What tracking does with a consent answer
Understand how consent changes tracking collection, identity and reports.
Lepsto Tracking reads the visitor’s consent choice and switches between full and cookieless collection. It does not display a banner or collect the choice itself.
On pages that use the Lepsto banner, load the banner first and put data-consent="banner" on the tracking snippet. The declaration prevents an undecided visitor from being treated as a visitor on a site with no banner while the banner loads.
This page is not the banner
Consent and Tracking handle different parts of the same visit:
Lepsto Tracking | ||
|---|---|---|
Purpose | Ask for a choice and store a signed decision | Adjust collection using that choice |
Browser behavior | Show preferences and block declared third-party resources | Use full or cookieless collection |
Configuration | Providers, categories, appearance and banner snippet | Declare the banner on the tracking snippet where it is installed |
You can use either feature independently. Tracking uses full mode when no banner or recorded decision is detected, as described below.
Keep the tracking snippet loaded on every page you want measured. Do not insert it only after acceptance: that would omit visitors who decline or leave without answering. Install the banner above it, without async or defer, and request tracking snippets with tracking_snippets_get and consentBanner: true for pages using the banner. See Install the tracking script.
The three states
Each event carries the consent state under which it was collected. One visit can therefore contain events in different states.
State | Condition | Collection |
|---|---|---|
Granted | Statistics consent is recorded as allowed | Full mode |
Declined | A banner is declared or detected, but statistics is denied or undecided | Cookieless mode |
No banner | No stored decision, declaration or banner object is detected | Full mode |
Tracking keeps declined and no-banner events distinct. Statistics controls cookie use and visitor identification. Marketing controls the consent information sent to Google Ads about a click; see Google Ads.
How the script learns the answer
Before using cookies, Tracking checks these signals in order:
- A readable stored decision, checking
lepsto_consentfirst and legacylessly_consentsecond. An unreadable new cookie does not hide a usable legacy choice. A recorded choice takes precedence. data-consent="banner"on the tracking tag. With no decision yet, collection starts cookieless even if the banner has not loaded.- A
window.LepstoConsentorwindow.LesslyConsentobject. With no recorded choice, its presence is treated as undecided and therefore cookieless. - If none is present, the event uses the no-banner state.
When waiting for a declared banner, Tracking leaves a callback queue for it in window.LepstoConsent without replacing an existing runtime object. Acceptance can then switch collection on the same page. If the banner never loads, that page remains cookieless.
The declaration is off by default. Do not add it to pages without a Lepsto banner: no choice would arrive, so those visitors would stay cookieless. It also does not replace loading the banner first. Without it, a tracking script that runs before an undecided visitor’s banner can see no signal and use full mode.
What is collected with consent
Full mode includes page views, custom events and their properties, anonymous and session identifiers in cookies, identify calls, cross-domain linking and full page URLs with campaign tags and advertising click ids.
What is collected without it
Cookieless collection writes no cookies and creates no browser identifiers. It does not probe the cookie domain or perform cross-domain linking. Each ping contains:
- Event name and time.
- Page origin and path, with the query string removed in the browser.
- Referrer origin.
- Only these campaign fields:
utm_source,utm_medium,utm_campaign,utm_content,utm_term,_lt_campaign,_lt_adgroup,_lt_creative,_lt_keyword,_lt_network,_lt_matchtypeand_lt_extid.
The allowlist excludes _lt_device and advertising click ids such as gclid. Allowed campaign values can still be sent as separate fields; removing the page query string does not remove those values.
Omitted data | Effect |
|---|---|
Custom properties | lt('track', …) keeps the event name but drops its properties |
Identity calls | lt('identify', …) is dropped entirely |
Person association | Events create or join no person and do not appear in People, person journeys, person-level attribution or funnels |
Advertising click id | A paid click cannot be linked to a later conversion through that id |
Stored cookieless pings still contribute to event totals, the event catalog, Live and paid tracking health on the Google Ads page. Collection is subject to the product’s current tracking limits; a sent ping is not by itself proof of storage. See Tracking troubleshooting.
Person-level reports and funnels cannot include cookieless visitors, since there is no person to follow across events. See Read the attribution reports.
Counting people without identifying them
On arrival, cookieless pings receive a counting key derived using a secret that is destroyed at UTC midnight. The same visitor gets a different key the next day.
This limits what counts can mean:
- Across multiple days, repeat visitors count again. One visitor on ten days can contribute ten daily visitors.
- Returning-visitor, retention and frequency analysis cannot connect these visits across days.
Use a single UTC day to avoid that cross-day duplication. The daily mechanism does not recover an exact multi-day count later. Paid tracking health on the Google Ads page shows how many paid clicks in its window were cookieless.
When consent changes during a visit
Tracking responds to the banner’s change signal on the same page without needing a reload.
Acceptance enables full mode immediately, creates the identifiers and restores cross-domain linking. Subsequent identify calls are sent normally.
Withdrawal switches to cookieless mode and deletes _lt_aid and _lt_sid. Subsequent events are pings. The banner may separately reload the page to stop other trackers that already ran.
Events already sent keep their original state. Acceptance does not enrich earlier pings, and withdrawal does not delete earlier events. For erasure, delete the person.
Sites with no banner
Without a banner, declaration or stored choice, Tracking uses full mode and records no consent answer. This behavior does not determine whether your site needs to ask for consent; configure Lepsto Consent when your site needs the banner.
Events sent from your backend
Backend events sent with an API key, including revenue and other lifecycle events, carry no browser consent answer and are stored as unknown. You are responsible for deciding whether you may send them.
Workflow triggers are a different surface
Enabling Workflow trigger for an event name can send personal data into your workflow independently of tracking consent choices. The trigger payload includes the person’s email address and phone number; it excludes the event’s free-form properties.
Before enabling it, check the basis for sharing those identifiers with each workflow step, any third party the step calls, and organization members who can read runs. Nothing is published for an event name until enabled; disabling it stops further publication. With no enabled names, the trigger emits nothing.
Keeping the script current
The tracking filename stays the same and the script has a short cache lifetime. Existing installations receive updates within about ten minutes without replacing the snippet. Adding data-consent="banner" is a separate installation change for pages that use the banner.
Next steps
- Lepsto Consent: understand how visitor choices are collected and recorded.
- Add a cookie consent banner: install and check the banner.
- Install the tracking script: configure the tracking tag.
- Read the attribution reports: understand report coverage and attribution limits.
- Data and privacy: review platform data handling.