Data protection
Tracking models and GDPR
No single compliant setup fits every company, and the rules differ per region. Four tracking models explained honestly, trade-offs included.
Last updated 20 July 2026
This page is not legal advice
We explain how our tracking works and which legal questions each model raises, based on our own compliance work. We are a software vendor, not a law firm, and data protection law differs between EU member states (Germany, for example, implements the ePrivacy rules in § 25 TDDDG). Always review your setup with your own legal team. You, as the operator of your website, are the controller under the GDPR; LeadJourney processes data on your behalf under our Data Processing Agreement.
The legal basics
Every tracking setup must pass two legal layers
Discussions usually start with “cookie consent”, but that framing hides the actual rules. Two separate laws apply, and a setup has to satisfy both.
Layer 1: Device access
ePrivacy / § 25 TDDDG in Germany
Storing information on a visitor’s device or reading it back requires consent, unless it is strictly necessary for the service the visitor requested. The rule is technology-neutral: it covers cookies, localStorage, and fingerprinting alike. Marketing attribution is not “strictly necessary”, and whether the cookie is first-party or third-party makes no difference here.
Layer 2: Processing personal data
GDPR, Art. 6
Any processing of personal data needs a legal basis, such as consent, performance of a contract, or legitimate interest. A click ID that follows one visitor’s journey is pseudonymous, not anonymous: it still counts as personal data, because it singles out one person and can later be linked to a lead. IP addresses are personal data too.
A common sales claim in this market is “first-party tracking, so no consent needed”. That claim is wrong. First-party infrastructure improves data quality because it is not blocked the way third-party cookies are, but it does not remove either legal layer.
Not the same everywhere
The rules differ by region
The two layers above are EU law. Customers in North America and Australia face different regimes: mostly opt-out instead of opt-in. Each model below shows its status per region.
- Opt-in
EU/EEA, UK, Switzerland, Quebec
Consent before device access and before sharing with ad platforms. The UK mirrors the EU rules (UK GDPR plus PECR), and Quebec’s Law 25 requires tracking technology to be off by default. Switzerland’s law is formally lighter, but most Swiss sites follow EU practice because they also serve EEA visitors.
- Opt-out
United States
No federal GDPR, but a patchwork of roughly 20 state laws (California, Colorado, Texas, and more). No cookie banner is required. Sending data to ad platforms counts as “selling/sharing” in several states, so you need a “Do Not Sell or Share” link and must honour the Global Privacy Control (GPC) browser signal where required. The practical risk is class-action litigation around pixels and session recording, especially for health data.
- Opt-out, mostly
Canada & Australia
Canada’s PIPEDA accepts implied consent for non-sensitive ad tracking with clear notice and an easy opt-out; Quebec is the strict exception. Australia’s Privacy Act requires disclosure and an opt-out for direct marketing, with no cookie consent rule today. Australian privacy law is under active reform, so this is moving toward stricter rules.
The four models
Pick a model to see exactly what it does
You choose which model runs on your site, and each one shows openly where its legal risk sits, per region.
Model A: Consent-based tracking
Clearest legal footingDevice storage
Cookie + localStorage, only after consent
Consent banner
Required
Cross-session attribution
Yes, for consented visitors
Ad platform upload
Yes, with consent signals
EU / EEA, UK, CH, Quebec
The safe standard
United States
More than required
Canada & Australia
More than required
How it works
- 1The visitor accepts tracking in your consent banner (CMP). Until then, the script stays silent.
- 2The click ID is stored in a first-party cookie and in localStorage, so the visitor is recognised when they return.
- 3The full journey is recorded: ad click, page views, form submission, and the lead’s contact details.
- 4Conversions flow back to Google, Meta, LinkedIn, or Microsoft, together with the consent signals the platforms require.
Advantages
- Consent covers both legal layers, and it is what the ad platforms contractually require for EU traffic.
- Complete journeys for every consented visitor, including returns days or weeks later.
- Full lead-level reporting, including contact details.
Trade-offs
- Visitors who decline are invisible. Their conversions show up as “direct” or not at all.
- You need a properly configured consent banner (CMP).
Notes for your legal team
Legal basis is consent (Art. 6(1)(a) GDPR plus the ePrivacy device rule). The compliance work sits in the banner itself: consent must be informed, granular, and as easy to withdraw as to give, and the script must genuinely stay silent until consent is given.
Model B: Cookieless tracking
Requires your legal assessmentDevice storage
None. No cookie, no localStorage
Consent banner
Not for this tracking itself
Cross-session attribution
Same session, plus a coarse server-side signal
Ad platform upload
No, not without consent
EU / EEA, UK, CH, Quebec
Defensible with your legal assessment
United States
No issue
Canada & Australia
No issue
How it works
- 1Attribution relies on the click ID arriving in the URL (such as gclid or fbclid) plus data the server receives with any normal page request.
- 2The click ID lives in page memory only and is handed through to your form during the same visit.
- 3IP addresses are truncated at ingestion. Reports identify visitors by a pseudonymous ID.
- 4Contact details only enter the picture when a lead actively submits your form, which has its own legal basis (typically Art. 6(1)(b) GDPR).
- 5Visitors can object at any time (Art. 21 GDPR): an opt-out, linked from your privacy notice, sets a flag that stops the script from sending any further events. Storing that flag in the browser is allowed without consent, because remembering a visitor’s own choice is strictly necessary.
Advantages
- Paid channels stay measurable for visitors who never see, or who decline, a banner.
- No device access, so the ePrivacy consent requirement for cookies and similar storage is not triggered by the tracking itself.
- Data minimisation by design: truncated IPs, no device identifiers.
Trade-offs
- A visitor who returns days later and converts can only be linked to the original click through a coarse server-side signal, not reliably. Multi-visit journeys often break.
- Some conversions land in “direct”. Coverage of the click-to-lead moment is high; coverage of long journeys is not.
- Besides the click ID, LeadJourney can derive a coarse server-side signal from what every browser sends with a request (IP address, ISP, device and browser characteristics) to help link repeat visits. It is a probability, not a stored identifier, and under ePrivacy and the UK's PECR it can still count as information taken from the device, so it belongs in your legal assessment.
Notes for your legal team
Often sold as “consent-free”, and that is where honesty matters: the pseudonymous click ID is still personal data, so a GDPR legal basis is still required. The usual argument is legitimate interest (Art. 6(1)(f)) with safeguards (IP truncation, short retention, no cross-site profiles, no platform uploads without consent, and a working opt-out for visitors who object). German supervisory authorities (DSK) accept consent-free measurement only under narrow conditions. Whether that carries your setup is exactly the question for your legal team, together with whether your consent mechanism should gate the server-side signal described above. We deliberately do not market this mode as “100% GDPR-compliant without a banner”.
Model C: Consent-aware tracking
Recommended setupDevice storage
Only after consent
Consent banner
Required
Cross-session attribution
Consented: yes. Declined: same session only
Ad platform upload
Consented visitors only
EU / EEA, UK, CH, Quebec
Recommended
United States
Works, stricter than required
Canada & Australia
Works, stricter than required
How it works
- 1Your consent management platform passes each visitor’s consent state to the LeadJourney script.
- 2Visitor accepts: full consent-based tracking as in Model A, including cross-session recognition and platform uploads.
- 3Visitor declines or has not answered yet: automatic fallback to cookieless mode as in Model B. Nothing is stored on the device, IPs are truncated, nothing is sent to the platforms.
Advantages
- The best available data for every visitor, without treating a “no” as permission.
- No blind spot when consent rates drop, and no over-collection when they do not.
Trade-offs
- Requires a consent banner and a small integration step to pass the consent signal.
- Reports mix full journeys and session-level data, which is worth understanding when reading them.
Notes for your legal team
Legally this is Models A and B applied per visitor, so both assessments apply, each to its own share of traffic. The per-visitor switch itself is a safeguard: it demonstrates that declining consent has real technical consequences.
Model D: No-consent tracking
Non-compliant in the EUDevice storage
Always: cookie + localStorage for everyone
Consent banner
Ignored by the tracking
Cross-session attribution
Yes, for every visitor
Ad platform upload
Yes, for every visitor
EU / EEA, UK, CH, Quebec
Non-compliant, your risk
United States
Broadly lawful with opt-out link + GPC
Canada & Australia
Broadly lawful with notice + opt-out
How it works
- 1The script stores the click ID for every visitor, before and regardless of any banner interaction.
- 2Full journeys and contact details are recorded for everyone who converts, including visitors who declined.
- 3Conversions are uploaded to the ad platforms for every visitor.
Advantages
- The most complete dataset, typically 95%+ of visitors, with no dependence on consent rates.
- The strongest optimisation signal for the ad platforms’ algorithms.
- No banner integration work for the tracking itself.
Trade-offs
- In the EU/EEA, UK, and Quebec this violates the consent requirements. GDPR fines reach up to 20M EUR or 4% of global turnover, and competitors and consumer groups can take action too.
- The ad platforms require consent signals for EEA and UK traffic (for example Google’s EU User Consent Policy). Uploading non-consented conversions breaches their policies and can get your ad account restricted or banned, independent of any regulator.
- Reputational risk if visitors, customers, or journalists notice that declining the banner changes nothing.
Notes for your legal team
In the United States this is broadly how lawful tracking works today, provided you honour opt-outs (a “Do Not Sell or Share” link and the Global Privacy Control signal where state law requires it) and stay away from sensitive categories such as health data. The same goes for most of Canada (implied consent under PIPEDA, Quebec excepted) and for Australia. In the EU-style opt-in regimes this model is not defensible, and we will not tell you otherwise. Some companies knowingly run it there anyway, weighing marketing data against legal risk. That is a business decision only you can make: you are the controller, and the full legal and platform-policy risk sits with you.
Side by side
The four models compared
| Criterion | AConsent-based | BCookieless | CConsent-aware | DNo-consent |
|---|---|---|---|---|
| Stores data on the device | Yes, after consent | Never | Only after consent | Always |
| Consent banner needed | Yes | Not for this tracking itself (other tools may still need one) | Yes | Ignored by the tracking |
| Cross-session attribution | Yes, for consented visitors | No, same session only | Consented: yes. Declined: same session only | Yes, for every visitor |
| Visitors who decline | Not measured | Measured pseudonymously, same session | Measured pseudonymously, same session | Fully tracked anyway |
| Conversion upload to ad platforms | Yes, with consent signals | No | Consented visitors only | Yes, for every visitor |
| Primary legal basis | Consent | Legitimate interest (to be assessed by you) | Consent plus legitimate interest | None in the EU. Opt-out regimes: notice plus opt-out |
| EU / EEA, UK, Quebec | Compliant | Defensible with your legal assessment | Compliant (recommended) | Non-compliant, your risk |
| USA, rest of Canada, Australia | Compliant, more than required | Compliant | Compliant | Broadly lawful with opt-out mechanics |
| Relative legal risk | Lowest | Higher, depends on your assessment | Low, with Model B’s residual risk on the declined share | High in the EU, manageable in opt-out regimes |
How much data each model captures in practice depends heavily on your audience and your banner. We intentionally do not promise a universal percentage.
The strictest part
Sending conversions back to ad platforms
Feeding conversions back to Google, Meta, LinkedIn, or Microsoft is one of the most valuable things a tracker does, and also the step with the least legal wiggle room. A click ID is directly linked to a user account inside the platform.
GDPR
Disclosing the click ID and conversion to the platform is a transfer of personal data for advertising purposes. The broadly accepted legal basis for this is consent.
Platform policies
The platforms themselves require consent signals for EEA traffic (for example Google’s EU User Consent Policy with Consent Mode). Uploading conversions for users who declined can put your ad account at risk, independent of any regulator.
In Models A to C, LeadJourney gates platform uploads on consent, including in cookieless mode. Model D removes that gate at your explicit instruction, and the legal and platform-policy risk then sits with you as the controller. Vendors who promise to “send 100% of conversions to the platform without consent, fully compliant” are hiding that risk; we would rather name it.
Our lines
What LeadJourney does not do, in any model
No third-party cookies
Tracking runs first-party on your own domain. Nothing is set on or read from a third-party domain.
No cross-site profiles
Your tracking data is used for your reporting only. No cross-customer profiles.
No selling of data
Visitor and lead data is never sold or used for our own marketing.
No fake compliance claims
No “fully GDPR-compliant, no banner needed” promises. Compliance depends on your setup and your legal assessment.
All platform data is hosted in Frankfurt, Germany, inside the EU. Details are on our GDPR page and in our technical and organisational measures.
Before you decide
Questions to settle with your legal team
- 1
Where are our visitors located, and which regime applies to them: EU-style opt-in (EU/EEA, UK, Quebec) or opt-out (US states, rest of Canada, Australia)?
- 2
Which visitors do we have consent from, and does our banner meet the requirements (informed, granular, easy withdrawal)?
- 3
If we want cookieless measurement for non-consented visitors, can we support a legitimate-interest assessment (LIA) for it, with the safeguards documented?
- 4
Is our privacy notice updated to describe the tracking, the legal bases, retention, and the visitor’s right to object?
- 5
Which conversions do we upload to which ad platforms, and is that gated on consent end to end?
- 6
Do we have a Data Processing Agreement with LeadJourney and with every other vendor in the chain?
We are happy to walk your legal team through the technical details of any model, and we provide a GDPR-compliant DPA. The Data Processing Agreement, our technical and organisational measures and how we handle data subject rights are published here; for anything else, contact us at [email protected].
Common questions
Frequently asked questions
The questions that come up first when a legal team reads this page, answered with the same care as the rest of it.
Do I need a cookie banner when using LeadJourney?
It depends on the model and on where your visitors are. In the EU/EEA, the UK, and Quebec, consent-based and consent-aware tracking (Models A and C) require a consent banner, because they store a click ID on the visitor's device. Cookieless tracking (Model B) is designed to work without device storage, so the tracking itself does not trigger the cookie consent requirement, but other tools on your site usually still need a banner, and the GDPR side needs your own legal assessment. In the US, Canada outside Quebec, and Australia, no banner is required; you need transparency and a working opt-out instead.
Is cookieless tracking 100% GDPR-compliant without a banner?
No vendor can honestly promise that, including us. The pseudonymous click ID is still personal data under the GDPR, so you need a legal basis, usually legitimate interest, and that assessment depends on your specific setup. What we can say: cookieless mode avoids the device-access consent requirement, minimises data by design, and does not upload conversions to ad platforms without consent. Whether legitimate interest carries your case is a question for your legal team.
What happens to visitors who decline the banner?
That depends on the model you run. Consent-based (Model A): they are not tracked at all. Cookieless (B) and consent-aware (C): they are measured pseudonymously within the session that contains the ad click, nothing is stored on their device, and nothing is sent to ad platforms. No-consent (Model D): they are fully tracked anyway, which is non-compliant in the EU and entirely your risk as the controller.
Can visitors object to cookieless tracking?
Yes. Tracking based on legitimate interest comes with a right to object (Art. 21 GDPR), so your privacy notice should offer an opt-out. Technically, the opt-out sets a flag that stops the script from sending any further events. Storing that flag in the browser is permitted without consent, because remembering a visitor's own choice counts as strictly necessary.
Does LeadJourney use fingerprinting?
LeadJourney does not rely on third-party cookies, and attribution is based on click IDs. Besides the click ID, LeadJourney can derive a coarse server-side signal from what every browser sends with a request (IP address, ISP, device and browser characteristics) to help link repeat visits. Regulators can treat a signal built from device and browser characteristics as fingerprinting under ePrivacy and PECR, so include it in your consent analysis. On request we provide a written technical breakdown: what the script stores on the device, which signals are generated or derived on the server, how long each is kept, and what we recommend gating behind your consent mechanism.
Which model should we choose?
We cannot make that call for you, and this page is not legal advice. As orientation: for EU traffic, consent-aware tracking (Model C) usually offers the best balance, lawful full tracking where you have consent and session-level measurement where you do not. For US, Canadian, and Australian traffic, full tracking with a proper opt-out is the market standard. Take the trade-offs on this page to your legal team; we are happy to walk them through the technical details.
For your legal team
We will walk your legal team through every model
One call covers the technical walkthrough of the model you are weighing and the document set your review needs: the Data Processing Agreement, the technical and organisational measures and the sub-processor list.
