GDPR-Compliant Tracking: Consent, Data Flows and Trust

For GDPR-compliant tracking, a simple rule of thumb applies: anything that is not strictly necessary – analytics, marketing pixels, embedded maps and videos – may load only after valid consent. In addition you need documented data flows, contracts with every service provider involved and a privacy policy that matches the technology actually in use. If you get this right, you protect your company and get more reliable numbers at the same time.

This article gives decision-makers and teams in mid-sized companies a technical overview: what the law requires in principle, how to document data flows, how to implement consent, tag management and server-side tagging, and how to verify the result. For the legal assessment of your specific setup, your data protection officer or a law firm is the right contact.

The two legal layers: the device and data processing

Two sets of rules interlock in tracking. Section 25 of the Telecommunications Digital Services Data Protection Act (TDDDG) governs when information may be stored on or read from a user’s device – for example via cookies, local storage or fingerprinting. Consent is generally required here, unless the storage is strictly necessary for a service the user has explicitly requested. The GDPR then governs whether and on what basis the personal data collected may be processed, and requires, among other things, transparency, purpose limitation and data minimization.

Valid consent is voluntary, informed, tied to a specific purpose and unambiguous – and it can be withdrawn as easily as it was given. Pre-ticked boxes are not enough; the Court of Justice of the European Union and the German Federal Court of Justice ruled to that effect in 2019 and 2020. You must also be able to prove consent (Art. 7(1) GDPR). Violations can lead to fines from the supervisory authorities, cease-and-desist letters and damages claims; the GDPR’s fine framework goes up to €20 million or four percent of worldwide annual turnover, and in 2024 the Federal Court of Justice confirmed that even a loss of control over personal data can constitute compensable damage.

Which services need consent

Assign every service to a category. The overview shows the usual classification; in case of doubt, your data protection officer’s review decides.

Category	Typical examples	Classification
Strictly necessary	Shopping cart, login session, storage of the consent decision, security functions	Generally no consent under Section 25 TDDDG; disclosure in the privacy policy remains mandatory
Analytics and audience measurement	Google Analytics 4, self-hosted analytics using cookies	Consent generally required
Marketing and remarketing	Pixels and tags from ad platforms, conversion tracking, retargeting	Consent required
Embedded third-party content	Videos, maps, social plugins, chat widgets	Consent generally required – or load only after a click
External resources	Fonts, scripts, libraries from third-party servers	Better to host locally: external requests transmit the visitor’s IP address to third parties

Typical consent banner mistakes

• Tracking scripts load before consent – often via the tag manager, because a single tag has no consent condition
• “Reject” is hidden or much harder to reach than “Accept”; in their guidance, the supervisory authorities expect an equally easy way to decline
• Optional categories are already pre-selected
• The settings can’t be reopened or withdrawn later
• The decision isn’t logged, so proof is impossible in a dispute
• New tools go live without updating the banner, the records and the privacy policy

Documenting data flows

Over time, many websites integrate more and more services: analytics, advertising pixels, maps, videos, chat, fonts. After two or three years, often nobody knows exactly which data goes where. In a real case, that becomes a problem – with an access request, an inspection by the supervisory authority or a data breach.

The building blocks of docu­menta­tion

• Records of processing activities (Art. 30 GDPR): Which personal data is processed for what purpose?
• Data processing: Which service providers have data processing agreements with you, and which sub-processors do they use?
• Data flow overview: Which system sends which data to which recipient – and to which country?
• Responsibilities: Who decides on new tools, who reviews changes, who maintains the privacy policy?

A practical tip: stipulate that new scripts may go live only after a short review and an entry in the overview. The documentation is also a foundation of your web application security, for instance when, after an incident, you need to establish quickly which data is affected.

Joint responsi­bility and third countries

If you embed plugins or pixels from third-party providers, you may be jointly responsible with them – the Court of Justice of the European Union ruled so in 2019 in the Fashion ID case, concerning a social media plugin. So don’t just check the contract; also check what the provider does with the data for its own purposes. Services that process data outside the EU deserve particular attention: the basis for transfers to the US has changed several times – the CJEU struck down Safe Harbor and Privacy Shield, and since 2023 the adequacy decision on the EU-US Data Privacy Framework has applied. It, too, has been challenged in court, so don’t rely on it alone for critical data. Record in your overview where a service processes data and on what basis, and plan alternatives with processing inside the EU for critical services.

Implementing GDPR-compliant tracking technically

The technical implementation determines whether your privacy policy matches reality. Depending on your setup, these building blocks come into play.

Consent management and tag manager

A tag manager bundles all scripts in one place and fires them depending on the consent given. It’s important that every tag has a consent condition – a single forgotten tag is enough for data to flow before consent. Google Consent Mode v2 passes the consent status to Google services using four parameters (ad_storage, analytics_storage, ad_user_data, ad_personalization) and adjusts their behavior; for remarketing and personalized advertising in the European Economic Area, Google requires these signals. Note the modes: in basic mode the tags load only after consent, while in advanced mode they send cookieless signals beforehand – whether that is permissible without consent is assessed controversially. How to set up Google Analytics 4 cleanly is described in configuring GA4 properly.

Server-side tagging and data minimization

With server-side tagging, data first passes through your own server before it is forwarded to analytics or advertising services. That gives you control: you can truncate IP addresses, remove parameters and decide which information leaves the company at all. It does not replace consent where it is required. The principle of data minimization applies throughout: collect only what you actually need for your goals.

Consider privacy-friendly alternatives

Not every question requires extensive advertising tracking. For many company websites, privacy-friendly analytics tools are enough: they get by with little data and can partly be run on your own servers. They often handle reach and popular content well, but cross-channel campaign analysis only to a limited extent. Whether a measurement can do without consent entirely depends on whether information is stored on or read from the device and on what the processing is based – a case-by-case question for your data protection officer.

Load third-party content after a click, host resources locally

Load videos and maps with a two-click solution, only when visitors want them. Serve fonts, scripts and libraries from your own server instead of fetching them from external providers – the dynamic embedding of Google Fonts prompted a widely noted ruling by the Munich I Regional Court in 2022. The side effect: fewer data transfers to third parties and often a better loading time.

Check technically on a regular basis

Websites change constantly: a new plugin, an embedded video or an update to the tag manager can trigger additional connections unnoticed. So use a fresh browser profile without a stored consent to check which connections the page actually makes – first before any decision, then after “Accept all” and after “Reject”. The browser’s developer tools (the “Network” and “Application” tabs) show requests and cookies; specialized scanners automate the comparison.

Practical example: a machine-building supplier’s website

A typical mid-sized scenario: a supplier with 80 employees runs a website with a contact form, product videos, an embedded map, Google Analytics 4 and an advertising pixel for LinkedIn campaigns. The site has grown over the years, and nobody has reviewed it since the relaunch. Here is how to proceed:

1. Inventory: Capture all connections using developer tools and the tag manager preview. The result is often longer than expected, for example because of an old plugin or a forgotten pixel.
2. Categorize: form protection as necessary, Analytics and the LinkedIn pixel as requiring consent, video and map as third-party content loaded after a click.
3. Implement: connect consent management, set consent conditions in the tag manager, configure Consent Mode, serve fonts locally.
4. Document: reconcile the records of processing, processor agreements, data flow overview and privacy policy with the result.
5. Test and release: check before and after in a fresh browser profile and define an approval process for future tools.

The visitor numbers recorded may drop as a result. In return, your reports rest on a sound basis, and you know which gaps, if any, you can close with privacy-friendly measurement or modeled values.

Transparency as a trust factor

Data protection is also communication. A banner that explains in plain words what data is used for looks more credible than a wall of technical terms. A clear privacy policy (Art. 13 GDPR) and a prompt, friendly reply to access requests show visitors that you take their data seriously. In industries such as healthcare, finance or real estate in particular, that can tip the balance when choosing a provider. The legal situation continues to evolve, and changes are under discussion at EU level too: plan with the law as it stands today and keep your configuration flexible enough that adjustments don’t require a redevelopment.

Checklist for trustworthy tracking

1. Capture all services and scripts in use
2. Record the purposes and data needed per service
3. Check and file processor agreements, note the recipient countries
4. Implement the consent banner so that scripts load only after consent
5. Make declining just as easy as agreeing
6. Make settings reopenable at any time and log decisions
7. Load videos and maps only after a click, host fonts and scripts locally
8. Reconcile the privacy policy with the actual setup
9. Define an approval process for new tools
10. Check the setup technically on a regular basis – before and after consent

How Nano Concepts can help

GDPR-compliant tracking is not the opposite of good marketing but its foundation. Nano Concepts implements consent solutions, tag management and server-side tracking technically – as part of our web development and coordinated with the requirements of your data protection officer or law firm. We handle the marketing side, such as campaigns and reporting, together with our partner agency LOMA DESIGN. If you run newsletters and automation, you’ll find the specifics in the article B2B email marketing. In a free initial consultation, we clarify where you stand and which technical steps make sense.

This article does not replace legal advice.