Consent Management

Consent management covers everything needed to collect, document and technically enforce your website visitors' consent to data processing. You usually see it as a cookie banner; behind it there's typically a consent management platform (CMP).

What a CMP does

1. Ask: The banner asks for consent, usually split into categories like ‘necessary’, ‘statistics’ and ‘marketing’.
2. Store: The choice is logged with a timestamp so you can prove it.
3. Control: Tracking scripts like the Meta Pixel or Google tags only load once the matching category is approved.
4. Allow withdrawal: Visitors must be able to change their choice later.

Why consent management changes tracking

In the EU, the GDPR and the ePrivacy rules generally require consent for marketing and analytics cookies. If a visitor declines, those scripts must not run. For you, that means the ad account only sees part of your real conversions. Many US states now have their own privacy laws as well, typically with opt-out rather than opt-in rules.

Example

Your landing page gets 1,000 visitors from Meta ads, and 40 of them become leads. If 60% accept marketing consent, the browser pixel sees only about 24 leads on average. The cost per lead in the ad account looks much higher than it really is – and the algorithm has fewer signals to learn from.

Consent management in lead generation

Because consent shrinks your data, it pays to also capture leads from your CRM or forms instead of relying on browser events alone. Clarify with your privacy advisor which data you share with ad platforms and on what legal basis.

With lead tracking in LeadMetrics, the lifetime of a session depends on consent: 90 days with consent, 1 day without.

Common mistakes

• Loading scripts before consent: The banner is there, but the pixel still fires immediately.
• Hiding the reject option: An ‘accept all’ button without an equally easy way to decline is legally risky in the EU.
• Wrong categories: Putting a marketing tag under ‘necessary’ doesn't get around consent – it just makes your setup vulnerable.

Note: This article is not legal advice.