If you run Google Ads or Meta campaigns, the cookie banner on your website quietly decides how much of your results you can actually see. Every visitor who declines tracking is a visitor whose enquiry may never show up in your ad platform. So when the ICO updates its guidance on cookies and tracking, it matters to your measurement as much as to your compliance.
A clear note before we start: we’re paid media specialists, not lawyers, and this isn’t legal advice. Whether your own setup is compliant is a question for your legal adviser. What we can help with is what consent rules mean for your tracking data, and how to keep your reporting honest and useful within whatever setup you have.
What the ICO published, and what it didn’t change
On 29 April 2026 the ICO published its finalised guidance on storage and access technologies. It covers how the Privacy and Electronic Communications Regulations (PECR) and, where relevant, UK GDPR apply to cookies, tracking pixels, device fingerprinting and similar technologies. In other words, it isn’t only about cookies. The pixels and tags most ad accounts rely on are in scope too.
The ICO describes the guidance as reflecting the law as it currently stands. It adds examples and clarification, and it incorporates changes made by the Data (Use and Access) Act 2025, but it isn’t a relaxation of the rules for advertising.
That question is being handled separately. On 18 May 2026 the ICO published advice to government suggesting that some lower-risk advertising activity could be allowed without consent in future, while tracking and profiling people across sites would still need it. That’s a recommendation, not a change in the law. Nothing has changed yet, and there’s no date for when or whether it will.
For anyone running ads, the practical point is simple. The current consent rules for advertising tags still apply, and the ICO has made clearer where it thinks the line sits. If you want to read the detail, the full guidance is on the ICO website, and your legal adviser is the right person to apply it to your site.
What consent does to your ad data
Here’s the part that sits squarely in our world. When a consent banner works as intended, some of your visitors will say no to advertising and analytics tracking. That has knock-on effects that many businesses never connect back to the banner.
Your ad platforms see fewer conversions. If someone declines tracking and then fills in your form, Google Ads or Meta may never record that enquiry. The lead is real. Your dashboard just doesn’t know about it.
Smart bidding learns from less. Automated bidding works from the conversions it can see. Fewer recorded conversions means a thinner signal, which can make bidding slower to settle and less confident.
Retargeting audiences shrink. People who decline advertising cookies can’t be added to most retargeting lists, so those audiences will be smaller than your traffic suggests.
Some numbers are estimates. Google can model some of the conversions it can’t observe directly. That fills part of the gap, but it means the figure in your account is partly an estimate rather than a count.
None of this means your campaigns are failing. It means the platform’s view is incomplete, and you need another source of truth.
Why your Google Ads, Meta and CRM numbers won’t match
If your ad platform says 25 conversions and your CRM shows 40 enquiries from paid traffic, that gap is normal. Consent choices, ad blockers, people switching devices and modelled conversions all pull the figures apart.
The mistake is treating the platform number as the truth. We see businesses cut budgets on campaigns that were producing real enquiries, simply because those enquiries weren’t being recorded in the ad account. The reverse happens too, when modelled conversions make a campaign look better than it is.
Keeping your measurement useful
Within whatever consent setup your adviser signs off, a few habits keep your reporting honest.
Make your CRM the reference point. Every enquiry that reaches you lands in your CRM, whether or not a pixel fired. Record the source on each lead, then judge campaigns on what the CRM shows, not only on what the ad platform reports.
Measure outcomes, not just form fills. Booked calls, quotes issued and jobs won are the numbers that matter. Tracking them in your CRM gives you a view of performance that doesn’t depend on a tag firing on the website.
Compare trends, not totals. The platform’s absolute numbers will always be incomplete. Month-on-month and year-on-year direction is far more reliable than any single figure.
Know how your tags respond to consent. Google’s Consent Mode changes how Google tags behave depending on what the visitor has chosen. Ask your web developer whether it’s set up on your site, and how, so you know what your reports are and aren’t counting.
Reconcile monthly. Put the ad platform figures next to your CRM figures once a month. If the gap suddenly widens or narrows, something has changed in your tracking and it’s worth finding out what.
Questions to take to your developer and legal adviser
You don’t need to become a compliance expert. You do need to know enough to ask the right people the right questions.
For your web developer:
- Which tags, pixels and scripts load on our site, and do any of them fire before a visitor has made a choice on the banner?
- Is Google Consent Mode set up, and in which mode?
- Are there any tracking codes hard-coded into the site outside Google Tag Manager?
- What happens to our conversion tracking when someone declines?
For your legal adviser:
- Does our cookie banner and tagging setup meet the ICO’s current guidance?
- Which of our tags, if any, can run without consent?
- Do we have the right basis to upload customer data to Google or Meta as offline conversions?
- What should we be keeping as a record of consent?
Take the answers back to whoever runs your ads, so the campaigns and the reporting reflect how your site actually works.
What might change next
The ICO’s May 2026 advice suggests that some lower-risk advertising activity, such as measurement carried out by the business a visitor is dealing with directly, could one day be allowed without consent. If the government acts on it, the gaps in your conversion data could narrow.
But it hasn’t happened, and it may not. Plan your measurement around how things work today, and treat any future easing as a bonus.
The short version
Consent rules aren’t going away, and they shape what your ad platforms can see. The businesses that report well under these conditions don’t fight the gaps. They build their reporting around the CRM, track real outcomes, and compare trends rather than chasing a perfect number.
Get your legal adviser to confirm your setup is right. Then, if you want your reporting to reflect what your ad spend is really producing, we can help you build Google Ads tracking and CRM reporting that works with consent rather than around it.
