A site can ask for permission for advertising while treating some analytics as always allowed. To understand that choice, compare which tools respond to consent, what continues, and what the site says about it.
This guide explains the evidence to collect for that comparison. It does not publish a CookieTrail estimate of how often sites choose each strategy.
Compare three measurement strategies
Switch strategies to see what changes before a choice, after rejection, and after acceptance. These are invented implementations.
- Before a choice
- No example analytics or advertising events
- After rejection
- Both remain blocked
- After acceptance
- Both send events
Measurement depends on affirmative permission in this example.
Next check: Check that the same rule applies on landing pages and in each intended region.
Invented observations for teaching. Manual-debugger details illustrate evidence beyond CookieTrail’s current standard capture. Colors describe this example’s evidence or stated policy, not legal compliance.
Three measurement strategies
Start by distinguishing a site that waits for permission, a site that continues limited measurement, and a site that leaves ordinary analytics unchanged while blocking advertising. They can display similar banners and still collect different information.
Google's basic Consent Mode blocks transmission without consent. Advanced mode can send cookieless measurements while consent is denied. A request to an Analytics endpoint therefore needs supporting evidence before you assign it to a strategy.
- Google Consent Mode Documented behavior of basic and advanced implementations.
There is also a commercial reason to preserve limited measurement: Google's behavioral modeling has advanced-mode and data-volume prerequisites. This documents an incentive; it does not tell us why an individual team selected its configuration.
- Google behavioral modeling Requirements for estimating activity missing from consented measurement.
Compare the explanation with the implementation
- List the tools named in the banner and cookie declaration, including their assigned purposes.
- Read the privacy policy for claims such as aggregate statistics, necessary operation, or consent-exempt analytics.
- Record which features are enabled. A vendor that offers advertising features might not have those features enabled on this site.
- Ask who owns the exception decision and which visitor regions it covers.
A statement that a tool is anonymous or cookieless is a claim to investigate. Device-access rules can apply to non-personal information and techniques beyond cookies. The applicable exemptions and later processing need separate review.
- EDPB technical scope guidance Why the absence of personal data or a conventional cookie does not alone settle scope.
Measure the pattern at a verified location
Run the same URL in separate fresh sessions before choice, after acceptance, and after verified rejection. Use comparable observation windows. Compare cookie snapshots and recognized collection requests with the site's stated policy.
A selective pattern is worth investigating: advertising changes while analytics remains unchanged. It could reflect a reviewed policy, a default, an overlooked integration, or a bug. Interviews and configuration review are needed to distinguish those explanations.
Compare regional collection policies before assuming the same behavior applies to every visitor.
For a tracker-specific rate, count eligible independent sites where that tracker was detected. Disclose how detection works, where it can miss tools, and how incomplete runs are handled. Don't divide by every scanned page or count repeated retests as additional sites.
Use the result for a specific investigation
Give the implementation owner the declared rule, the saved choice, and the observed event. Ask whether the event is intended, what evidence supports the claimed exemption, and whether the chosen configuration limits the tool to that purpose.
CookieTrail saves regional first-load, accept, and reject evidence for one public URL. Its bounded request capture excludes payloads and does not establish an exemption, business intent, or server-side use. Declarations, selective choices, and debugger inspection need additional evidence.