Measuring your audience without forcing consent

一What a tracker is

The word ‘cookie’ refers to a small file a site stores in its visitor's browser, to remember them from one page to the next or from one visit to the next. The CNIL, the French data protection authority, prefers the broader word ‘tracker’, because other techniques do the same thing: the browser's local storage, invisible pixels, or a fingerprint calculated from a device's characteristics. What matters is not the technique but the act: storing information on the visitor's device, or reading information already there. It is this act that the law governs.

Some trackers are indispensable: they remember a basket, keep a session open, or precisely store the visitor's choice about cookies. Others are used to measure the audience, to personalise advertising, or arrive with a third-party service embedded in the page, such as a video player, a map or a share button. Many sites set them without knowing it, because a plug-in installed one day brought them along. The first task is therefore an inventory: knowing what your site sets, and what for.

二When consent is mandatory

The rule lies in Article 82 of the French Data Protection Act (loi Informatique et Libertés) of 6 January 1978, which transposes into French law Article 5(3) of the European ‘ePrivacy’ Directive (2002/58/EC). Storing or reading a tracker on a visitor's device, their computer or phone, requires their prior consent. ‘Prior’ is the key word: agreement must be obtained before the tracker is set, not afterwards. A site that loads its measurement tools on arrival, then displays a window, has already broken the rule before the visitor could answer.

The law provides for exceptions, which the CNIL clarified in 2020 in guidelines and a recommendation that serve as the reference. Trackers strictly necessary for the service the visitor has requested do not require consent. Certain forms of audience measurement, configured in a very precise way, are exempt as well. Here are the most common cases.

• An online shop's basket, which remembers the items from one page to the next.
• The session of a customer area, which keeps the visitor signed in.
• The storage of the consent choice itself, without which the window would return on every page.
• Security trackers, for example those that protect a sign-in against repeated attempts.
• Certain forms of audience measurement, under strict conditions that we detail below.

Everything else requires the visitor's agreement: ordinary audience measurement, targeted advertising, social media pixels, and third-party services that set their own trackers. When in doubt about a tracker, one question is enough: would the service the visitor asked for work without it? If so, it is not strictly necessary.

三What a proper consent window requires

Consent is only valid if it is freely given, specific, informed and expressed by a clear affirmative action. The window that collects it must therefore follow a few rules, which the CNIL has made very concrete. The most important fits in one sentence: refusing must be as easy as accepting.

• Two buttons at the same level: ‘Reject all’ next to ‘Accept all’, of the same size and appearance, on the very first screen, not hidden behind a ‘Settings’ link.
• No pre-ticked boxes: a pre-ticked box is not consent, as the Court of Justice of the European Union held in its Planet49 judgment, in October 2019.
• No implied consent: carrying on browsing, scrolling the page or closing the window does not count as agreement.
• Clear purposes: the visitor must know, in plain words and before choosing, what each category of trackers is for.
• Withdrawal just as easy: a ‘Cookie settings’ link, available at all times, lets the visitor change their mind whenever they wish.

These rules are not theoretical. The CNIL has already sanctioned major web companies because refusing cookies there was more complicated than accepting them. The complaint was not about the existence of cookies, but about the imbalance of the choice. A window where ‘Accept’ shines in colour while ‘Refuse’ can barely be made out in small grey type falls squarely into that trap.

四The most common pitfalls

Most non-compliant windows are not so out of malice, but out of neglect: a template installed as it came, a script added without checking its loading order, a default setting never changed. The result for the visitor, however, is the same. Here are the most widespread faults, each of which can be checked in a few steps.

• The script before the question: the measurement tool is loaded in the header of every page, and therefore fires before the window has even appeared.
• The switch already on: in the detailed choices, audience measurement is enabled in advance, so that ‘Save’ amounts to agreement.
• The hidden refusal: ‘Accept all’ is in the foreground, and refusal sits on the second screen, in small print.
• The close button that accepts: closing the window is treated as agreement, when that gesture says nothing.
• The choice with no way back: once the window is closed, no link allows it to be reopened to change one's mind.
• The policy that gets it wrong: the privacy page claims ‘no trackers’ while the site sets several.

五How long to keep the choice

A choice does not last for ever. The CNIL recommends keeping the user's choice, whether they accepted or refused, for six months, then asking again. Repeating the question on every visit would be just as wrong: a refusal must be respected, not worn down by insistence. The trackers themselves must have a lifespan in proportion to their purpose; for audience measurement, the CNIL sets thirteen months at most.

Finally, the privacy policy must state things as they are: which trackers the site sets, what they are for, and how long they last. It is updated with every change of tool, not once and for all. A reassuring sentence that has become false, such as ‘we use no trackers’, exposes you more than an honest text describing well-configured audience measurement.

六Exempt audience measurement, and Google Analytics

There is a way to measure your audience without asking for consent. The CNIL accepts it when the tool is configured to produce only anonymous statistics specific to the site: no tracking from one site to another, no combining with other data, no transfer to third parties. The data collected is not kept beyond twenty-five months. The CNIL has published these conditions, along with a programme for assessing the tools able to meet them.

This route comes at a price: it limits what can be measured. You obtain visit statistics specific to the site, but nothing that allows a person to be followed beyond it, nor to feed an advertising campaign. For many businesses, that is enough: knowing which pages are read already answers most of the questions. Google Analytics, in its usual configuration, does not meet these conditions: it requires consent.

Google's consent mode, basic or advanced

Google offers a ‘consent mode’ (Consent Mode), which comes in two very different variants. In basic mode, Google's tag is loaded only after the visitor agrees: without agreement, nothing is sent. In advanced mode, the tag is loaded on arrival and sends cookieless signals before any agreement. The second gives the measurement tool more information, but it sends requests to Google before the visitor has said yes. We prefer that no request goes to the measurement tool until the visitor has accepted something: so we load Google's script only after agreement.

七What we do on our own site

On our site, the window is titled ‘A senbei before your visit?’: in Japan, a rice cracker is offered with tea, and the window turns this into a small scene. Behind the illustration, the mechanism is plain. Three categories are offered: essentials, always on; audience measurement, off by default; advertising, refused in all circumstances. ‘Reject all’ and ‘Accept all’ are the same size and at the same level.

Without a choice, or after a refusal, the measurement script is not even requested: no request goes to Google, no measurement cookie is set, and any left behind by an earlier visit are deleted. Only after agreement does the page record the consent, then load the tool. The choice lasts six months, after which the question is asked again. A ‘Cookie settings’ link, in the footer of every page, reopens the window to change one's mind.

Advertising remains refused, with no switch: we build no advertising profile of our visitors, and the window says so rather than leaving it to be guessed. Our Personal data page describes audience measurement as it actually works: the tool, its cookies, their lifespan, and how to withdraw consent. We approach consent in the same way on the sites we build (see our web design discipline): it is part of the construction, not a module added at the end.

八Checking your own site

You do not need to be a technician to know whether your site respects the essentials. A desktop browser is enough, with its developer tools, usually opened with the F12 key. The ‘Network’ tab shows every request the page sends; the cookies tab, often found under ‘Application’ or ‘Storage’, shows what has been set.

1. 一
   Start from a blank page

   Open a private browsing window, then the developer tools, before even typing your site's address. That way you will see everything that happens on arrival.

2. 二
   Look before answering

   Load the page without touching the consent window. In the ‘Network’ tab, look for requests to your measurement tool or to advertising networks: there should be none.

3. 三
   Refuse, then reload

   Click ‘Reject all’, reload the page and check again: still no measurement request, and no measurement cookie in the list.

4. 四
   Accept, then observe

   Reopen the window from the footer link, accept, and confirm that the measurement requests appear only at that moment.

5. 五
   Reread the policy

   Finally, compare what you have seen with what your privacy page says: every tracker observed must be described there.

If a measurement request goes out before your answer, the setting needs reworking, whatever the tool. The fix is usually simple, but it involves the loading order of scripts, which calls for care. A site that is sparing with scripts gains twice over: it respects its visitors better, and it displays faster, as we explain in our article on speed.