Measurement
Part of 10 privacy first measurement tactics for UK ecommerce brands
10 privacy first measurement tactics for UK ecommerce brands
Ten privacy first measurement tactics for UK ecommerce brands, from consent state logging to server-side tagging, reconciliation and quarterly holdouts.
What to take away
- Consent state decides what you may store, so settle that before any attribution question.
- Order confirmation data is first party, but it is not blanket permission to profile shoppers.
- Moving tags server-side changes where processing happens, not whether you need a lawful basis.
- Reconciling shop totals against analytics totals is the cheapest audit available to a small retailer.
- Ten tactics below, most of them low cost, close the gaps that survive a cookie change.
How PECR and UK GDPR split the work
A UK retailer answers to PECR for what it stores on a shopper's device, and to the UK GDPR for the personal data that follows. The ICO's guidance on direct marketing and electronic communications explains how the cookie rule interacts with marketing consent.
PECR vs UK GDPR
PECR
- Question asked
- Permission to store?
- Scope
- Device identifiers
- Also covers
- Cookie rule
- Regulator
- ICO
UK GDPR
- Question asked
- Why hold data?
- Scope
- Personal data
- Also covers
- Retention and sharing
- Regulator
- ICO
The two rulebooks ask different questions. PECR asks whether you had permission to place or read the identifier. The UK GDPR as retained EU law then asks why you hold the data, how long you keep it and who else sees it.
Shopify, WooCommerce and bespoke stacks differ in how much they hand you by default, and most return an order object plus a session identifier. Neither lets you join the two across every shopper.
The tool you pick to hold them decides what you can export later. Our comparison of privacy first analytics tools for UK websites covers export behaviour specifically.
Ten tactics, ordered by effort rather than novelty
Start with the cheap controls and finish with the decisions that need sign-off. None of these requires a new platform.
- Log the consent state with every event.A permission value beside the timestamp lets you filter later to shoppers who allowed measurement, instead of guessing who was in scope.
- Keep order records apart from browsing records.Fulfilment and accounting justify order data on their own. Browsing histories answer different questions and carry a different risk profile.
- Use one identifier per purpose.An order number, a hashed email and an analytics cookie should not be joined unless you can name the reason and the lawful basis in writing.
- Reconcile weekly.Compare shop platform revenue against analytics revenue for the same seven days. A gap you can explain is a finding; a gap you cannot explain is a measurement failure.
- Walk the checkout with consent refused.Test the funnel as a shopper who declines everything, then record where tracking breaks and what the trading team loses.
- Move tag execution server-side, and keep the paperwork.Server-side tagging reduces what leaks from the browser, but the processing still needs a basis. Our guide to server-side tracking under UK GDPR sets out the records a reviewer asks for.
- Decide what first-party data you actually need.A written plan that links each signal to a decision is how you avoid collecting more than the business will use.
- Run one incrementality test a quarter.Take the channel you trust least, hold spend back from part of the audience, and compare contribution rather than platform-reported conversions.
- Keep an aggregate model for the top of the funnel.Media mix modelling works on spend and sales totals, so it needs no individual-level consent and survives a change in device signal.
- Protect the measurement store.Where order data and pseudonymous identifiers share a database, information security is part of the argument. ISO 27001 information security management is the certification partners ask about first.
Where the numbers still mislead
Platform-reported conversions flatter the platform that produced them. A quarterly holdout gives a smaller number with a clearer meaning, and it is the figure worth defending in a trading meeting.
Write the uncertainty down. If the interval is wide, say so rather than presenting a point estimate as a fact.
Common questions
Do we need consent to measure orders?
Order data needed to fulfil a contract sits on a different footing from marketing analytics. Using the same records to build audiences needs consent or another lawful basis.
Is server-side tagging a way around consent?
No. It changes where the processing happens and reduces what the browser exposes. The obligation to have a lawful basis and to tell people what you do travels with the data.
What should a small retailer measure first?
Reconciliation. Comparing shop platform revenue with analytics revenue for the same week is cheap, repeatable and exposes gaps that no new tool will fix.
