Track only after consent

Region

European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.

How to do it

The consent banner itself follows store nothing extra without a yes and treat the privacy signal as a no. This rule is about where the check sits. Put it inside the generated tracking function, so no feature can forget it. Without consent, either drop the event or send a count with no ID and no storage. A count of paths, kept without IP address, user agent or ID, needs no tracking at all. A self-hosted tool that works this way can serve every visitor. Say which tool you use in the privacy policy. Marketing messages need their own consent, as Have consent before any marketing message says. Apps follow Ask before any tracking.

Examples

JavaScript example

export function track(name, properties) {
  const consent = readConsent(); // the stored choice from the consent banner
  if (!consent.analytics || navigator.globalPrivacyControl) return sendAnonymousCount(name);
  navigator.sendBeacon('/collect', JSON.stringify({ name, properties, anonymous_id: consent.analyticsId }));
}

Python example

def track(request, name: str, properties: dict):
    consent = read_consent(request)  # the stored choice, server side
    if not consent.analytics or request.headers.get("Sec-GPC") == "1":
        return record_anonymous_count(name)
    collect({"name": name, "properties": properties, "anonymous_id": consent.analytics_id})

How to check

A browser test with a fresh profile clicks through sign-up and checkout without consenting. The collector receives no event with a user or device ID, and no analytics storage exists. The stored count rows hold no IP address, user agent or ID.

Sources

• ePrivacy Directive Article 5(3)
• GDPR Article 7 on conditions for consent
• EDPB Guidelines 2/2023 on Article 5(3) ePrivacy

Related rules

• WEB-37 Measure speed in visitors' browsers in Website
• STK-79 Use Plausible for analytics without cookies in Software choices
• MOB-29 Ask before any tracking in Mobile apps
• DEN-36 Remove people who objected from every sync out of the warehouse in Data engineering
• DSK-42 Send usage data only after the user says yes in Desktop apps and extensions
• SEO-86 Count visits that come from AI assistants in SEO
• WEB-207 Store nothing extra without a yes in Website
• WEB-208 Treat the privacy signal as a no in Website
• NTF-2 Have consent before any marketing message in Notifications