What you are allowed to measure before anybody clicks accept

Regulation 5(3) of S.I. No. 336 of 2011 prohibits using an electronic communications network to store information, or to gain access to information already stored, in the terminal equipment of a subscriber or user, without consent and without clear and comprehensive information.

Two features of that wording decide most measurement questions. It is about the act of storing or reading on the device, not about whether the thing stored is personal data. And it is technology-neutral, so cookies, local storage, session storage, a pixel that sets an identifier and a fingerprinting script are all the same act in law.

So the boundary is not between personal and anonymous. It is between touching the device and not touching it.

More than most people assume, and it is worth knowing before buying anything.

Analytics is not strictly necessary. Nobody visits a website in order to be measured, so the second limb of the Regulation 5(5) exemption, which requires the storing to be strictly necessary to provide a service explicitly requested by the user, does not reach it. Whether it ought to is a real policy argument in Europe and it is not the current Irish position.

Advertising pixels are further from the line rather than closer to it. So is session recording, so are heatmaps, and so is anything that follows a person between visits.

The Data Protection Commission's guidance is specific about the mechanics as well: pre-ticked boxes and defaults set to on are not permitted, wording that treats continued use or scrolling as consent is not permissible, and silence or inaction cannot constitute consent. The banner rules are set out separately.

There are consent-rate statistics in circulation for Ireland. They come from vendors with something to sell, none of them publishes a method, and your own rate is the only one that decides anything. It is also easy to obtain.

Count consent decisions at the banner, which you can do server-side without storing anything on the device, and compare accepted against declined against ignored. Then compare your analytics session count against your server log request count for the same period. The ratio between them is your real measurement coverage.

That number is worth more than any benchmark, and it is the number that decides whether the next paragraph is relevant to you.

The difference between what a business sells and what its ad platforms report has two causes and only one of them is consent.

The other is ordinary loss: browsers blocking third-party requests, extensions, network failures, attribution windows and the fact that a browser-side tag has to survive a page unload to fire. That share has nothing to do with anybody declining, and it is the share a server-side setup genuinely recovers.

Which of the two dominates is an empirical question about your own site, and it is the whole basis on which the work should be bought or not bought. What server-side tracking actually fixes sets out both halves, including the part it cannot legally fix.

The most reliable numbers in a small business are the ones already in its own systems, and they are systematically under-used because they are less exciting than a dashboard of sessions.

Orders by source captured at the point of sale, as a field on the order rather than as an inference from a cookie. Revenue per customer over time. The proportion of enquiries that become quotes and quotes that become work. Repeat purchase rate. None of those requires consent, none of them degrades when a browser changes its defaults, and all of them are closer to the decision a business is trying to make.

The honest sequencing for most Irish SMEs is to get those right first and treat platform attribution as the thing that helps you spend an advertising budget rather than as the thing that tells you how the business is doing.

Behavioural tracking is not just a consent question. Item 4 of the Data Protection Commission's list of processing requiring an impact assessment is systematically monitoring, tracking or observing individuals' location or behaviour, and item 9 covers combining separate datasets where the linking contributes to profiling or behavioural analysis.

A joined-up reporting setup that puts an advertising platform, an analytics property and a payment processor on the same customer is item 9 in its own words: different sources, different original purposes, different controllers. Whether that makes an assessment mandatory is a ten minute question, and it is better answered before the dashboard is built than after.