GDPR, ePrivacy and consent management

Because the tool carries out a decision it does not make for you.

A consent management platform can display a banner, store a choice and pass it on to your tools. What remains to be decided is the purposes you declare, the vendors you keep, the behaviour each tag receives, and what all of that produces for your measurement.

We are the trusted third party between you and the vendor: we work those decisions through with your teams, we configure the tool, and we check on the ground that the result matches what was decided.

Three parties, and each holds a piece the other two do not have.

• Legal, or your DPO: purposes, legal bases, retention periods, documentation of the setup.
• IT: technical integration, script loading order, page performance, application environments.
• Business and acquisition: what the setup changes for measurement, attribution and campaign steering.

Our role is to hold the three together, in language each of them understands, and to surface the trade-offs rather than settle them on our own.

On your context, not on a ranking.

The criteria that really make a difference: the scope to cover (website, mobile apps, connected TV), integrations with your existing stack, handling of multiple domains or brands, TCF support if you run programmatic advertising, Google certification if you rely on its tools, and how easily your teams can run it day to day.

We work across every platform on the market, OneTrust, Axeptio, Commanders Act, Usercentrics, Cookiebot or Didomi, where we are a Gold partner. The choice is made on your side.

It is the mechanism that passes your visitor's choice on to Google tools, rather than simply blocking tags.

It comes in two modes. Basic holds tags back until consent is given. Advanced sends a signal without identifiers when a user refuses, which lets Google model part of the conversions it cannot observe.

What it changes depends on your volume, your consent rate and how your tags are sequenced. That is why we measure the effect on your own account rather than quoting an average gain.

Almost always because the tools are not counting the same thing, at the same moment.

• Sequencing: some tags fire before the consent signal is available. They count visits the others ignore, and the gap then shows up in attribution.
• Scope: a CMP counts banner displays, an analytics tool counts sessions, an advertising platform counts events. Three different denominators.
• Exemptions: measurement configured to run without consent sees a population the other tools never see.

Diagnosing those gaps is a large part of the work, and it is often where we start.

It changes in nature: it becomes aggregate or modelled instead of individual.

Several levers combine depending on the case: the conversion modelling offered by the platforms, an analytics solution configured to run without consent, and measurement methods that do not rely on identification, such as incrementality tests or contribution models.

What matters is knowing what each figure covers before steering with it, and saying so to the teams who use it.

Three frameworks that overlap on the same subject.

• The GDPR is the European regulation on the processing of personal data. It sets the principles: purposes, legal bases, rights of individuals.
• The ePrivacy Directive, transposed into French law, governs access to information stored on a user's device. That is what covers cookies and other trackers.
• The CNIL is the French authority. It publishes guidelines and a recommendation on trackers, which set out its operational reading of those texts.

This framework moves, and so does its interpretation. Our job is to keep your setup current on the technical and marketing side, with your DPO or your counsel on the legal reading.

It changes what you control, not the rule that applies.

Consent remains the condition for firing, and a tag server placed between your site and your partners does not replace it. What it brings is elsewhere: you see and decide what reaches each recipient, you filter out unnecessary data before sending, and you lighten what runs in the browser.

It is a governance gain, and it calls for even more rigour on carrying the consent signal all the way to the server.