Why 60% of Your Analytics Data Is Missing,
and How to Fix It

In the GDPR-compliant analytics setups of many Hamburg businesses, a large share of visitors never shows up in the reports. The data behind your budget decisions, content plans and page optimisations reflects only part of reality. The tracking code works as it should. The gap comes from visitors who decline cookies and from a consent setup that drops them from the data completely.

The problem most website owners don't see

Most businesses have no idea their analytics data is incomplete. GA4 reports sessions, conversions and bounce rates without a disclaimer saying: "These numbers only apply to the visitors who accepted cookies."

What happens when users reject cookies

Without Consent Mode v2, Google Tag Manager sends nothing to GA4 or Google Ads when a user declines cookies. For your reports, that session does not exist. If the same user comes back three days later after clicking a retargeting ad and completes a purchase, your reports show zero conversions from that campaign path.

German courts require the "decline" option to be as easy to reach as "accept" (OLG Köln, 19 January 2024, 6 U 80/23). Every visitor who uses that option disappears from your reports. If you measure only consenting users, you work with a systematically skewed picture of your own business.

The hidden cost: decisions based on wrong numbers

Say a Hamburg retailer with 10,000 monthly website visitors spends €2,000 on Google Ads, and 60% of visitors decline cookies. GA4 shows 40 conversions, and the cost per acquisition looks acceptable at €50. In reality, 100 conversions occurred, with 60 more coming from users who rejected cookies. The real CPA is €20, two and a half times better than the data suggests. The business owner doesn't know this and under-invests in campaigns that are working.

The same gap does damage in the other direction, too. Campaigns that perform well get paused because the attributed conversions show only a fraction of reality. Strong campaigns receive too little budget, and the ones that look weak may be the ones driving growth.

New website in Hamburg? These GDPR requirements apply from day one

Many Hamburg businesses think about web design Hamburg first in terms of colours, layouts, and load times. GDPR-compliant tracking tends to come up only after the first enforcement letter arrives, or when GA4 still fails to produce usable data weeks after launch.

Anyone getting a website built in Hamburg should plan the analytics setup as a requirement from the start. Section 25 TDDDG applies from the first moment the site goes live, regardless of ad campaigns or traffic volume. Before Google Analytics, Facebook Pixel or any heatmap tool goes active, a legally compliant Consent Management Platform must be in place.

This sounds like extra work, but it is the more efficient path. Businesses that integrate a CMP from the start of a Hamburg web design project avoid the cost of retrofitting a live system later. They also avoid ending up with data from the first weeks after launch that is legally unusable because consent was missing.

Often a freelancer or agency delivers the finished website with tracking technically set up, but the cookie banner is missing or misconfigured. Many web designers treat data protection as someone else's concern, so it falls through the cracks. From the first visitor onwards, the site then collects data without valid consent.

If you're building or relaunching a website in Hamburg, you're better served by a partner who handles technical implementation and data protection compliance as a single brief instead of two separate workstreams.

What changed? TDDDG, GDPR, and the Digital Markets Act

From TTDSG to TDDDG: what changed in 2024

Germany's TTDSG (Telecommunications and Telemedia Data Protection Act) was renamed TDDDG (Telecommunications and Digital Services Data Protection Act) on 14 May 2024. The rename followed Germany's new Digitale-Dienste-Gesetz (DDG), which replaced the term "telemedia" with "digital services". Section 25 stayed the same in substance: it governs when information may be stored on or accessed from a user's device.

Section 25 TDDDG: what requires consent

Section 25(1) TDDDG prohibits storing information on a user's device (or accessing already-stored information) without prior consent. In practice, this means Google Analytics, Facebook Pixel, Google Ads conversion tracking, Hotjar, LinkedIn Insight Tag, and all similar tools must not load until the user has given active consent.

Exceptions apply only to "technically strictly necessary" storage, meaning cookies that make the website function (session cookies for a shopping cart, security tokens). Analytics does not qualify.

The Digital Markets Act and why Consent Mode v2 is now mandatory

Since March 2024, Google requires advertisers to collect consent from users in the European Economic Area and pass the consent signals to Google, for example through Consent Mode v2. Without those signals, measurement, ad personalisation and remarketing stop working for these users. Google tied the change to the Digital Markets Act, which designates Google as a "gatekeeper".

Businesses that use Google Ads or GA4 without consent signals break Google's EU user consent policy and lose features. Add the GDPR and TDDDG exposure, and implementation is no longer optional.

What German data protection consultants recommend

German data protection consultants have looked closely at Consent Mode v2, and the ones we follow prefer Basic Mode. In Advanced Mode, the website sends cookieless pings to Google even after a user has explicitly declined. Those pings carry the user agent, referrer and a timestamp from the visitor's device, so § 25 TDDDG likely requires consent for them as well. The consultancy behind datenschutz-notizen.de sees considerable residual risk in Advanced Mode for that reason.

Many agencies implement Advanced Mode by default because it produces more data. For a Hamburg business that wants to stay on the safe side, Basic Mode is the better default for the CMP configuration.

Consent Mode v2 explained without the jargon

Basic Mode vs. Advanced Mode: the difference and what it means

How Google handles missing data (conversion modelling)

In Advanced Mode, Google uses machine learning to estimate missing conversion data. Google knows how consenting users behave on your site. When a non-consenting user sends similar signals (clicked an ad, visited comparable pages), Google estimates the probability that this user would have converted and adds those modelled conversions to your reports.

That sounds helpful, but modelled conversions are estimates, not measured facts, and the difference matters when you set budgets. GA4 labels modelled data, but many users miss the label in their dashboards.

What Consent Mode v2 does not solve

Consent Mode v2 does not fix a poorly designed cookie banner. If declining is hidden or cumbersome on your banner, you have a technical Consent Mode implementation, but your process is still not GDPR-compliant. Germany's Datenschutzkonferenz (DSK) has made clear that consent must be freely given, informed, and unambiguous. Dark patterns (manipulative banner designs) are explicitly prohibited.

Cookie banners in 2026: what compliant means (checklist)

The 7 most common cookie banner mistakes German SMBs make

In 2021, Germany's consumer organisations led by the Verbraucherzentrale Bundesverband (vzbv) reviewed 949 websites and sent 98 formal warning letters over clearly unlawful banners (vzbv press release). These seven failures keep appearing:

What a TDDDG-compliant banner needs

• Clear distinction between technically necessary and optional cookies
• Equivalent "decline" and "accept" buttons on the first layer
• Granular selection by purpose (analytics, marketing, preferences)
• No pre-checked boxes for optional purposes
• Full list of tools and third parties receiving data
• Logged consent records with timestamps
• Accessible withdrawal option at all times (footer link)
• Link to the full privacy policy

Which CMP tools work for Hamburg SMBs

For many Hamburg SMBs, consentmanager is a pragmatic choice with a solid feature set. Cookiebot works well as an entry point for smaller websites. Usercentrics makes sense when managing multiple sites under one account or when complex reporting requirements apply. Prices and hosting locations change, so check the current plan and the provider's data processing agreement and subprocessor list before you sign.

Setting up GA4: analytics with and without consent

Google Analytics 4 + Consent Mode v2: a step-by-step overview

The technical implementation of Consent Mode v2 for Google Analytics involves four main steps:

1. Choose and install a CMP. Select a certified Consent Management Platform with native Consent Mode v2 support. Most current CMPs (Cookiebot, consentmanager, Usercentrics) come with native Google integration.
2. Configure Google Tag Manager and activate Consent Mode v2 there. The CMP passes the consent status to GTM via a dataLayer event before any other tags fire. Make sure to use "Consent Initialization" as the tag trigger.
3. Update the GA4 configuration tag by enabling "Consent Checks Required". GA4 then automatically sends pings in the correct mode (with or without cookies) based on the user's consent status.
4. Test and verify the setup. Use Google Tag Assistant and GTM preview mode to confirm Consent Mode initialises correctly. In GA4, check "Privacy > Consent" to verify the consent signals are being received.

Understanding data modelling in GA4

GA4 shows modelled data in many reports, marked by a small "Modelled" indicator. For strategic decisions, keep measured and modelled values apart. A working rule: use modelled data for trend analysis, and base budget decisions on measured numbers that you compare against your own historical benchmarks.

Server-side tagging as an alternative: when it makes sense

Server-side tagging moves tracking from the user's browser to your own server. Instead of Google collecting data directly in the browser, all tags run centrally through your server. You get more control, lose less data to ad blockers and may see better performance. On the other hand, setup and operation are considerably more complex and expensive. For SMBs with fewer than 50,000 monthly sessions, server-side tagging is rarely the right approach unless you have specific data protection requirements.

GDPR-friendly alternatives to GA4 (etracker, Matomo, Plausible)

Not every business needs GA4. If you want to simplify your analytics setup and reduce data protection risk, there are options:

• etracker is based in Hamburg. In certain configurations it is GDPR compliant without mandatory consent, it stores data in Germany, and its feature set is somewhat lighter than GA4's.
• Matomo can be self-hosted, which is free and gives you full data control, but the setup is more complex.
• Plausible is built for privacy from the start and uses no cookies. Because it stores nothing on the visitor's device, it usually needs no consent under § 25 TDDDG, but its reporting is very simple.

For businesses running Google Ads, GA4 with Consent Mode v2 remains the most practical option, because GA4 and Google Ads then work from the same conversion data. If you're not running paid ads, switching to Plausible or etracker removes most of the cookie banner complexity.

What a bad tracking setup costs your business

Fine risk and enforcement for Hamburg SMBs

Enforcement does happen: in 2021 the vzbv and its partners reviewed 949 websites and sent 98 formal warning letters. Under GDPR Art. 83, data protection authorities can impose fines of up to €20 million or 4% of global annual revenue, whichever is higher. The actual amount depends on severity, duration and whether it's a repeat offence. Legal fees and reputational damage come on top.

Beyond regulatory fines, competitors and consumer protection organisations can pursue civil enforcement under German competition law (UWG). A non-compliant cookie banner can be treated as an unfair business practice. Our website security guide covers more on technical compliance requirements.

Lost conversion data = lost advertising budget

Bad analytics also costs money directly, through mis-allocated advertising spend rather than fines. The table below shows the scale of data loss for three typical business sizes:

Assumptions: visitors decline cookies in 60% of visits (the average etracker measured for compliant banners in 2025), 2% conversion rate. Your own rejection rate depends on the banner design, the audience and the traffic source, and conversion rates vary by industry.

The domino effect: bad analytics weakens Google Ads bidding

Google Ads uses conversion data to optimise its bidding strategies, so the damage goes beyond incomplete reports. If GA4 only reports 40% of actual conversions, Smart Bidding learns from a fraction of the real results and treats working campaigns as weaker than they are. It may then bid too cautiously, and your ads win fewer auctions. On top of the missing data, a broken analytics setup costs you money directly in your Google Ads account.

For this reason, experienced online marketing agencies in Hamburg audit the analytics setup before any campaign goes live. Our Google Ads Hamburg 2026 guide covers how to run effective Google Ads in Hamburg with correct attribution.

What Hamburg businesses should do now

5-step action plan for GDPR-compliant tracking in 2026

When to bring in a specialist

Sometimes doing it yourself ends up more expensive. If you're running Google Ads and haven't implemented Consent Mode v2 yet, you're losing conversion data every day, and the missing data degrades your bidding algorithm's performance. Every week without a correct setup costs money.

If nobody with data protection expertise has ever reviewed your cookie banner, you don't know whether it's compliant, and self-assessments here are unreliable. The CMP-GTM-GA4-Google Ads chain has several points where errors can go unnoticed. A wrong trigger type in GTM can make tags fire before consent, and you won't see that failure without deliberate testing. We also help with optimising your local digital visibility in Hamburg, since accurate analytics is the foundation for everything else.

Local SEO Hamburg: why you need clean tracking

For local SEO in Hamburg, clean tracking matters for your own decisions. Google does not use your GA4 or Google Ads conversion data to rank your pages in organic or local search. You use that data to judge which pages and districts bring in customers.

Micro-conversions count as well. Phone clicks, direction requests and form submissions show you which local pages work. When broken tracking undercounts them, you rate pages that bring in local customers as weaker than they are and may rewrite or drop the wrong ones.

For businesses operating across the Hamburg region, in the core city and the surrounding districts, this is a practical concern. A working consent setup makes regional conversion paths measurable in the first place. Without it, you judge your local SEO work on incomplete data.

SEO in Hamburg: how Consent Mode v2 affects your SEO decisions

Your consent setup does not change your organic rankings. Google ranks pages on their content and relevance, not on what GA4 or Google Ads measure, and ad spend has no effect on organic or local positions. The connection runs through your decisions: you plan SEO work with the data GA4 gives you, and that data is only as good as your consent setup.

Hamburg businesses that run Google Ads and organic SEO side by side feel this directly. A good SEO agency in Hamburg treats Consent Mode v2 as part of the technical foundation instead of an optional add-on. Without it, every recommendation built on GA4 data rests on a skewed sample, and optimisation decisions will regularly land in the wrong place.

It also changes how you read GA4 reports. GA4 calculates engagement rates, session durations and conversion rates from a population that excludes everyone who declined. Pages that perform well for non-consenting users look worse in the reports than they are, which leads to content changes or budget shifts that make things worse. Anyone serious about local SEO in Hamburg needs valid data as the starting point.

Then there is the striking-distance effect. Many Hamburg websites rank on pages 3 or 4 for commercially relevant queries, where small quality improvements can produce measurable ranking gains. If you prioritise those improvements based on bad data, the effort goes to the wrong pages. Beyond compliance, a clean Consent Mode v2 setup is the precondition for judging whether your SEO investment is working.

Frequently asked questions about GDPR analytics and Consent Mode v2