Your client asks if the tracking is compliant. What do you say?

Rhobin

July 31, 2026

7 min read

You do not answer with a yes, because the client is the controller and their counsel makes the compliance call. What you owe them, and what the accountability rules ask for, is a factual description: which tags run before anyone has chosen, which vendors receive what, what a refusal changes downstream, and how long the data is kept.

The symptom

The question rarely arrives as a question. It arrives as a forwarded email, a procurement questionnaire, or a line in an assessment the client's legal counsel started. Can you confirm the tracking on our site is GDPR compliant? Answer by Friday.

And you do not know. Not because anyone was careless, but because the setup was assembled by three parties over four years, and the banner went in during a compliance project nobody documented. There is no list of what loads on that site, in what order, or who receives what.

So the reply that goes back is a version of "yes, we use a consent management platform". True, not an answer, and now written down in the client's file with your name next to it.

Why it happens

The question mixes two rulebooks

Most agencies answer half of it. The GDPR half covers processing personal data: lawful basis, transparency, retention, transfers, contracts. The other half is older, narrower, and governs the moment a tag runs. Article 5(3) of the ePrivacy Directive allows "the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user" only with consent, with a carve-out for what is "strictly necessary" to deliver the service the user asked for.

Two consequences get missed. First, the word is information, not personal data. In its Guidelines 2/2023, adopted in October 2024, the European Data Protection Board states that the notion of information "includes both non-personal data and personal data, regardless of how this data was stored and by whom", and that Article 5(3) "does not exclusively apply to cookies, but also to similar technologies". So "we anonymise the data" answers a question nobody asked. Second, this is a directive, phrased as "Member States shall ensure", implemented in national law. The honest answer differs by country, and a client selling in five markets is asking five questions.

Nobody owns the inventory

The question is only answerable at the level of what actually runs in a browser on that domain, and almost no setup has that written down. Vendors arrive through a tag manager, through plugins, through an embedded booking engine, and through third-party scripts that quietly load scripts of their own.

Passing it upstream does not work either. In Fashion ID, decided in July 2019, the Court of Justice held that an operator embedding a third party's tracker "can be considered to be a controller" for "the collection and disclosure by transmission of the data at issue", and that consent for those operations "must be obtained by that operator". The tool belongs to the vendor. The decision to put it on the page does not.

The answer changed once already, and can change again

The 2022 decisions that made "Google Analytics is illegal" a headline were about transfers to the United States, not about analytics as such. That analysis moved on 10 July 2023, when the European Commission adopted its adequacy decision for the EU-US Data Privacy Framework, under which data can flow to participating US companies without additional safeguards, and the Commission says the framework is subject to periodic reviews. Google now also states that Analytics "does not log or store individual IP addresses from EU, Switzerland, or UK users", per its own privacy documentation. None of that makes a given setup lawful. It does mean a source from 2022, in either direction, is a bad basis for what you tell a client in 2026.

The evidence duty is the part that gets skipped

Being compliant and being able to show it are two obligations. Article 5(2) of the GDPR requires a controller to "be responsible for, and be able to demonstrate compliance with" the principles, and Article 7(1) to "be able to demonstrate that the data subject has consented". Your contracts say the same. Google's EU user consent policy requires consent from end users "in the European Economic Area, the UK and Switzerland" for cookies where legally required and for personalised advertising, and requires you to "retain records of consent given by end users". Nobody is asking you to be a lawyer. They are asking for records, and records are the thing a tracking setup either has or does not.

What good looks like

You stop trying to return a yes and return a description instead, one the client's counsel can rule on:

What loads, and when. The tags and vendors on the site, and which of them run before the visitor has made any choice.
What the consent signal actually does. Not that a banner exists, but what happens downstream when someone refuses, tag by tag and platform by platform. That is its own piece of work, covered in Consent Mode v2 without throwing data away.
What leaves in the payload. Whether URLs, form fields or event parameters carry an email address or a name. The Analytics terms of service forbid passing Google anything it "could use or recognize as personally identifiable information", so this is a contract question too.
Retention, written down. GA4 event data is a setting, 2 or 14 months on a standard property, per Google's retention documentation. Someone chose one, ideally on purpose.
The per-country notes. Exemptions are narrower than people hope. France allows one for audience measurement only under conditions including a single publisher scope, a truncated IP address and a 13 month tracker lifetime, and the CNIL adds that "most large audience measurement offerings do not fall within the scope of the exemption, regardless of their configuration".

Then be clear about who decides. The client is the controller and their counsel makes the call. Your job, usually as a processor under a contract required by Article 28(3) of the GDPR, is to make sure that call is made on facts rather than on a vendor logo, and the logo matters less than the wiring, which is the argument in does your CMP choice matter.

That documentation is what Archon Consent produces, and it is why Archon Labs treats consent as an implementation discipline rather than a legal opinion. We take the legal requirement as given, then wire the implementation so a refusal removes what it has to remove and nothing beyond that, and so what remains still reaches the platforms that need it. With server-side collection behind it, that recovers 15-40% more conversions than a browser-only setup records. It does not close the gap: roughly 95% of events is the realistic ceiling, and 15-30% of conversions were going uncaptured before consent entered the conversation.

FAQ

So is Google Analytics GDPR compliant, yes or no?

Neither, as a general statement, and anyone who answers it in one word is guessing. It depends on how the product was implemented on a specific site, in which countries, with what consent, what is sent in the payload, and what is retained. The transfer objection behind the 2022 headlines was addressed for participating US companies by the 2023 adequacy decision, and participation is checkable per company on the framework's public list. The consent question under Article 5(3) was never about Google in the first place.

We have a consent management platform. Is that not the answer?

A banner is a mechanism for collecting a choice. It is not evidence that the choice is respected once collected, and that gap is where most setups fail. A capable platform can still be wired so a conversion tag fires before consent, or so a refusal blocks more than it needs to.

Does server-side tracking put us outside the consent rules?

No, and treating it as a workaround is the expensive mistake here. Moving collection into your own container changes who receives the data and how long a cookie survives, not whether reading something from the device needed consent. The EDPB guidelines say Article 5(3) "could apply even though the instruction to make the IP available has been made by a different entity than the receiving one", and that information produced locally and then sent to a server stays in scope, because being "produced locally does not preclude the application of Article 5(3)". Server-side collection is worth doing for data quality and durability, not for legal cover.

What do we say this week?

Say what is true and dated. "Here is what runs on your site, here is what fires before consent, here is what we are changing and by when, and your counsel decides whether that meets your risk appetite." That holds up in a review. A confident yes that later turns out to be wrong is what clients remember at renewal.

If you cannot produce that list today, a free tracking audit is the fastest way to get one, and it is the same document your client's legal team has been asking for.