Privacy and Compliance

Not maintained since 2026-10-06. Privacy is outside the guide for now.

You’ve built a governed taxonomy. Your values are consistent, your links are tagged, your reports are clean. Then you check your consent rate and find that 40% of your campaign traffic was never recorded, because those visitors declined cookies before your analytics could load. This scene is a composite of teams we’ve worked with, at a consent rate of 60%.

Nothing in your taxonomy is broken. The ground moved underneath it.

The question people bring here is “why is so much traffic missing?” The answer is mostly not about tagging at all. UTM parameters don’t identify anyone. The systems that process them (analytics platforms, cookies, CRMs) sit inside privacy law, and browsers restrict tracking on their own terms. In the introduction’s terms, this is the envelope lost on the way: the letter was written correctly, and the visit never got recorded. This page sorts measurement into the parts that erode and the parts that hold.

What the law changes about tagging

Two frameworks come up again and again. The EU’s GDPR applies to anyone processing EU residents’ data, wherever the company sits: it requires a lawful basis for processing personal data, consent for non-essential tracking, and rights for people to see, correct and delete their data. California’s CCPA, as amended by the CPRA, gives residents the right to know what’s collected, to opt out of its sale or sharing, and to have it deleted.

A UTM value on its own (utm_source=linkedin, utm_campaign=spring_sale) isn’t personal data. Combined with an IP address, a device fingerprint, a cookie or a CRM record that identifies someone, it becomes part of a dataset those laws cover. Four things follow for anyone who tags links:

If analytics uses cookies to tie UTM values to a session, GDPR requires consent before the cookie is set; CCPA requires a clear way to opt out.
Keep personal data out of UTM values entirely: no email addresses, user IDs or account numbers.
UTM-enriched data in your warehouse or CRM needs a retention period and a deletion process.
If EU users’ data flows into US-based analytics or CRM platforms, you need a transfer mechanism such as Standard Contractual Clauses.

We’re not lawyers, and neither is your analytics vendor. But one design rule keeps you out of most trouble: a UTM never needs to carry personal data. If yours do, that’s an architecture problem, not a compliance question. A naming guide can state that rule. A builder that checks values before a link exists can reject an email address outright, so a personal value never reaches analytics or server logs in the first place.

Analytics platforms use cookies to tie a visitor’s arrival (with its UTM values) to what they do next. Consent requirements cut that chain.

Under strict GDPR practice, analytics scripts shouldn’t run until the visitor agrees. Someone who arrives on a perfectly tagged link and declines may never be recorded at all, so campaign traffic is undercounted, systematically. Typical consent rates run from 40% to 85%, depending on geography, banner design and audience. So every campaign number is a floor: the visits that declined aren’t in it, and nothing in the report says how many there were.

Two mitigations come up. Server-side capture can read the UTM values on the first page request and attach them to the analytics session only once consent is granted. And some analytics tools model the missing traffic to fill part of the gap.

Browsers restrict on their own schedule

Legislation is half of it. Browser vendors also restrict tracking for every visitor, consenting or not, and change the rules on their own schedule. This page no longer tracks the specifics.

The effect on campaign data is the same whatever the browser. When an analytics cookie is gone before the visitor comes back, the return visit shows up as a new, unattributed session. Attribution windows shrink, returning visitors stop being recognized, and the multi-touch models in Chapter 11, which depend on recognizing one person across visits, get less reliable.

What erodes and what holds

	Erodes	Holds
Anything that waits for consent	not recorded when the visitor declines
Analytics cookies	a browser may expire or block them
UTM parameters		travel in the URL, store nothing that can expire
Server-side capture	still needs consent to process personal data	runs on your server, out of the browser’s reach
First-party data (logins, forms)		consent-based, stored in your own systems

UTMs age better than cookies

UTM parameters travel with the URL, not with the browser’s memory. Nothing is stored, so nothing can expire. A tagged link carries its campaign data to your server in the request itself.

Much of the machinery around it erodes. The UTM rides in the URL, in plain sight, which is why governing it keeps its value while the rest of the tracking stack changes.

Server-side tracking

Server-side tracking moves collection from the visitor’s browser to your own infrastructure. Instead of a script reading UTM values and setting cookies, your web server reads them from the incoming request and forwards them to analytics with a server-to-server call.

The gains: ad blockers and script blockers in the browser don’t see it, because the UTMs arrive with the page request itself; you control exactly what’s collected and sent; and you can strip or anonymize data before it reaches a third party. The costs: engineering time, more infrastructure, and the same consent obligations as before. Moving the collection point doesn’t move the law.

First-party data

Data people give you directly, knowingly and with consent, is the firmest ground for measurement. Logged-in visitors can be recognized across sessions and devices without cookies. UTM values captured at form submission or account creation and stored on the CRM record (Chapter 7) give you a durable, consent-based link between campaign and customer. And the ad platforms’ conversion APIs send your first-party conversion data back to them server-side, without relying on browser pixels.

The options

The moves teams make here:

an audit of every place UTM values are captured, stored or processed, marking which steps involve cookies, personal data or third parties
a record of processing activities that includes the UTM and analytics data flows
a consent management platform in front of the analytics and the tag manager, blocking non-essential tags until consent
measurement that tolerates gaps: modeled conversions, mix modeling and incrementality tests (Chapter 11)
server-side capture for the measurement that matters most, such as conversion tracking and the CRM feed