Know what is loading
Most stores carry more tracking than the owner realises: analytics, advertising pixels from campaigns that ended, app-injected scripts and embedded services that set their own cookies.
Open the browser network tab and list the external domains being contacted. It takes ten minutes and it is usually a longer list than expected.
Consent obligations
- Necessary cookies generally do not require consent
- Analytics and advertising generally do, in many jurisdictions
- Consent must be a genuine choice, recorded
- Withdrawal must be as easy as giving it
- Scripts must not fire before consent is given
The most common failure is a consent banner that appears while the tracking scripts have already loaded. The banner is decoration at that point.
Measurement is now incomplete
With consent requirements, browser restrictions and blocking, a meaningful proportion of visitors are not measured. That is the reality of current analytics and it is not a configuration error.
Design your reporting for directional accuracy rather than precision, and use total revenue against total spend as the sanity check on everything else.
Server-side alternatives
Server-side tracking improves data quality and does not remove the consent obligation. It is a technical improvement, not a legal workaround, and it should be described that way internally.
Privacy-focused analytics that avoid personal data can sometimes remove the consent requirement altogether, which is worth considering for a small store.
Remove what you do not use
- Advertising pixels from campaigns that have ended
- Analytics tools nobody looks at
- App scripts from uninstalled apps
- Embedded services with a lighter alternative
Each removal improves speed, simplifies consent and reduces your data-sharing footprint at once.