---
title: "Track only after consent · Agent Wranglers"
url: https://agentwranglers.se/playbook/analytics/privacy-and-consent/analytics-consent
id: ANA-7
level: Required
applies: eu-users
region: EU
risk: law
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1384
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Track only after consent

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Privacy and consent](https://agentwranglers.se/playbook/analytics/privacy-and-consent.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: ANA-7
- Level: Required
- Chapter: [Privacy and consent](https://agentwranglers.se/playbook/analytics/privacy-and-consent.md)
- Rule: Send no analytics event that uses device storage or identifies a person until that person has agreed. Read the stored choice in the tracking module itself. Without a yes, count visits only, with no cookie, no device storage and no ID.
- Check: A browser test with a fresh profile clicks through sign-up and checkout without consenting. The collector receives no event with a user or device ID, and no analytics storage exists. The stored count rows hold no IP address, user agent or ID.
- Risk: A law broken
- Applies when: The project has users in the EU.
- Region: European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.
- How: The consent banner itself follows [store nothing extra without a yes](https://agentwranglers.se/playbook/website/privacy/cookie-consent.md) and [treat the privacy signal as a no](https://agentwranglers.se/playbook/website/privacy/global-privacy-control.md). This rule is about where the check sits. Put it inside the generated tracking function, so no feature can forget it. Without consent, either drop the event or send a count with no ID and no storage. A count of paths, kept without IP address, user agent or ID, needs no tracking at all. A self-hosted tool that works this way can serve every visitor. Say which tool you use in the privacy policy. Marketing messages need their own consent, as [Have consent before any marketing message](https://agentwranglers.se/playbook/notifications/channels-and-preferences/marketing-consent.md) says. Apps follow [Ask before any tracking](https://agentwranglers.se/playbook/mobile-apps/privacy-declarations/tracking-permission.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
export function track(name, properties) {
  const consent = readConsent(); // the stored choice from the consent banner
  if (!consent.analytics || navigator.globalPrivacyControl) return sendAnonymousCount(name);
  navigator.sendBeacon('/collect', JSON.stringify({ name, properties, anonymous_id: consent.analyticsId }));
}
```

### Python example

```python
def track(request, name: str, properties: dict):
    consent = read_consent(request)  # the stored choice, server side
    if not consent.analytics or request.headers.get("Sec-GPC") == "1":
        return record_anonymous_count(name)
    collect({"name": name, "properties": properties, "anonymous_id": consent.analytics_id})
```

## Sources

- [ePrivacy Directive Article 5(3)](https://eur-lex.europa.eu/eli/dir/2002/58/oj)
- [GDPR Article 7 on conditions for consent](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- [EDPB Guidelines 2/2023 on Article 5(3) ePrivacy](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-22023-technical-scope-art-53-eprivacy-directive_en)

## Related rules

- WEB-37 [Measure speed in visitors' browsers](https://agentwranglers.se/playbook/website/performance/field-measurement.md) in Website
- STK-79 [Use Plausible for analytics without cookies](https://agentwranglers.se/playbook/stack/product-services/plausible-analytics.md) in Software choices
- MOB-29 [Ask before any tracking](https://agentwranglers.se/playbook/mobile-apps/privacy-declarations/tracking-permission.md) in Mobile apps
- DEN-36 [Remove people who objected from every sync out of the warehouse](https://agentwranglers.se/playbook/data-engineering/personal-data-in-the-warehouse/reverse-sync-objections.md) in Data engineering
- DSK-42 [Send usage data only after the user says yes](https://agentwranglers.se/playbook/desktop-apps/crashes-telemetry-and-accessibility/telemetry-opt-in.md) in Desktop apps and extensions
- SEO-86 [Count visits that come from AI assistants](https://agentwranglers.se/playbook/seo/ai-search-answers/ai-referral-traffic.md) in SEO
- WEB-207 [Store nothing extra without a yes](https://agentwranglers.se/playbook/website/privacy/cookie-consent.md) in Website
- WEB-208 [Treat the privacy signal as a no](https://agentwranglers.se/playbook/website/privacy/global-privacy-control.md) in Website
- NTF-2 [Have consent before any marketing message](https://agentwranglers.se/playbook/notifications/channels-and-preferences/marketing-consent.md) in Notifications

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/analytics/privacy-and-consent/analytics-consent">Agent Wranglers product analytics and experiments playbook</a>`. In code you write, add a comment next to it with the same link.

- Next: [Keep personal data out of events](https://agentwranglers.se/playbook/analytics/privacy-and-consent/events-without-personal-data.md)
- [Privacy and consent](https://agentwranglers.se/playbook/analytics/privacy-and-consent.md)