Advanced · Lesson 2 of 4
First-party data, consent and fewer third-party cookies
About 11 minutes · Yogender Kumar, Managing Partner
By the end of this lesson you'll be able to
- Explain how UK consent rules limit what tracking can see
- Estimate the real total from consented conversion data
- Plan how to build and use your own first-party data
Why this matters
Your shop took 1,000 orders and your analytics shows 600. Nothing is broken: consent rules and browsers cause the gap. Knowing its size stops you cutting channels that work.
The core idea
Third-party cookies are set by companies other than the site you're on, such as ad platforms. They let those companies follow people across sites.
They're already limited in three ways:
- Browsers. Safari blocks third-party cookies by default, and Firefox blocks known trackers and walls off the rest. Chrome still allows them by default, though users can switch them off. Browser plans keep changing, so check the current position.
- Consent. In the UK, PECR means advertising cookies need the visitor's agreement first. Many people say no.
- Devices. People browse on a phone and buy on a laptop, and cookies don't follow them.
The Data (Use and Access) Act 2025 adds exceptions for some low-risk cookies, such as certain statistics cookies, where people are told and can opt out. It's coming in in stages, so check the ICO's current guidance. Advertising cookies still need consent.
So every tool sees part of the picture. Your order system sees all of it.
First-party data is what people give you directly: customer records, email subscribers, purchase history. You collect it with permission, you own it, and it doesn't depend on anyone else's cookie.
Worked example
Rowan Kids is an imaginary UK children's clothing shop, so the figures are illustrative. In March its shop system records 1,000 orders. Its analytics, which only runs for visitors who accept cookies, shows 600.
About 60% of visitors accept cookies, so the gap is what you'd expect. Rowan estimates each channel's real total by dividing what analytics sees by the consent rate. Paid social shows 120 orders in analytics, so its estimate is 120 ÷ 0.6 = 200.
That's an estimate. It assumes people who accept cookies buy the same way as people who don't. Rowan checks it against its order records, using discount codes and customer surveys.
Then the first-party side. Rowan has 20,000 email subscribers who opted in. A new-season email brings 300 orders for the cost of the email software. At its paid CPA of £25, buying those orders through ads would have cost about £7,500. That's an upper figure, because some of those customers would have bought anyway (Lesson 1).
Rowan also uploads hashed customer lists to ad platforms, only for people it has a lawful basis to use, and says so in its privacy notice. That lets it exclude existing customers and find similar new ones.
My view: treat your email list as a channel with its own targets, not as an afterthought.
Rowan Kids' March orders, by who counted them
In practice
- Compare analytics orders with your order system every month, and know your consent rate.
- Estimate totals by dividing consented numbers by the consent rate, and say it's an estimate.
- Make your cookie banner honest: rejecting as easy as accepting.
- Grow your email list with a clear reason to join, and record each consent.
- Send conversions to ad platforms from your server where you can (a postback), for consented users.
- Cover customer list uploads in your privacy notice.
Common mistakes
- Treating analytics as the full count. It only sees people who agreed. Use your order system as the total.
- Cutting a channel on undercounted data. A channel that looks weak may just be poorly tracked. Check against orders first.
- Nudging people into accepting. A banner that hides the reject button breaks the rules. Make both choices equal.
Try it yourself
Your shop records 2,400 orders in a month. Analytics shows 1,560, and your cookie consent rate is 65%. Search shows 390 orders in analytics. What's your estimate of search's real total, and does the overall gap match the consent rate?
Show answer
Search estimate: 390 ÷ 0.65 = 600 orders. Overall, 1,560 ÷ 2,400 = 65% of orders are seen, which matches the consent rate. So the estimate method fits this month's data.
Quick check
Not scored. Pick an answer to see the explanation.
Under UK rules, what do advertising cookies need before they're set?
Analytics shows 300 orders from a channel. Your consent rate is 75%. What's your estimate of its real total?
Key takeaways
- Browsers, consent and devices all limit what tracking sees.
- Your order system is the full count. Tools see the consented part.
- Estimate totals from the consent rate, and call it an estimate.
- First-party data, collected with permission, is yours to use.