The Conversion Data You Trust Is Broken: a heads-up for marketers

‍

For years, marketers have been preparing themselves for a so-called “cookieless future”, as if it was inevitable. New strategies came to life, audience targeting was redefined, and reporting systems were rebuilt, providing new dashboards… but then, Google pulled the ultimate reverse card and decided not to fully phase out third-party cookies after all.

How does it leave us?! Well, dealing with an even more uncertain landscape.

‍

GDPR and Google’s third-party cookies: where privacy meets boundaries

‍

Let’s be honest: when Google announced in April 2025 that it would not be killing third-party cookies in Chrome after all, many performance marketing teams quietly closed their contingency planning documents and got back to business as usual (understandable, we can all agree). And, we all might agree that, after five years of delayed deadlines and escalating preparation costs, this plot twist felt like permission to exhale… but, well, it definitely is not.

Even if on the surface, it feels like a stay of execution, if you look a little closer, it is merely a mirage. The reality is that the fundamental rules of marketing measurement have already changed, and no single browser update (whether delayed, scrapped, or altered) is going to put the old tracking genie back in the bottle. Mainly because this is not just about Google and its cookies for a long time. There are two major forces colliding: the European regulatory hammer of the General Data Protection Regulation (GDPR) - and yes! - Google’s much-publicised cookie U-turn. These two, combined, are forcing a paradigm shift and making it impossible for marketers to ignore for too long.

‍

‍

So instead of removing third-party cookies entirely, Google shifted towards a user-choice mode, which gives users the option to allow or block cross-site tracking.

But across Europe, that question had already been answered with GDPR, which had long established the rules, making user consent a requirement rather than a feature, which is something that fundamentally shapes how tracking works across much of Google’s audience.

Consider European and UK consumers, who had been clicking "decline" on cookie banners for years before Chrome's prompt even existed. GDPR did not just create a legal compliance requirement, it created a population of users who had been conditioned, banner by banner, to withhold consent as a default behaviour. By the time Google served its own opt-in prompt, it was just pushing against a wall of learned refusal that the regulation had spent years building.

Apple’s App Tracking Transparency rollout in 2021 showed precisely how this plays out and made one thing very clear: when people are directly asked whether they want to be tracked across apps and websites, most of them simply say “no, thank you, but no!”

Not because they’ve carefully read every privacy policy (god forbid that), but because, when the question is put plainly, the answer feels quite obvious.

Google’s move towards user-controlled tracking runs into that same psychology. By the time Chrome introduced similar prompts, the mindset had already shifted. Again, GDPR did the cultural work prior to and didn’t just set legal boundaries; it shaped user expectations.

So while Google may have kept third-party cookies alive on paper, in practice, many users are choosing to opt out, making them far less effective than they once were.

The result is a measurement environment that is arguably more confusing than a clean break would have been. Third-party cookies technically exist, but their reach is structurally compromised by GDPR consent refusals across the Europe and UK (which by the way has it the Information Commissioner's Office - ICO - that is the UK’s independent regulatory authority responsible for upholding information rights and enforcing data privacy laws, as the UK General Data Protection Regulation - GDPR), by Safari's long-standing tracking prevention, by Firefox's default blocking, and now by Chrome's own opt-out mechanism.

So, for marketers whose optimisation logic depends on complete conversion visibility, this fragmented landscape is not a theoretical future problem, but instead the operating reality today.

If by now, as a marketer in charge of return on ad spend, you have probably noticed a disturbing trend over the past year: your reporting is lying to you. Cost per acquisition might be fluctuating without explanation, conversion paths are fragmenting, and the dashboards you use to justify your budget look like a Swiss cheese with increasingly and massively unexplained holes.

Right now, we are in the midst of a performance marketing crisis. Yes, performance marketing is going through a quiet but significant reset. The systems we’ve relied on for years, that allowed us to track, target, and attribute with and attributing results with near-perfect precision, are starting to break down.

And, at the same time, the pressure to demonstrate clear, bottom-line Return on Investment (ROI) hasn’t gone anywhere. If anything, it has been intensified.

That leaves marketers in a difficult position as they are expected to deliver certainty while working with less and less visibility.

So the real question becomes: how do you measure what works when you can no longer see the full picture?

‍

How marketers should rethink measurement in a privacy-first world

‍

‍

For a long time, everything revolved around the click. Measurement frameworks were built on the idea that you could follow a user’s journey from the first interaction to the final conversion, capturing every step along the way. While this was never a perfect science or flawless, it felt precise enough to be trusted.

Then the landscape shifted. Privacy regulations tightened, user expectations changed, and the technology that enabled that level of tracking began to crumble.

As said before, Google reversed course on full cookie deprecation in Chrome, now allowing users to choose either to opt in or opt out of cross-site tracking. And if at first this sounded ok for marketers, then came the daunting realisation. A user-choice model does not preserve the measurement environment that marketing depends on; it fractures it.

Between a more rigorous implementation of the GDPR, limitations on third-party cookies, and reduced visibility across platforms and devices, the traditional attribution model has consistently become less relevant. What’s left is a more complex reality: much of the “precision” marketers once relied on was always partly inferred.

The result is an environment where third-party cookies nominally exist but are increasingly unreliable as a universal measurement substrate. For marketers whose entire optimisation logic depends on seeing which clicks convert, which audiences retarget efficiently, and which channels are genuinely driving revenue, this is a fundamental problem.

Readjusting to this new environment isn’t about finding a replacement for what’s been lost, but to rethink how we use data, how we evaluate performance, and how much certainty we can realistically expect.

In a privacy-first world, measurement becomes less about tracking everything and more about understanding what truly drives impact.

‍

The GDPR effect… and why regulation is not the enemy

‍

‍

Let’s rewind, because to understand where we are today, it helps to look back.

Long before Google began rethinking cookies in Chrome, GDPR had already reshaped the digital landscape. When it came into force, it didn’t just introduce stricter rules or larger penalties; it changed how people think about their data.

For the first time, users were clearly told: your data belongs to you, and you have a say in how it’s used.

That shift had a ripple effect. Suddenly, tracking was no longer invisible as cookie banners became part of the everyday browsing experience, and with them came a new level of awareness. People started to recognise the exchange happening behind the scenes, and many started opting out.

What followed wasn’t just a legal change, but a behavioural one, where privacy became an expectation, and not a feature. For marketers, this introduced real data collection limitations and, more importantly, it challenged long-standing assumptions, such as the idea that users would accept widespread tracking by default, which no longer holds true.

So, while it’s easy (and tempting!) to view regulations like GDPR or ePrivacy as barriers and/or limits imposed by policymakers who don’t fully understand digital marketing, in fact, that perspective misses the point.

These rules didn’t appear out of the blue. They are a response to years of obscure data practices, where users were tracked in ways they didn’t fully understand or explicitly agree to. So, if we think about it, in many ways, regulation was inevitable.

Furthermore, what’s really interesting is what happens when businesses stop treating compliance as a checkbox and start treating it as a strategic input. Because when you can’t rely on unrestricted tracking, you’re forced to think differently and ask fundamental and better questions: who are we really trying to reach? What matters to them? How do we measure success in a way that reflects reality, not just what’s easy to track? Those questions - in the end - tend to lead to a stronger and more focused marketing strategy.

There’s also a clear commercial upside. Trust in how companies handle data has fallen over time, and consumers are becoming more selective about who they engage with, typically choosing brands that are transparent and respectful about data usage, leading to these brands seeing the benefits in both loyalty and long-term value.

Handled properly, privacy isn’t a limitation, but by contrast, it’s a symbol of quality and, increasingly, a competitive advantage.

‍

The perfect attribution or the convenient illusion?

‍

For years, last-click attribution gave marketers a comforting sense of clarity. It told a simple story: the final interaction before a purchase was the one that mattered most. The funny fact: it was always a lie told for convenience and that simplicity came at a cost.

It awarded all the credit to the final touchpoint before a purchase, ignoring the full customer journey. Our traditional marketing attribution models were built on the assumption of perfect visibility. But it overlooked everything that happened beforehand (the awareness, the consideration, the repeated exposure that actually nudged someone towards a decision). In reality, customer journeys have never been linear. They’re messy, stretched across multiple channels, devices, and moments of intent. It was the technology behind it that made attribution feel accurate: those third-party cookies allowed marketers to connect those scattered interactions and build a seemingly complete picture.

As tracking becomes more restricted, the links between touchpoints are disappearing. Without that invisible thread tying it all together, our dashboards are fracturing. The data is becoming sparse, leading to what industry analysts call "dark marketing”, where a significant chunk of your upper-funnel influence goes completely uncredited (the influence you know is there, but can no longer fully see or measure).

Multi-touch attribution tried to solve this by spreading credit across multiple interactions, but it relied on the same assumption (that you could still follow the full journey), which no longer holds.

Today, even well-resourced marketing teams are feeling the impact of it, because the conversions you can track are often only a percentage of the total.

Signal loss is now part of the equation, whether it’s users declining consent, browsers limiting tracking, or devices operating in closed environments; large chunks of data are simply unavailable. A user might engage with your brand multiple times, reject tracking, and return later to convert, leaving little to no trace in your reports.

The natural reaction is to try to fix the gaps with better technology. So, server-side tracking, enhanced conversions, and first-party data strategies come to play, and while all help (and they’re worth investing in), the more effective approach is a mindset shift. Instead of chasing complete certainty, marketers need to work with partial data, learning to interpret patterns, test assumptions, and draw meaningful conclusions without seeing every step.

Because, in the end, the goal hasn’t changed, and you still need to understand what drives performance; now you just have to do it without the illusion of perfect attribution.

‍

‍

The smarter measurement stack for a privacy-first world: the only way to go

Remember this: there isn’t a single tool that can fix today’s measurement challenges. No platform, no workaround, no quick patch. But there’s a way to go, and it basically is a combination of approaches, where each one fills in a different part of the picture.

‍

‍

Meaning:

‍

1. Server-side tracking and conversion APIs 

Traditionally, tracking relied on browser-based pixels (such as Meta Pixel, GA4 tags, Google Ads tags) firing directly from the user’s browser at the moment of purchase. But then ad blockers, cookie refusals, Safari's tracking prevention, and consent choices came to play, and problems arose. All of these privacy mechanisms basically interrupt those signals, creating incomplete reporting and attribution gaps.

Server-side tracking helps marketers recover some of the signal that gets lost when browser-based tracking is blocked, limited, or interrupted.

This means that, instead of relying only on the user’s browser to fire tags, the data is sent via your own server, which can improve accuracy, resilience, and control while still being built around consent and GDPR requirements.

To show how this can work, let’s consider an eCommerce brand that sends purchase events from its backend to Meta Conversions API and Google Ads enhanced conversions. If a user buys after clicking an ad, but the browser pixel fails to fire, the backend event still records the sale and gives the platform a better signal for optimisation.

The same happens, for instance, with a lead-gen business that passes form submissions from the CRM into the ad platform so campaigns can be optimised against qualified leads rather than just visible on-site form completions.

Both Google's Enhanced Conversions and Meta's Conversions API (CAPI) operate this way. When a customer completes a purchase and provides their email, that email is hashed server-side and transmitted to the platform. The platform matches it against its own user graph and credits the conversions, without needing any third-party cookies.

According to data from Weld.app “companies relying only on client-side tracking see just 50-65% of conversions inside Meta Ads Manager. After implementing CAPI (Conversions API from Meta, also known as Facebook Conversion API or "CAPI"), that number jumps to 95%+, resulting in significantly better campaign targeting, more accurate attribution, and lower cost per conversion”.

Among the most used conversion APIs used today, you’ll find: 

• Meta Conversions API (CAPI)
• Google Enhanced Conversions
• TikTok Events API
• Pinterest Conversion API

‍

‍

2. Consent mode and similar modelling techniques 

Consent banners create a new challenge for advertisers. If users reject tracking, traditional analytics lose visibility entirely, and, in some industries, opt-out rates can significantly reduce observable data.

When a user clicks "decline" on your cookie banner, most measurement systems simply go dark. Consent Mode is designed to stop that from happening. Rather than overriding the user's choice and forcing tracking, it respects it by working around the absence of data in a way that keeps your campaigns functional.

The mechanics are straightforward enough. Rather than cutting off the signal entirely, Consent Mode registers that consent was withheld and uses aggregated, anonymised behavioural patterns from consented users to model what likely happened next. It is an educated inference, not a workaround. The user's preference is respected; the platform just does not pretend the rest of the world stopped converting because one person opted out.

Google's Consent Mode v2 sharpened this considerably. Where the original version handled basic consent signals, v2 introduced two new parameters (ad_user_data and ad_personalization), giving marketers more control over what gets passed to Google and under what conditions. In markets where GDPR consent rates are structurally low, as they are across much of the UK and EU, this distinction matters. 

A well-configured Consent Mode v2 setup means Smart Bidding still has something meaningful to optimise against, even in an environment where a large share of your audience has opted out of direct tracking.

A practical example would be a travel company running Google Ads in the UK and EEA, where a large share of visitors reject cookies on the banner. Consent Mode allows Google to model some conversions that would otherwise be excluded from the reports, helping preserve bidding performance and conversion optimisation. Google has published a TUI case study showing a 7% increase in conversions after implementing Consent Mode, which is a strong proof point to reference in the article.

Basically, consent modelling estimates likely behaviour from aggregated patterns so advertisers retain directional visibility into campaign performance.

This is especially useful for:

• Lead generation
• Subscription businesses
• Cross-device journeys
• High-consideration purchases

Here are some recommended consent platforms:

• Usercentrics
• Didomi
• CookieYes
• CookieBot

The limitation of this is that modelled conversions are not the same as observed ones. A ROAS (return on ad spend) figure that blends both without distinguishing between them is not a reliable basis for confident budget decisions. Plus, Consent Mode only works when it is properly implemented (meaning consent signals are being passed accurately and Google tags are not loading before consent is granted). 

‍

3. Incrementality testing ads 

Incrementality basically leads the way to understand what’s genuinely driving results, not just what’s being tracked. It tries to answer the question that attribution models cannot: would these conversions have happened without this campaign? 

Incrementality testing takes a different approach from traditional attribution. Instead of tracing a user's journey across touchpoints, it compares results at the group level: an audience exposed to the campaign versus a similar holdout group that wasn’t. That makes it far more useful when privacy rules, consent choices, and platform limits leave attribution data incomplete.

A simple example is a retail brand running paid social across two similar regions. One region sees the campaign, the other doesn’t. If sales rise only in the exposed region, the campaign is likely creating real incremental value. If both regions perform about the same, the ads may not be driving much extra demand.

The same logic applies to a brand running remarketing. Incrementality testing can show whether those ads are actually generating additional conversions or simply picking up people who were already close to buying.

If you’re looking for incrementality tools, Meta's open-source GeoLift library (available in R) and Google's geo experiment framework are both accessible starting points. Other commercial platforms, such as Northbeam, Measured, and Haus, offer more automated test design and statistical validation.

‍

4.  Marketing mix modelling (MMM) 

Marketing Mix Modelling is experiencing a major revival because it works without individual tracking. 

It basically provides a view of performance across channels using aggregated data, without relying on individual user tracking at all.

Rather than following users, MMM estimates the revenue contribution of different marketing channels based on aggregated, population-level data (spend by channel, market conditions, seasonality, economic factors), without requiring any individual-level tracking at all. It is entirely immune to the signal loss created by consent opt-outs, cookie blocking, and browser restrictions, because it never depended on any of those mechanisms in the first place.

This makes it especially valuable in a privacy-first environment, and that’s why it’s often used by leadership teams to understand channel contribution, optimise budgets, and evaluate overall ROI across a full media mix

MMM is slower-moving than attribution, making it better suited to quarterly budget allocation decisions than real-time bid management. But it is the only tool that gives a channel-agnostic, tracking-independent view of what is actually driving revenue across the whole mix. Used alongside incrementality testing (which can be used to calibrate and validate the MMM outputs), it provides the most robust, evidence-based cross-channel available for performance marketing decisions.

Plus, newly machine learning-enhanced MMM can now run at a more granular geo-level and refresh more frequently than traditional annual models, making it actionable for planning cycles rather than purely retrospective. Platforms, including Google's Meridian (open-source) and commercial providers such as Analytic Partners and Nielsen, are all worth evaluating depending on team size and data maturity.

‍

Take it as a whole

‍

Look at these individually, and none of them is perfect. Patch them together, and they will create a measurement framework that’s far more resilient.

And again, the key difference is mindset, so instead of chasing complete visibility (leave that in the past… that’s so 2025), reach to become a leading brand, and build a system that works despite the said visibility.

Focus on directional confidence, which enables you to say, with reasonable certainty, what’s contributing to growth and what isn’t. Because the reality is, the rules have changed. GDPR has reshaped how and when data can be collected, while Google’s evolving stance on cookies has preserved the appearance of tracking without restoring its former reliability.

Given this, a layered, multi-method approach to measurement isn’t a temporary fix, but how marketing works now.

‍

‍