Ads for Breakfast
← All posts

GDPR and conversion tracking: why the panic is overdone — Camp Nerd 2024

My talk at Camp Nerd 2024: why GDPR panic does companies more damage than the regulation itself — and how clean, compliant tracking still works.

8 min read

Originally written in German — read it on visnakovs.de.

Talk on GDPR and conversion tracking at Camp Nerd

At Camp Nerd 2024 I gave a talk under a deliberately provocative title: “DSGVO ist ein riesen Scam” — GDPR is a giant scam. I mean the argument behind it seriously.

Watch the recording: DSGVO ist ein riesen Scam — Conversion Tracking in Marketingkanälen, Camp Nerd 2024. (The recording is in German.)

The argument: GDPR panic does more harm than it prevents

To be clear: GDPR is an important law and data protection matters. But what happens in practice often has very little to do with what the regulation was actually for.

What I see at companies every day:

  • Tracking switched off entirely — out of fear of legal warnings
  • Marketing budgets spent blind — with no data showing what works
  • Consent banners implemented wrongly — blocking more than they need to
  • Google Ads avoided altogether — because “GDPR and Google don’t go together”

The result: companies lose money. Not because GDPR demands it, but because it’s being implemented wrongly.

What’s actually allowed

Server-side tracking

Server-side tracking through Google Tag Manager can be run in a GDPR-compliant way:

  • Data is routed through your own server rather than straight to Google
  • You control exactly which data gets forwarded
  • IP anonymisation happens on your server, before data reaches Google
  • No third-party cookies required

Google Consent Mode v2 has been mandatory for Google Ads advertisers in the EU since March 2024. Very few people understand what it actually does:

  • Granted mode: full data collection after explicit consent
  • Advanced mode: cookieless pings allow conversion modelling even without consent — fully compliant
  • Basic mode: no data at all before consent — compliant, but you lose 40–70% of your conversion data

Enhanced conversions

First-party data (email, phone) is hashed (SHA-256) and passed to Google:

  • The user entered the data themselves (form, order)
  • The data only leaves your server as a hash
  • Google can match the hash against signed-in users — without setting new cookies

The most common GDPR mistakes in marketing

Plenty of CMP setups are configured so that no tag fires even after consent. Result: 0% conversion data, despite the user having agreed.

2. Analytics and Ads get treated as the same thing

Google Analytics and Google Ads rest on different legal bases. GA4 needs consent (analytics). Google Ads conversion tracking can, under certain circumstances, rest on legitimate interest.

3. “Let’s switch everything off, just to be safe”

The most common mistake of the lot. A company then burns €5,000 a month on ads without knowing whether they work. That isn’t “safe”, it’s negligent.

The other extreme: banners that make “Accept” big and green and hide “Reject”. Neither compliant nor trustworthy.

The pragmatic path

  1. Set up server-side GTM — control over the data flow
  2. Consent Mode v2 in advanced mode — maximum data at maximum compliance
  3. Turn on enhanced conversions — put first-party data to work
  4. Configure the CMP properly — not blocking too much, not too little
  5. Document it — keep the record of processing activities current

Two free tools if you want to start yourself

Key take-aways

  • GDPR ≠ no tracking. Clean tracking is possible and compliant.
  • Server-side is the standard. Track client-side only and you lose data and risk problems.
  • Use Consent Mode v2. Advanced mode gives you conversion data even without explicit consent.
  • Pragmatism beats panic. A well-thought-through setup protects users and your business.

Want to get tracking and GDPR set up properly? Write to me at visnakovs@clickspire.de.