Analytics Consent and Marketing Consent Are Two Different Decisions. Your Banner Treats Them as One.

Analytics measures the site. Marketing follows the user. They are different purposes, with different data, different defaults, and different consequences, and a banner that bundles them into one toggle is asking for a consent that covers neither properly.

One toggle, two laws

The banner offers one switch, labeled cookies or tracking or personalization, and the user toggles it on or off. Behind that switch are two different purposes. Analytics measures the site: how many visitors, which pages, where they came from, how long they stayed. Marketing follows the user: which ads they saw, which products they viewed, which campaigns brought them back. The data is different, the retention is different, the third parties are different, and the legal basis is different. Analytics can often rely on legitimate interest or a narrow consent. Marketing, especially advertising personalization and cross-site tracking, needs explicit consent in the EU, and the consent has to be specific to that purpose.

Bundling them into one toggle means the user cannot consent to analytics without also consenting to marketing, or cannot refuse marketing without also refusing analytics. That is not a choice. It is a package, and consent that is bundled is not freely given, which is the first requirement in the GDPR definition and in the EDPB guidelines. The banner that simplifies the choice into one toggle has simplified away the consent.

What analytics consent actually permits

Analytics consent permits measuring the site: page views, session counts, traffic sources, and conversion events, aggregated and used to understand how the store performs. It does not permit building a profile of the individual, following them across sites, or sharing their behavior with advertising networks. The data stays with the analytics tool, the retention is bounded, and the user can be measured without being identified. That distinction is the reason analytics can sometimes proceed on a narrower basis than marketing, and it is the reason the toggle for analytics should be separate and default to a more permissive setting than the marketing toggle.

The analytics toggle should also be honest about what it does. A banner that labels the toggle analytics but wires it to a tag that also sends data to an advertising platform is mislabeled, and the mislabeling is the violation. The toggle must match the tag, and the tag must match the purpose, or the consent is for something the site is not doing.

What marketing consent adds

Marketing consent permits the rest: advertising personalization, remarketing lists, cross-site tracking, and sharing with the ad platforms and data partners that make those possible. It is the consent that lets the store follow the user after they leave, show them the product they viewed, and measure which ad brought them back. It is also the consent that carries the highest risk, because the data leaves the store and enters systems the store does not control, and the user cannot withdraw it from those systems by toggling a switch on the store.

The marketing toggle should default to off, and it should stay off until the user turns it on. A pre-ticked marketing box is not consent, and a banner that treats marketing as the default is a banner that has already decided for the user. The default matters more than the toggle, because most users never change a default, and a default that favors the business is a default that takes the choice away.

The toggle layout that survives a complaint

Two toggles, clearly labeled, with plain-language descriptions of what each one does, and both defaulting to off, with the analytics toggle explained as measurement and the marketing toggle explained as advertising and tracking. The user can turn on analytics and leave marketing off, which is the combination most users want, and the site can measure its performance without following its visitors. The settings panel should show which vendors receive data under each toggle, because a marketing toggle that lists 800 vendors is a toggle the user cannot meaningfully evaluate, and the vendor list should be trimmed to the vendors the site actually uses. The layout is simple, the defaults are honest, and the consent is specific, which is the test it has to pass.

Frequently asked questions

Can I bundle analytics and marketing into one consent toggle?

No. They are different purposes with different data and different legal bases, and consent has to be specific to each purpose. A single toggle forces the user to accept or refuse both together, which is not freely given consent.

Should the marketing toggle default to on or off?

Off. Marketing consent has to be an active choice, and a pre-ticked box is not consent. Most users never change a default, so a default that favors the business takes the choice away.

What does analytics consent actually allow?

Measuring the site: page views, sessions, traffic sources, and conversions, aggregated and used to understand performance. It does not allow profiling the individual, cross-site tracking, or sharing with advertising networks.

Why does the vendor list matter for consent?

Because consent has to be informed, and a marketing toggle that lists 800 vendors is not a choice the user can evaluate. Trim the list to the vendors the site actually uses, so the toggle means something.