What you are allowed to measure before anybody clicks accept

Regulation 5(3) of S.I. No. 336 of 2011 prohibits using an electronic communications network to store information, or to gain access to information already stored, in the terminal equipment of a subscriber or user, without consent and without clear and comprehensive information.

In plain terms: storing or reading anything on a visitor's phone or computer needs their consent and clear information first, apart from two narrow exceptions. Two features of the Regulation's wording decide most measurement questions. It is about the act of storing or reading on the device, not about whether the thing stored is personal data. And it treats every technology the same, so cookies, local storage, session storage, a pixel that sets or reads an identifier and a fingerprinting script are all the same act in law.

The boundary is between touching the device and not touching it. Whether the data is personal does not move it.

A useful amount, and it is worth knowing before buying anything.

Analytics is not strictly necessary. The visitor did not ask for measurement as a service. Regulation 5(5) exempts storing that is strictly necessary to provide a service the user explicitly asked for, and that exemption does not reach analytics. There is a real policy argument in Europe that it should, but that is not the current Irish position.

Advertising pixels are further from the line, and so are session recording, heatmaps and anything that follows a person between visits.

The Data Protection Commission's guidance is specific about the mechanics as well: pre-ticked boxes and defaults set to on are not permitted, wording that treats continued use or scrolling as consent is not permissible, and silence or inaction cannot constitute consent. The banner rules are set out separately.

Your own consent rate is the one that decides this, and it can be measured.

Count what happens at the banner: accepted, declined and ignored. You can do that on your server without storing anything on the device. Then compare the visits your analytics counts with the requests your server logs record for the same period. The ratio between them tells you how much of your traffic you are measuring.

That number is worth more than any benchmark, and it is the number that decides whether the next section is relevant to you.

The difference between what a business sells and what its ad platforms report has two causes and only one of them is consent.

The other is ordinary loss: browsers blocking requests to other companies' servers, extensions, network failures, the time limits platforms put on crediting an ad (attribution windows), and tags in the browser that do not fire before the page closes. That share has nothing to do with anybody declining, and it is the share a server-side setup recovers.

Which of the two is bigger depends on your own site, and you can measure it. That answer is the whole basis for deciding whether to buy the work. What server-side tracking fixes sets out both halves, including the part it cannot legally fix.

The numbers already in a business's own systems need no consent.

Where each order came from, recorded on the order when it is placed. Revenue per customer over time. The proportion of enquiries that become quotes and quotes that become work. Repeat purchase rate. None of those requires consent, none of them degrades when a browser changes its defaults, and all of them are closer to the decision a business is trying to make.

Get those right first. Platform attribution helps you spend an advertising budget, and the business's own records tell you how the business is doing.

Tracking what people do is a data protection question as well as a consent one. The Data Protection Commission keeps a list of processing that can require an impact assessment. Item 4 is systematically monitoring, tracking or observing people's location or behaviour. Item 9 covers combining separate datasets where the linking significantly contributes to, or is used for, profiling or behavioural analysis.

A joined-up reporting setup that links an advertising platform, an analytics account and a payment processor to the same customer fits item 9's own description: different sources, different original purposes, different organisations in charge of the data. Whether that makes an assessment mandatory is better answered before the dashboard is built than after.