitor’s browser. The site tells the ad platform directly that a lead came in. Meta calls this the Conversions API. Google offers enhanced conversions and offline conversion imports. Done well, it records leads that a blocked browser script would miss.

It helps in 3 ways:

• conversions are still recorded when a browser script was blocked;
• the business decides exactly what data is sent, rather than a script collecting whatever it can see;
• conversions can be matched to later outcomes, such as whether the lead became a customer.

Deduplication is essential. If both the browser and the server report the same lead, the platform needs a shared event ID. That ID tells it the 2 reports are one conversion. Without it, reported results double and bidding goes wrong.

Consent still applies. Server-side tracking is no way around a visitor’s choice. If someone declined advertising tracking, the server should not send their details to an ad platform either.

Be very careful with sensitive information

Some businesses handle information that should never reach an advertising platform. Health practices are the clearest example. Say a form asks about symptoms or a condition. Sending that page’s URL or form fields to an ad platform can disclose health information. Even the fact that someone enquired about a specific treatment can. Page URLs and titles alone can reveal a lot.

For health and medical websites in particular, the safe design sends a generic signal only, such as booked or not booked. It carries no health details at all. Sensitive pages stay out of advertising audiences. And following the OAIC’s 2026 decisions, no Meta, TikTok or Google Ads pixel runs on a health page without express opt-in for that pixel.

A tracking setup that holds up

For a typical service business, a setup that holds up has 6 parts.

1. One source of truth for each conversion: a successful form or booking, recognised by the site itself.
2. A consent platform that blocks non-essential tags until a choice is made, and passes that choice to every tag.
3. Consent mode configured for Google tags, so declined visitors are measured anonymously and modelled.
4. Server-side events for key conversions, with deduplication IDs and only the minimum data required, sent only where consent allows.
5. Offline or CRM feedback where practical, so platforms learn which leads became paying customers. HubSpot and Salesforce can both feed this back.
6. Regular checks, because tracking breaks quietly after site changes.

Our conversion tracking work builds and tests that chain end to end, from the form to the report. GA4, Google Tag Manager, Google Ads and Meta all get wired to the same events.

How do you test your conversion tracking?

Test in 3 steps. Decline cookies in a private window and confirm advertising tags stay silent. Accept cookies, send a test enquiry and check each platform records exactly 1 conversion. Then compare a month of platform conversions with your inbox. A steady gap is normal. A large or sudden gap usually means something broke.

Each step takes a few minutes.

• Load your site in a private window and decline all non-essential cookies. Use your browser’s developer tools or a tag assistant to see whether advertising tags still fire. They shouldn’t.
• Accept cookies and send a test enquiry. Confirm exactly 1 conversion is recorded in each platform.
• Compare a month of platform conversions against the leads in your inbox or CRM. A gap is expected. A very large or suddenly changing gap usually means something is broken.

The honest number

No setup will make ad platform numbers match the inbox exactly again, and that’s fine. The aim is a measurement system the business can rely on. It should be consistent, consent-respecting, deduplicated and tied to actual enquiries. You can manage a budget well on that. You can’t manage one on numbers that are quietly wrong.

Want to know which ad sent your last customer?

That’s the question good tracking answers. We build websites wired into Google Ads, Meta and your CRM, with consent handled from the first tag. See how our conversion tracking service works. Book a free strategy call and we’ll tell you straight what your current setup is missing.