Consent banners didn't increase privacy — they increased data blindness!
Consent banners were sold as a victory for privacy. Users were promised control, businesses were promised “clean” legal analytics. In reality, the market got something else: blind spots in data, degradation of product solutions, and the illusion of compliance.
The illusion of control instead of real privacy!
Consent banners are not about privacy. They are about legal shifting of responsibility.
The user sees a modal window, clicks Accept or Reject — often automatically, without reading.
At this point:
- the user does not understand what data is being collected and why;
- the company does not explain the value of data collection;
- the regulator receives a formal checkbox.
The control is illusory. The behavior is reflexive. Privacy is not enhanced, just a new UI barrier appears.
The real effect: analytics has become incomplete!
Facts:
- 20-60% of users in the EU do not consent to tracking.
- GA4, Meta, Google Ads, and A/B platforms are starting to work on a sample basis.
- Product and marketing decisions are made based on distorted data.
What this means for business:
- Conversions are “falling” — but not because the product is worse.
- Channels are “not working” — because part of the traffic has disappeared.
- A/B tests are statistically incorrect.
- LTV and CAC are guesswork, not metrics.
This is not privacy-first. This is decision-making-last.
Privacy ≠ lack of data
The key mistake of the market is to equate privacy with zero data.
In reality:
- privacy = minimization and anonymity
- analytics = aggregation and context
- tracking ≠ surveillance
It is possible to:
- not use cookies.
- not identify users.
- not build profiles.
- not store personal data.
... and still understand:
- how many people came.
- what they did.
- where the product breaks.
- which pages work.
Consent banners killed this layer — safe, aggregated analytics.
Who benefits from data blindness?
Paradoxically, it is not users who benefit the most.
The winners are:
- large platforms with first-party data
- ecosystems with logins and accounts
- walled gardens (Google, Meta, Apple)
The losers are:
- independent SaaS
- startups
- content projects
- the open web
Small and medium-sized businesses are left without data, while big tech has the same capabilities, just packaged differently.
Banners do not solve the key problem!
The real problem is uncontrolled user-level tracking, not analytics.
Consent banners:
- Do not limit the amount of data
- Do not check its use
- Do not prevent abuse
- Do not increase transparency post-factum
The market is already moving away from consent-dependent analytics.
Trends:
- cookie-less tracking
- server-side aggregation
- event-based metrics without user IDs
- privacy-by-design tools
- moving away from “knowing everything about the user” → “understanding the system”
Regulators understand this too. The next step is not new banners, but requirements for data collection architecture, not buttons.
!!!Conclusion!!!
Consent banners:
- did not increase privacy
- did not provide real control
- reduced data quality
- impacted product solutions
- widened the gap between big tech and the rest of the market
The future lies in analytics that:
- does not require consent because it does not violate privacy
- does not identify people
- gives businesses a signal, not an illusion of accuracy
- works all the time, not “if the user has given permission”
This is not a compromise.
It is simply a more mature level of thinking.
I'm more in agreement than I would like to admit. ~
Users were not made more informed by consent banners, just trained to get through it faster.
It happened to me when analytics began to look “cleaner” but less informative. Less signals. Extra guesswork.
For me, the shift was the realization that privacy is not about asking permission, it’s about collecting less by design.
I wonder about your thoughts on accuracy versus restraint. How far can you go?
How far we have come with our analytics:
1) Aggregated analytics (Trends, vectors, correlations work without personal tails. 80% of value — without user-level tracking.)
2) For us and our clients, observability is more important than attribution (the product needs to understand what is happening, not who did it).
3) For us, accuracy ends where data is no longer necessary for decision-making. If a metric does not affect the product, growth, or decision-making, it is an unnecessary risk. And you need to understand that!
Many analytics sites calculate the average time customers spent on the site, BUT if it is calculated from user sessions with an identifier, the user is tracked first, then the average is calculated → the metric is aggregated, but the collection is personal.
Lawyers and regulators look at the process, not the dashboard.
That's why we settled on what you can see on our website!
Thank you for your question!
This is a strong articulation of something a lot of teams feel but struggle to explain internally. We’ve seen the same effect in practice — consent banners didn’t just reduce tracking, they quietly changed what decisions felt “data-backed”.
What stood out to me in the comments is the tension between “privacy as zero data” and “privacy as minimization + aggregation.” When teams lose that distinction, they either overreact by flying blind or double down on questionable workarounds. Neither feels healthy.
In our case, moving toward aggregated, event-level signals (without user identity) brought back confidence in decisions without crossing privacy lines. It didn’t give perfect answers — but it gave honest ones.
Curious how you see regulators evolving here: do you expect clearer guidance on data architecture itself, not just consent mechanics?
This has already begun, but regulators are moving slowly.
Regulators will:
Require provable data minimisation architecture:
• what is collected;
• where it is stored;
• why;
• how it is isolated.
Look at data flows, not UI
• server-side tracking;
• event pipelines;
• third-party leakage.
What matters to regulators is not "what you promise," but what is physically impossible to match.
This makes a lot of sense — especially the idea that regulators will focus on what’s structurally impossible rather than what’s promised at the UI layer.
Looking at data flows instead of banners feels like the right abstraction: once minimization and isolation are baked into the architecture, consent becomes less of a frontline defense and more of a safeguard.
Appreciate you laying this out so clearly — it’s a useful framing for teams trying to navigate privacy without defaulting to either blindness or overreach.
I think overall GDPR has been a positive, especially with data management and control. However cookie consent (which pre-date GDPR) and my impact on analytics is the single worst part of the legislation. The truth is one users opt out they are still being tracked as the banners are not always linked to how the cookies fire. (Fixing this is actually a good source of revenue for my business).
I really like this privacy by design approach and I completely agree. Company owners should be able to track users anonymously to learn about what's working and what's not just as you would in a bricks and mortar location.
I completely agree with you!
The irony kills me: GDPR was supposed to limit Big Tech, but it widened their moat
They have first-party login data on billions. A 10-person SaaS has consent banners that 40% of visitors reject.
We stopped using GA4 last year. The data was so incomplete it was worse than useless -- it gave false confidence. Now we use server-side events and accept that we'll never know exact numbers. Paradoxically, we make better decisions.
Server-side tracking increased complexity, not clarity!
Server-side tagging was sold as the fix:
- Better control.
- More privacy.
- More accurate data.
- What actually happened:
- Higher costs.
- More moving parts.
- More legal ambiguity.
- Same consent dependency for analytics.
Tools like Checkanalytic.com exist to answer simple questions reliably:
- How many people visited?
- Which pages matter?
- Are conversions happening at all?
No cookies.
No consent dependency.
No user profiles.
This comment was deleted 8 months ago