Tracking Models & GDPR
There is no single “compliant tracking setup” that fits every company, and the rules differ between the EU, the US, Canada, and Australia. This page explains four tracking models honestly, including their legal trade-offs per region, so you can decide together with your legal team instead of taking a vendor’s word for it.
Last updated: 20 July 2026
This page is not legal advice
We explain how our tracking works and which legal questions each model raises, based on our own compliance work. We are a software vendor, not a law firm, and data protection law differs between EU member states (Germany, for example, implements the ePrivacy rules in § 25 TDDDG). Always review your setup with your own legal team. You, as the operator of your website, are the controller under the GDPR; LeadJourney processes data on your behalf under our Data Processing Agreement.
The legal basics
Every tracking setup must pass two legal layers
Discussions usually start with “cookie consent”, but that framing hides the actual rules. Two separate laws apply, and a setup has to satisfy both.
Layer 1: Device access
ePrivacy / § 25 TDDDG in Germany
Storing information on a visitor’s device or reading it back requires consent, unless it is strictly necessary for the service the visitor requested. The rule is technology-neutral: it covers cookies, localStorage, and fingerprinting alike. Marketing attribution is not “strictly necessary”, and whether the cookie is first-party or third-party makes no difference here.
Layer 2: Processing personal data
GDPR, Art. 6
Any processing of personal data needs a legal basis, such as consent, performance of a contract, or legitimate interest. A click ID that follows one visitor’s journey is pseudonymous, not anonymous: it still counts as personal data, because it singles out one person and can later be linked to a lead. IP addresses are personal data too.
A common sales claim in this market is “first-party tracking, so no consent needed”. That claim is wrong. First-party infrastructure improves data quality because it is not blocked the way third-party cookies are, but it does not remove either legal layer.
Not the same everywhere
The rules differ by region
The two layers above are EU law. Customers in North America and Australia face different regimes: mostly opt-out instead of opt-in. Each model below shows its status per region.
EU/EEA, UK, Switzerland, Quebec
Consent before device access and before sharing with ad platforms. The UK mirrors the EU rules (UK GDPR plus PECR), and Quebec’s Law 25 requires tracking technology to be off by default. Switzerland’s law is formally lighter, but most Swiss sites follow EU practice because they also serve EEA visitors.
United States
No federal GDPR, but a patchwork of roughly 20 state laws (California, Colorado, Texas, and more). No cookie banner is required. Sending data to ad platforms counts as “selling/sharing” in several states, so you need a “Do Not Sell or Share” link and must honour the Global Privacy Control (GPC) browser signal where required. The practical risk is class-action litigation around pixels and session recording, especially for health data.
Canada & Australia
Canada’s PIPEDA accepts implied consent for non-sensitive ad tracking with clear notice and an easy opt-out; Quebec is the strict exception. Australia’s Privacy Act requires disclosure and an opt-out for direct marketing, with no cookie consent rule today. Australian privacy law is under active reform, so this is moving toward stricter rules.
The four models
Pick a model to see exactly what it does
You choose which model runs on your site, and each one shows openly where its legal risk sits, per region.
Model A: Consent-based tracking
Clearest legal footingDevice storage
Cookie + localStorage, only after consent
Consent banner
Required
Cross-session attribution
Yes, for consented visitors
Ad platform upload
Yes, with consent signals
EU / EEA, UK, CH, Quebec
The safe standard
United States
More than required
Canada & Australia
More than required
How it works
- 1The visitor accepts tracking in your consent banner (CMP). Until then, the script stays silent.
- 2The click ID is stored in a first-party cookie and in localStorage, so the visitor is recognised when they return.
- 3The full journey is recorded: ad click, page views, form submission, and the lead’s contact details.
- 4Conversions flow back to Google, Meta, LinkedIn, or Microsoft, together with the consent signals the platforms require.
Advantages
- Consent covers both legal layers, and it is what the ad platforms contractually require for EU traffic.
- Complete journeys for every consented visitor, including returns days or weeks later.
- Full lead-level reporting, including contact details.
Trade-offs
- Visitors who decline are invisible. Their conversions show up as “direct” or not at all.
- You need a properly configured consent banner (CMP).
Notes for your legal team
Legal basis is consent (Art. 6(1)(a) GDPR plus the ePrivacy device rule). The compliance work sits in the banner itself: consent must be informed, granular, and as easy to withdraw as to give, and the script must genuinely stay silent until consent is given.
Side by side
The four models compared
| AConsent-based | BCookieless | CConsent-aware | DNo-consent | |
|---|---|---|---|---|
| Stores data on the device | Yes, after consent | Never | Only after consent | Always |
| Consent banner needed | Yes | Not for this tracking itself (other tools may still need one) | Yes | Ignored by the tracking |
| Cross-session attribution | Yes, for consented visitors | No, same session only | Consented: yes. Declined: same session only | Yes, for every visitor |
| Visitors who decline | Not measured | Measured pseudonymously, same session | Measured pseudonymously, same session | Fully tracked anyway |
| Conversion upload to ad platforms | Yes, with consent signals | No | Consented visitors only | Yes, for every visitor |
| Primary legal basis | Consent | Legitimate interest (to be assessed by you) | Consent plus legitimate interest | None in the EU. Opt-out regimes: notice plus opt-out |
| EU / EEA, UK, Quebec | Compliant | Defensible with your legal assessment | Compliant (recommended) | Non-compliant, your risk |
| USA, rest of Canada, Australia | Compliant, more than required | Compliant | Compliant | Broadly lawful with opt-out mechanics |
| Relative legal risk | Lowest | Higher, depends on your assessment | Low, with Model B’s residual risk on the declined share | High in the EU, manageable in opt-out regimes |
How much data each model captures in practice depends heavily on your audience and your banner. We intentionally do not promise a universal percentage.
The strictest part
Sending conversions back to ad platforms
Feeding conversions back to Google, Meta, LinkedIn, or Microsoft is one of the most valuable things a tracker does, and also the step with the least legal wiggle room. A click ID is directly linked to a user account inside the platform.
GDPR
Disclosing the click ID and conversion to the platform is a transfer of personal data for advertising purposes. The broadly accepted legal basis for this is consent.
Platform policies
The platforms themselves require consent signals for EEA traffic (for example Google’s EU User Consent Policy with Consent Mode). Uploading conversions for users who declined can put your ad account at risk, independent of any regulator.
In Models A to C, LeadJourney gates platform uploads on consent, including in cookieless mode. Model D removes that gate at your explicit instruction, and the legal and platform-policy risk then sits with you as the controller. Vendors who promise to “send 100% of conversions to the platform without consent, fully compliant” are hiding that risk; we would rather name it.
Our lines
What LeadJourney does not do, in any model
No fingerprinting
No techniques to re-identify visitors who declined or were never asked.
No cross-site profiles
Your tracking data is used for your reporting only. No cross-customer profiles.
No selling of data
Visitor and lead data is never sold or used for our own marketing.
No fake compliance claims
No “fully GDPR-compliant, no banner needed” promises. Compliance depends on your setup and your legal assessment.
All platform data is hosted in Frankfurt, Germany, inside the EU. Details are on our GDPR page and in our technical and organisational measures.
Common questions
Frequently asked questions
It depends on the model and on where your visitors are. In the EU/EEA, the UK, and Quebec, consent-based and consent-aware tracking (Models A and C) require a consent banner, because they store a click ID on the visitor's device. Cookieless tracking (Model B) is designed to work without device storage, so the tracking itself does not trigger the cookie consent requirement, but other tools on your site usually still need a banner, and the GDPR side needs your own legal assessment. In the US, Canada outside Quebec, and Australia, no banner is required; you need transparency and a working opt-out instead.
No vendor can honestly promise that, including us. The pseudonymous click ID is still personal data under the GDPR, so you need a legal basis, usually legitimate interest, and that assessment depends on your specific setup. What we can say: cookieless mode avoids the device-access consent requirement, minimises data by design, and does not upload conversions to ad platforms without consent. Whether legitimate interest carries your case is a question for your legal team.
That depends on the model you run. Consent-based (Model A): they are not tracked at all. Cookieless (B) and consent-aware (C): they are measured pseudonymously within the session that contains the ad click, nothing is stored on their device, and nothing is sent to ad platforms. No-consent (Model D): they are fully tracked anyway, which is non-compliant in the EU and entirely your risk as the controller.
Yes. Tracking based on legitimate interest comes with a right to object (Art. 21 GDPR), so your privacy notice should offer an opt-out. Technically, the opt-out sets a flag that stops the script from sending any further events. Storing that flag in the browser is permitted without consent, because remembering a visitor's own choice counts as strictly necessary.
We cannot make that call for you, and this page is not legal advice. As orientation: for EU traffic, consent-aware tracking (Model C) usually offers the best balance, lawful full tracking where you have consent and session-level measurement where you do not. For US, Canadian, and Australian traffic, full tracking with a proper opt-out is the market standard. Take the trade-offs on this page to your legal team; we are happy to walk them through the technical details.
Before you decide
Questions to settle with your legal team
Where are our visitors located, and which regime applies to them: EU-style opt-in (EU/EEA, UK, Quebec) or opt-out (US states, rest of Canada, Australia)?
Which visitors do we have consent from, and does our banner meet the requirements (informed, granular, easy withdrawal)?
If we want cookieless measurement for non-consented visitors, can we support a legitimate-interest assessment (LIA) for it, with the safeguards documented?
Is our privacy notice updated to describe the tracking, the legal bases, retention, and the visitor’s right to object?
Which conversions do we upload to which ad platforms, and is that gated on consent end to end?
Do we have a Data Processing Agreement with LeadJourney and with every other vendor in the chain?
We are happy to walk your legal team through the technical details of any model, and we provide a GDPR-compliant DPA. Contact us at [email protected].
Track every lead
With Pixel-Perfect Accuracy
Stop losing data to iOS, ad blockers and CRM gaps. Server-side tracking, built for lead generation — live in 21 minutes.
